Checking the 13th-bit (shadow setting) from registry item (reg_binary)? - powershell

Question

Using the following PowerShell code:
$RegConnect = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]"CurrentUser", "$env:COMPUTERNAME")
$RegCursors = $RegConnect.OpenSubKey("Control Panel\Desktop", $true)
$myVal = $RegCursors.GetValue("UserPreferencesMask")
write-output $myVal
$RegCursors.Close()
$RegConnect.Close()
It returns:
190
30
7
128
18
1
0
0
From the MS help on UserPreferencesMask, the bit I'm after is the 13th, Cursor shadow.
13 Cursor shadow -- 1 Default
Cursor shadow is enabled. This effect only appears if the system has a color depth of more than 256 colors.
How can I extract the boolean for the current mouse shadow from this?
Here's the values in the on and off state.
on = "UserPreferencesMask"=hex:be,3e,07,80,12,01,00,00
off = "UserPreferencesMask"=hex:be,1e,07,80,12,01,00,00

Answer 1

It looks like you're adding 32 or 0x20 to the second byte to turn it on:
$myval[1] += 32 # on
$myval[1] -= 32 # off
Bitwise, "or" to set, "and" with "bit complement (not)" to unset.
0x1e -bor 0x20 # on
62
0x3e -band -bnot 0x20 # off
30
Maybe you could make a flags enum for all the settings, but you'd have to convert the byte array to one large int.
EDIT: Oh, if you just want to check that a bit is set:
$shadowbit = 0x20
if (0x3e -band $shadowbit ) { 'yep' } else { 'nope' } # 32
yep
if (0x1e -band $shadowbit ) { 'yep' } else { 'nope' } # 0
nope
See also How do you set, clear, and toggle a single bit?
EDIT:
I went a little overboard. Having this in preperation:
[Flags()] enum UserPreferencesMask {
ActiveWindowTracking = 0x1
MenuAnimation = 0x2
ComboBoxAnimation = 0x4
ListBoxSmoothScrolling = 0x8
GradientCaptions = 0x10
KeybordCues = 0x20
ActiveWindowTrackingZOrder = 0x40
HotTracking = 0x80
Reserved8 = 0x100
MenuFade = 0x200
SelectionFade = 0x400
ToolTipAnimation = 0x800
ToolTipFade = 0x1000
CursorShadow = 0x2000 # 13
Reserved14 = 0x4000
Reserved15 = 0x8000
Reserved16 = 0x10000
Reserved17 = 0x20000
Reserved18 = 0x40000
Reserved19 = 0x80000
Reserved20 = 0x100000
Reserved21 = 0x200000
Reserved22 = 0x400000
Reserved23 = 0x800000
Reserved24 = 0x1000000
Reserved25 = 0x2000000
Reserved26 = 0x4000000
Reserved27 = 0x8000000
Reserved28 = 0x10000000
Reserved29 = 0x20000000
Reserved30 = 0x40000000
UIEffects = 0x80000000 # 31
}
You can do:
$myVal = get-itemproperty 'HKCU:\Control Panel\Desktop' UserPreferencesMask |
% UserPreferencesMask
$b = [bitconverter]::ToInt32($myVal,0)
'0x{0:x}' -f $b
0x80073e9e
[UserPreferencesMask]$b
MenuAnimation, ComboBoxAnimation, ListBoxSmoothScrolling,
GradientCaptions, HotTracking, MenuFade, SelectionFade,
ToolTipAnimation, ToolTipFade, CursorShadow, Reserved16, Reserved17,
Reserved18, UIEffects
[UserPreferencesMask]$b -band 'CursorShadow'
CursorShadow
if ([UserPreferencesMask]$b -band 'CursorShadow') { 'yes' }
yes
Note that 3 undocumented reserved bits are already in use in my Windows 10. This is with "show shadows under mouse pointer" checked under "performance options" (advanced system) in the control panel
OR, getting simple without the enums:
$b = [bitconverter]::ToInt32($myVal,0) # 4 bytes from reg_binary to int
if ($b -band [math]::pow(2,13)) { 'cursor shadow' }
I've noticed that that registry entry is actually 8 bytes long, but bringing in all 8 bytes doesn't change the answer, even if some of those extra bits are set in windows 10.

Answer 2

To find the specific bit:
You need to calculate the byte index (starting from 0) by dividing the absolute bit index by 8:
[math]::floor(13 / 8) → byte 1 for the absolute bit 13
*Note: as #mklement0 pointed out, you can't use [Int] for this as is doesn't round down, see: division and rounding
Then calculate the relative bit index in that byte by finding the remainder (modulo) of the division:
$BitIndex - 8 * $ByteIndex → 13 - (8 * 1) = 5
*Note: I am not using the arithmetic operator (%) for the modulus due to the modulo operation with negative numbers issue and I used [math]::floor vs [math]::truncate for rounding. This way, the function also supports negative bit indices, with -1 referring to the most significant bit
Then create a byte mask from the relative bit:
[Byte][math]::pow(2, <relative bit>) → 25 = 32 (20h)
And finally mask (-bAnd) the concerned byte:
[Bool]($ByteArray[$ByteIndex] -bAnd $ByteMask) → 62 bAnd 32 = 32 (true), 30 bAnd 32 = 0 (false)
To make this more clear, I have put this in a Test-Bit function:
Function Test-Bit([Int]$BitIndex, [Byte[]]$ByteArray) {
$ByteIndex = [math]::floor($BitIndex / 8)
$ByteMask = [Byte][math]::pow(2, ($BitIndex - 8 * $ByteIndex))
[Bool]($ByteArray[$ByteIndex] -bAnd $ByteMask)
}
*Note: the Test-Bit function is based on little-endian byte order (see: Endianness)
Test:
Test-Bit 13 ([Byte[]](0xbe, 0x3e, 0x07, 0x80, 0x12, 0x01, 0x00, 0x00)) # True
Test-Bit 13 ([Byte[]](0xbe, 0x1e, 0x07, 0x80, 0x12, 0x01, 0x00, 0x00)) # False
Specific to your question:
$RegConnect = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]"CurrentUser", "$env:COMPUTERNAME")
$RegCursors = $RegConnect.OpenSubKey("Control Panel\Desktop", $true)
$MyVal = $RegCursors.GetValue("UserPreferencesMask")
$State = Test-Bit 13 $MyVal
If ($State) {
# Cursor shadow is enabled
} Else {
# Cursor shadow is disabled
}
$RegCursors.Close()
$RegConnect.Close()