Version of File whose Path is from Registry

Content Authoring
1

I have the following relevance that pulls a file path from the registry. Then I am trying to use the path from the registry to check a file version, but the version is not returned. It returns blank. The relevance that gets the path is correct but when I add the version part, it falls apart.

versions of files (preceding text of first " " of ((value "ImagePath" of keys whose (name of it as string contains "bomgar" and value "DisplayName" of it as string contains "Bomgar Jump Client" as string) of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services" of (native registries) as string)))
2

If the file is running as a service, would pulling the service version achieve what you need?

Q: versions of services "besclient"
A: 9.2.5.130
1 Like
3

Thanks. That is a great idea.

4

This is how you would do it with the BES Client:

versions of (files it) of unique values of (following text of first "%22" of it | it) of (preceding text of last "%22" of it | it) of (preceding text of last "%00" of it | it) of (it as string) of values "ImagePath" of keys whose(value "DisplayName" of it as string = "BES Client") of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" of (x64 registries; x32 registries)

This would be everything as long as my parsing works correctly, but it doesn’t take into account all cases, so this only works for some formats of ImagePath:

versions of (files it) of unique values of (following text of first "%22" of it | it) of (preceding text of last "%22" of it | it) of (preceding text of last "%00" of it | it) of (it as string) of values "ImagePath" of keys of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" of (x64 registries; x32 registries)

This is all of the ImagePath:

(it as string) of values "ImagePath" of keys of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" of (x64 registries; x32 registries)

This seems to be the ImagePath normalized:

unique values of (preceding text of first " /" of it | it) of (following text of first "\??\" of it | it) of (if (it as lowercase starts with "system32\") then ( (pathname of root folder of drive of system folder) & "\" & it ) else it) of (following text of first "\SystemRoot\" of it | it) of (expand environment string of it) of (following text of first "%22" of it | it) of (preceding text of last "%22" of it | it) of (preceding text of last "%00" of it | it) of unique values of (preceding text of first " -k " of it | it) of (it as string) of values "ImagePath" of keys of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" of (x64 registries; x32 registries)