Subversion Repositories recyclebinunit

Compare Revisions

No changes between revisions

Regard whitespace Rev 74 → Rev 75

/trunk/Research/PurgeInfo Analysis.txt
0,0 → 1,85
 
Windows 95 "PurgeInfo" Analysis by Daniel Marschall
 
= Location =
 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\BitBucket: PurgeInfo (Binary)
 
= Data structure =
 
Offset 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
Data 48 00 00 00 01 00 00 00 0A 00 0A 00 0A 00 0A 00
Sign < cbSize > <GS > <Pa > <Pb > <Pc > <Pd >
 
Offset 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
Data 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00
Sign <Pe > <Pf > <Pg > <Ph > <Pi > <Pj > <Pk > <Pl >
 
Offset 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
Data 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00
Sign <Pm > <Pn > <Po > <Pp > <Pq > <Pr > <Ps > <Pt >
 
Offset 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f
Data 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00
Sign <Pu > <Pv > <Pw > <Px > <Py > <Pz > <PH > <PG >
 
Offset 40 41 42 43 44 45 46 47
Data 00 00 00 00 04 0D 02 00
Sign N1 N2 N3 N4 ?? ?? ?? ??
 
= Legend =
 
GS
Global settings
0x00 = Individual settings for every drive
0x01 = Global settings for all drives
 
Pa..Pz Percentage of the drive A..Z
PH Percentage of "homedrive" (drive '@', I am not sure what that means)
PG Percentage of all drives (Global setting)
0x00 = 0%
0x64 = 100%
 
N1
"Nuke on delete" setting in a bitmask (7..0)
Bit 0 (LSB) = Flag for device A
Bit 1 = Flag for device B
Bit 2 = Flag for device C
Bit 3 = Flag for device D
Bit 4 = Flag for device E
Bit 5 = Flag for device F
Bit 6 = Flag for device G
Bit 7 (MSB) = Flag for device H
 
N2
"Nuke on delete" setting in a bitmask (7..0)
Bit 0 (LSB) = Flag for device I
Bit 1 = Flag for device J
Bit 2 = Flag for device K
Bit 3 = Flag for device L
Bit 4 = Flag for device M
Bit 5 = Flag for device N
Bit 6 = Flag for device O
Bit 7 (MSB) = Flag for device P
 
N3
"Nuke on delete" setting in a bitmask (7..0)
Bit 0 (LSB) = Flag for device Q
Bit 1 = Flag for device R
Bit 2 = Flag for device S
Bit 3 = Flag for device T
Bit 4 = Flag for device U
Bit 5 = Flag for device V
Bit 6 = Flag for device W
Bit 7 (MSB) = Flag for device X
 
N4
"Nuke on delete" setting in a bitmask (7..0)
Bit 0 (LSB) = Flag for device Y
Bit 1 = Flag for device Z
Bit 2 = Flag for "homedrive"
Bit 3 = Flag for global setting
Bit 4 = Unknown
Bit 5 = Unknown
Bit 6 = Unknown
Bit 7 (MSB) = Unknown
/trunk/Research/ShellState Analyse.txt
0,0 → 1,49
Analysis of "Recycler confirm dialog" setting
Analysis of Byte #5 of
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
 
[ ] Unchecked
[X] Checked
[X]1st Checked and never changed settings of recycler
 
Windows 95b ohne IE4
ShGetSettings: NOT EXISTING!
[ ] 05h 0 0 0 0 0 [1] 0 1
[X] 01h 0 0 0 0 0 [0] 0 1
[X]1st ? ?
 
Windows 2000 Professional
ShGetSettings: OK
[ ] 25h 0 0 1 0 0 [1] 0 1
[X] 21h 0 0 1 0 0 [0] 0 1
[X]1st 20h 0 0 1 0 0 [0] 0 0
 
Windows 2000 Professional (Some other settings!)
ShGetSettings: OK
[ ] 65h 0 1 1 0 0 [1] 0 1
[X] 61h 0 1 1 0 0 [0] 0 1
 
Windows XP
ShGetSettings: OK
[ ] 35h 0 0 1 1 0 [1] 0 1
[X] 31h 0 0 1 1 0 [0] 0 1
[X]1st 30h 0 0 1 1 0 [0] 0 0
 
Windows 2003 Server EE, SP1
ShGetSettings: OK
[ ] 3Eh 0 0 1 1 1 [1] 1 0
[X] 3Ah 0 0 1 1 1 [0] 1 0
[X]1st 33h 0 0 1 1 0 [0] 1 1
 
---
 
Unknown sources:
 
http://www.msfn.org/board/single-shellstate-disable-recycle-delete-conf-t122649.html
(!) If this is true, the behavior of the 3rd bit seems to have toggled (which I do not believe)
[ ] 2Ah 0 0 1 0 1 [0] 1 0
[X] 2Eh 0 0 1 0 1 [1] 1 0
 
Unknown Source
? 27h 0 0 1 0 0 [1] 1 1
? 23h 0 0 1 0 0 [0] 1 1
/trunk/Research/bitbucket_win10.reg
Cannot display: file marked as a binary type.
svn:mime-type = application/octet-stream
Property changes:
Added: svn:mime-type
+application/octet-stream
\ No newline at end of property
/trunk/Research/commandstore_test.reg
Cannot display: file marked as a binary type.
svn:mime-type = application/octet-stream
Property changes:
Added: svn:mime-type
+application/octet-stream
\ No newline at end of property