As an update, I’ve found something potentially related:
concatenation of characters ( bytes (( 72 + (it * 2) ) of ( positions whose (it < ((
byte (
byte 20 of it) of files
"<filename>.JOB" of folder
"tasks" of windows folder)) - 1 ) of (
"..............................................................." &
"................................................................" &
"................................................................" &
"................................................................" ) ) ) of files
"<filename>.JOB" of folder
"tasks" of windows folder)
I’m not yet sure how I’ll use this to split up a Registry.pol file into its individual registry keys and values, but I feel like that’s on the right track and might nudge someone’s memory.
I also think we can create the string of “.” dynamically to create a string of arbitrary size to use as an index of positions:
q: concatenation of "." of integers in (0, 255)
A: ................................................................................................................................................................................................................................................................
q: concatenation of "." of (integers in (0, size of it)) of file "c:\temp\hi.txt"
A: .................................................
T: 0.160 ms
I: singular string
And there’s a reference on the Registry.pol file format at https://msdn.microsoft.com/en-us/library/windows/desktop/aa374407(v=vs.85).aspx
Unfortunately there doesn’t seem to be a good way to delimit the file. My earlier attempts were to concatenate substrings separated by “%00” of the file lines…but “%00” is also used as a valid value frequently within the file. We also can’t assume that the “;” character is always a delimiter between [key;value;type;size;data], because if the value is one of the “**DelValues” or “**DeleteKeys” directives, a semicolon-delimited list of key/value names follows. And I’m not sure how safe it is to use “[” and “]” to separate directives, I’m not sure how a square-bracket would be escaped if it’s part of the data.