Sign in to follow this  
Followers 0
xpclient

Extract wallpaper path from registry

4 posts in this topic

So let me give you some background of my problem so you don't wonder "why would you want to do that"? Windows 7 introduced a nice slideshow feature so you can set for example, you entire Pictures library as wallpaper and have it cycle through your awesome collection. But when you install themepacks which come with multiple wallpapers in one theme, there are some pictures you don't like and wish to delete. So it would be nice while the slideshow was set, if you could determine the current wallpaper's path and delete the image if you don't like it. For Windows 7, I found a useful little script that precisely did this (http://www.pretentiousname.com/miscsoft/#delwall). The current desktop background is stored in the Registry at HKCU\Software\Microsoft\Internet Explorer\Desktop\General: String value: WallpaperSource. The script reads the current desktop background image from the registry and deletes it.

Now we got Windows 8 and Microsoft as we know likes to make our lives more difficult, annoying and delete/change features just for fun. In Windows 8, the current wallpaper is no longer stored at the above mentioned registry key which is a plain string value. Instead it is stored at HKCU\Control Panel\Desktop\ as a REG_BINARY value: TranscodedImageCache. So I wrote a little VBScript again to decode the REG_BINARY value and get the wallpaper source. This script is attached to this post (GetWallpaperSource.zip). But the problem is that TranscodedImageCache value also seems to store some other garbage in that value besides the image path. The value I get as output contains these extra bits I don't want before the wallpaper path begins. And my VBScript skills aren't advanced enough to read only a portion of a REG_BINARY value ignoring the initial binary data which is garbage.

So my question is can anyone help me get *just* the wallpaper source in one way or the other by writing any script, VBS or PowerShell or a little program so I can delete the current wallpaper quickly?

Edited by xpclient
0

Share this post


Link to post
Share on other sites

Yeah, I think a powershell way would be easier, I've found some useful Hex bits at sans.org.

http://www.sans.org/windows-security/2010/02/11/powershell-byte-array-hex-convert

Looking at my 8.1 machine the first 24 bytes are garbage, then begins plain text path, followed by hundreds of zero's padding.

Header7a,c3,01,00,c2,87,00,00,05,01,00,00,f1,00,00,00,dc,\  b4,b1,18,d5,ab,ce,01,Header is slightly different each time.7a,c3,01,00,e4,ef,00,00,80,07,00,00,b0,04,00,00,aa,\  ab,d2,f1,28,b5,ce,01,The goods.   This is the path in plain text (as hex)5a,00,3a,00,5c,00,53,00,68,00,61,00,72,00,65,00,64,00,\  5c,00,4b,00,72,00,79,00,74,00,65,00,6e,00,2d,00,52,00,65,00,64,00,44,00,77,\  00,61,00,72,00,66,00,2e,00,6a,00,70,00,67,00"TranscodedImageCache"=hex:7a,c3,01,00,c2,87,00,00,05,01,00,00,f1,00,00,00,dc,\  b4,b1,18,d5,ab,ce,01,5a,00,3a,00,5c,00,53,00,68,00,61,00,72,00,65,00,64,00,\  5c,00,4b,00,72,00,79,00,74,00,65,00,6e,00,2d,00,52,00,65,00,64,00,44,00,77,\  00,61,00,72,00,66,00,2e,00,6a,00,70,00,67,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

I guess the simple way from VBS would be to skip over the first 24 bytes when you run your loop. Start a counter, i = i+1, then make an if i = less than 24 skip to next byte.

0

Share this post


Link to post
Share on other sites

Ah thank you very much. That helped. It is that easy! I fixed my script :) and updated that script by Leo Davidson to get current wallpaper and delete it. (Attached to post)

DeleteWallpaper.zip

Edited by xpclient
0

Share this post


Link to post
Share on other sites

Ah thank you very much. That helped. It is that easy! I fixed my script :) and updated that script by Leo Davidson to get current wallpaper and delete it. (Attached to post)

Thanks, a lot! Great job

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.