[RESOLVED] Registry getsetting, savesetting, is an issue with non typeble ANSI chars in vbnet?

[sdowney1]

I have this subroutine xor char swap that 'encrypts' a string with a password and then stores it in the windows registry.
What I store like that is a database connection string, just so no one snooping would easily see it.

Pass a string in, and it encrypts the string.
Pass encrypted string in and it decrypts the string.

This works fine for windows XP thru 11 and VB6

I have tried with vbnet, and it quits getting the whole string, gets maybe half or less when using getsetting.
Like if encrypted string in registry has 29 chars (LEN) it retrieves only 12.

The encrypted string is including extended ASCII chars, which might include NUL chars, I am not sure exactly where it getsetting quits or why in vbnet.

What can I do to get something working? I am wondering why it does not work.

Will VS2022 have a better working getsetting function than vs2008?

Here I am encrypting a mysql connection string
Then saving it using savesetting

   'save conn string in registry
    secret = Encrypt(frmlogonConnectstring, "1234567890")
   
 If frmlogondbasetype = "MySQL" Then
        SaveSetting App.Title, "Login", "Connect", secret
   End If

Here I am getting the connection string

    'load the Current used connectrion string
    secret = GetSetting(App.Title, "Login", "Connect", "MissingKey")
    frmlogoncnConnector.ConnectionString = Encrypt(secret, "1234567890")

Here is the current function, and I have been playing with it for a while now.

Public Function Encrypt(ByRef secret As String, ByRef PassWord As String) As String
		Dim yada As String
		Dim L As Short

		Dim char_Renamed As String
		Dim X As Short
		
		yada = frmlogonConnectstring
		'????
		'The passwords and privileges are encrypted with "1234567890"
		'the connection string is encrypted with "123456789"
		'Win98 had a problem with 1234567890
		
		' secret = the string you wish to encrypt or decrypt.
		' PassWord = the password with which to encrypt the string.
		On Error GoTo errhandler
		' priv = Encrypt("A11111111111111111111", "1234567890")
		
		'' secret = "A11111111111111111111"
		''  PassWord = "1234567890"
		
		L = Len(PassWord)
		For X = 1 To Len(secret)
			char_Renamed = CStr(Asc(Mid(PassWord, (X Mod L) - L * CShort((X Mod L) = 0), 1)))
			Mid(secret, X, 1) = Chr(Asc(Mid(secret, X, 1)) Xor char_Renamed)
		Next 
		
		Encrypt = secret
		frmlogonConnectstring = yada
		Exit Function
		
errhandler: 
		
		Err.Clear()
		On Error GoTo errhandler2
		
		'like chinese unicode???
		
		L = Len(PassWord)
		For X = 1 To Len(secret)
			char_Renamed = CStr(AscW(Mid(PassWord, (X Mod L) - L * CShort((X Mod L) = 0), 1)))
			Mid(secret, X, 1) = ChrW(AscW(Mid(secret, X, 1)) Xor char_Renamed)
		Next 
		
		Encrypt = secret
		frmlogonConnectstring = yada
		Exit Function
errhandler2: 
		
		Encrypt = secret
		frmlogonConnectstring = yada
	End Function

I am including a pic of how these strings look in the registry, and these strings work in vb6

[PlausiblyDamp]

Dotnet has an entire class for dealing with the registry https://learn.microsoft.com/en-us/do...y?view=net-8.0 and if you are just looking at storing settings then https://learn.microsoft.com/en-us/vi...t?view=vs-2022 might be worth looking at.

If you are serious about improving the security then there is also all of the classes under https://learn.microsoft.com/en-us/do...y?view=net-8.0 to consider.

[sdowney1]

Dotnet has an entire class for dealing with the registry https://learn.microsoft.com/en-us/do...y?view=net-8.0 and if you are just looking at storing settings then https://learn.microsoft.com/en-us/vi...t?view=vs-2022 might be worth looking at.

If you are serious about improving the security then there is also all of the classes under https://learn.microsoft.com/en-us/do...y?view=net-8.0 to consider.

Found a set of encryption functions right here on vbforums
Works with vb6, will test later on vbnet
It creates a human readable string with no weird chars.
You got to do what you got to do to make things work.
This one has separate crypt-decrypt functions.

'--- equivalent to `openssl aes-256-ctr -pbkdf2 -md sha512 -pass pass:{Password} -in {sEncr}.file -a -d`
https://www.vbforums.com/showthread....ted-encryption

'source code
https://gist.github.com/wqweto/42a6c...e-mdaesctr-bas

EDIT
While it is cool module for VB6 to use, it has too many issues for vbnet.
So will keep looking to see if I can find something I like.

[sdowney1]

I will have to try this one from here

https://stackoverflow.com/questions/...ring-in-vb-net

Private Function AESE(ByVal plaintext As String, ByVal key As String) As String
    Dim AES As New System.Security.Cryptography.RijndaelManaged
    Dim SHA256 As New System.Security.Cryptography.SHA256Cng
    Dim ciphertext As String = ""
    Try
        AES.GenerateIV()
        AES.Key = SHA256.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(key))

        AES.Mode = Security.Cryptography.CipherMode.CBC
        Dim DESEncrypter As System.Security.Cryptography.ICryptoTransform = AES.CreateEncryptor
        Dim Buffer As Byte() = System.Text.ASCIIEncoding.ASCII.GetBytes(plaintext)
        ciphertext = Convert.ToBase64String(DESEncrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))

       Return Convert.ToBase64String(AES.IV) & Convert.ToBase64String(DESEncrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))

    Catch ex As Exception
        Return ex.Message
    End Try
End Function

Private Function AESD(ByVal ciphertext As String, ByVal key As String) As String
    Dim AES As New System.Security.Cryptography.RijndaelManaged
    Dim SHA256 As New System.Security.Cryptography.SHA256Cng
    Dim plaintext As String = ""
    Dim iv As String = ""
    Try
        Dim ivct = ciphertext.Split({"=="}, StringSplitOptions.None)
        iv = ivct(0) & "=="
        ciphertext = If(ivct.Length = 3, ivct(1) & "==", ivct(1))

        AES.Key = SHA256.ComputeHash(System.Text.ASCIIEncoding.ASCII.GetBytes(key))
        AES.IV = Convert.FromBase64String(iv)
        AES.Mode = Security.Cryptography.CipherMode.CBC
        Dim DESDecrypter As System.Security.Cryptography.ICryptoTransform = AES.CreateDecryptor
        Dim Buffer As Byte() = Convert.FromBase64String(ciphertext)
        plaintext = System.Text.ASCIIEncoding.ASCII.GetString(DESDecrypter.TransformFinalBlock(Buffer, 0, Buffer.Length))
        Return plaintext
    Catch ex As Exception
        Return ex.Message
    End Try
End Function

[sdowney1]

Dim ivct = ciphertext.Split({"=="}, StringSplitOptions.None)

above line has an error
I also said Dim ivct as object as it gave 5 errors unless I did that.

that line says 'expression expected', so the .split is written wrong
shows the error at the parenthesis between the first curly bracket

How should it be?

take out the curly braces and it says this error

Error 1 Overload resolution failed because no accessible 'Split' can be called without a narrowing conversion:
'Public Function Split(separator() As Char, options As System.StringSplitOptions) As String()': Argument matching parameter 'separator' narrows from 'String' to '1-dimensional array of Char'.
'Public Function Split(separator() As Char, count As Integer) As String()': Argument matching parameter 'separator' narrows from 'String' to '1-dimensional array of Char'. C:\vbp640Jessica-9-6-2015using3\vbnetmyfirst\WindowsApplication1\WindowsApplication1\Module1.vb 33 24 WindowsApplication1

[sdowney1]

Changed couple lines and it now shows no errors

Don't yet know if it works.
looks like ivct is supposed to be a string array?
Dim ivct() As String

and this as the var in the .split
Dim separators2() As String = {"=="}

Found an example where it shows Dim separators() As String = {"Domain:", "Mode:"}, which may have given me a clue

Private Function AESD(ByVal ciphertext As String, ByVal key As String) As String
        Dim AES As New System.Security.Cryptography.RijndaelManaged
        Dim SHA256 As New System.Security.Cryptography.SHA256Cng
        Dim plaintext As String = ""
        Dim iv As String = ""
        Dim ivct() As String

        ' Dim line As String = "SERVER1.DOMAIN.COM Running"
        ' Dim separators() As String = {"Domain:", "Mode:"}
        ' Dim result() As String
        ' result = line.Split(separators, StringSplitOptions.RemoveEmptyEntries)

        Try

            Dim separators2() As String = {"=="}

            ivct = ciphertext.Split(separators2, StringSplitOptions.None)
            'ivct = ciphertext.Split("==", StringSplitOptions.None)

[sdowney1]

YES! it works fine now
I think this will work ok in windows registry with getsetting and savesetting

It definitely takes me some time to figure out stuff.
At least so far figuring out things for vs2008 has not been too hard yet.

 
       Dim figures As String = AESE("the bomb", "secret")

        Dim mymy As String = AESD(figures, "secret")

[sdowney1]

I may not change anything as far as the encryption scheme in my program as vs2022, it's builtin getsetting function properly retrieves the connection string out of the registry. That will save hours of reconfiguring everything.

And then my decrypt function properly decrypts it as it should be. VS2008's getsetting is busted as far I am concerned.

I just got the program to run in vs2022 this am after switching the .net config in the program properties from 3.5 to 4.8

It is these little dumb things that just eat up time. like vs2008 not working like you would expect. It takes me hours to figure this stuff out, course I am a complete noob to VS vbnet stuff