How to access specific byte from registry value encrypted with CryptProtectData

Question

I am trying to retrieve a Date value from the registry. The value is encrypted with CryptProtectData.

The Bytes of interest are (little-endian):

[-16] and [-15] is a the year. [-14] and [-13] is a month and [-12] and [-11] is a day.

RegistryKey HKCR;
RegistryKey dateKey;
HKCR = RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Default);
dateKey = HKCR.OpenSubKey(subKeyPath);
byte[] registryValue = (byte[])dateKey.GetValue(null);
byte[] unprotectedRegistryValue = ProtectedData.Unprotect(registryValue, null, DataProtectionScope.LocalMachine);

The unprotectedRegistryValue is an byte Array: {byte[224]}. I have to further process the range [-16..-11] and pass the apropried values to BitConverter.ToInt16([-16..-15]) and then to Date functions to receive the information about the year for example.

Unfortunatelly I am stuck with the value from unprotectedRegistryValue, because there is no negative index. When I try to access the values for the year information.

var yearBytes = new byte[] {unprotectedRegistryValue[-16], unprotectedRegistryValue[-15]};

I receive an IndexOutOfRangeException because the indexes of the unprotectedRegistryValue are all positive.

I miss some understanding between the part of encrypt the data and pass the bytes of interest to further processing the values.

How could I manage to get the bytes of interest and pass them further?

Answer 1

A negative index has no meaning unless you know where '0' is placed, when you have a positive index you assume that '0' is the first element in the array, but when you have a negative number there is no consensus (it's not even valid), so your colleague must have some reference to where '0' is, where he considers the data starts and ends.

It's worth a try to consider '0' the last byte, if that's the case then '-16' would be unprotectedRegistryValue.Length - 17 and '-15' unprotectedRegistryValue.Length - 16