Specific Unicode Character Searching in Relevance

(imported topic written by SystemAdmin)

We have a request from one of our users to query the value names under a specific registry key, looking for the following Unicode characters if they are surrounded by ASCII characters:

0E20

0F20

2A20

2B20

2D20

2E20

2C20

Ignoring the “surrounded by ASCII characters” part I have not been able to get the Unicode values to trigger properly using regex. Is this because I am doing this wrong, or does Bigfix or Windows convert the Unicode characters to ASCII prior to the relevance even executing? Some examples of what I have tried:

number of matches (regex ".

\u202E.

") of

names of values of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache” of registry

number of matches (regex ".

\x{202E}.

") of

names of values of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache” of registry

(imported comment written by brolly33)

Kevin,

Wha does this query give you as a return on a system you would want to evaluate to True?

q: names of values of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache” of registry

Try turning on hex encoding of results in your debugger and see if the hex codes help you at all.

(File>>Preferences>>Percent Encode Results)

You may end up needing to use strings with hex encodeing.

q: “%0e%20”

A: