One day my colleague asked me if there is a way to know the registered application to a specific extension, or how OS executes Notepad when user double clicks on any txt files. Here is my finding over it.
And here is the sample application source
using System;
using Microsoft.Win32;
namespace FileAssociationCheck
{
class Program
{
static void Main(string[] args)
{
while (true)
{
Console.WriteLine(“Extension:”);
string val = GetAssociatedFileName(Console.ReadLine());
Console.WriteLine(val);
}
}
private static string GetAssociatedFileName(string Extension)
{
RegistryKey ClassRoot = Registry.ClassesRoot;
String AssociatedFileName = “”;
if (ClassRoot != null)
{
try
{
RegistryKey ExtensionKey = ClassRoot.OpenSubKey(Extension);
if (ExtensionKey != null)
{
string ExtensionValue = (string) ExtensionKey.GetValue(“”);
RegistryKey FileTypeKey = ClassRoot.OpenSubKey(ExtensionValue);
if (FileTypeKey != null)
{
RegistryKey ShellKey = FileTypeKey.OpenSubKey(“shell”);
if (ShellKey != null)
{
String FileType = (String) ShellKey.GetValue(“”);
AssociatedFileName = String.IsNullOrEmpty(FileType)
? OpenDefaultKey(ShellKey)
: OpenSpecifiedKey(ShellKey, FileType);
}
FileTypeKey.Close();
}
ExtensionKey.Close();
}
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}
ClassRoot.Close();
}
return ParseString(AssociatedFileName);
}
private static readonly char[] nonChars = new[] {‘&’,‘”‘, ‘/’,‘%’,‘*’};
private static string ParseString(string name)
{
name = name.Trim(nonChars);
string[] split = name.Split(nonChars);
if(split.Length >0)
{
string str= split[0].Trim();
return str;
}
return “”;
}
private static string OpenSpecifiedKey(RegistryKey ShellKey, string CommandType)
{
string Value = “”;
RegistryKey SpecifiedKey = ShellKey.OpenSubKey(CommandType);
if(SpecifiedKey==null)
{
string[] names = ShellKey.GetSubKeyNames();
if(names.Length>0)
{
SpecifiedKey = ShellKey.OpenSubKey(names[0]);
}
}
if (SpecifiedKey != null)
{
RegistryKey CommandKey = SpecifiedKey.OpenSubKey(“command”);
if (CommandKey != null)
{
Value = (string)CommandKey.GetValue(“”);
CommandKey.Close();
}
SpecifiedKey.Close();
}
return Value;
}
private static string OpenDefaultKey(RegistryKey ShellKey)
{
String Value = “”;
RegistryKey OpenKey = ShellKey.OpenSubKey(“Open”);
if(OpenKey==null)
{
string[] names = ShellKey.GetSubKeyNames();
if(names.Length>0)
{
OpenKey = ShellKey.OpenSubKey(names[0]);
}
}
if (OpenKey != null)
{
RegistryKey CommandKey = OpenKey.OpenSubKey(“Command”);
if (CommandKey != null)
{
Value= (string) CommandKey.GetValue(“”);
CommandKey.Close();
}
OpenKey.Close();
}
return Value;
}
}
}
The program produce output as
Extension:
.msi
G:\WINDOWS\System32\msiexec.exe
Extension:
.dll
E:\Reverse engineering\Software\Olly Engines\odbg110 Shadow\Shadow.exe
Extension:
.rar
G:\Program Files\WinRAR\WinRAR.exe
Extension:
.dfaff
Extension:
.txt
G:\WINDOWS\system32\NOTEPAD.EXE
Extension:
.docx
G:\Program Files\Microsoft Office\Office12\WINWORD.EXE
Extension:
.doc
G:\Program Files\Microsoft Office\Office12\WINWORD.EXE
Extension:
.elx
Extension:
.msg
G:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
Extension:
.rar
G:\Program Files\WinRAR\WinRAR.exe
Extension:
.7z
G:\Program Files\WinRAR\WinRAR.exe
Extension:
Ya really useful code. I had been doing try -catch for sloving the same problem, but I was never satisfied with what I was doing.
Good job, secretbytes!