Extract wallpaper path from registry

[xpclient]

So let me give you some background of my problem so you don't wonder "why would you want to do that"? Windows 7 introduced a nice slideshow feature so you can set for example, you entire Pictures library as wallpaper and have it cycle through your awesome collection. But when you install themepacks which come with multiple wallpapers in one theme, there are some pictures you don't like and wish to delete. So it would be nice while the slideshow was set, if you could determine the current wallpaper's path and delete the image if you don't like it. For Windows 7, I found a useful little script that precisely did this (http://www.pretentiousname.com/miscsoft/#delwall). The current desktop background is stored in the Registry at HKCU\Software\Microsoft\Internet Explorer\Desktop\General: String value: WallpaperSource. The script reads the current desktop background image from the registry and deletes it.

Now we got Windows 8 and Microsoft as we know likes to make our lives more difficult, annoying and delete/change features just for fun. In Windows 8, the current wallpaper is no longer stored at the above mentioned registry key which is a plain string value. Instead it is stored at HKCU\Control Panel\Desktop\ as a REG_BINARY value: TranscodedImageCache. So I wrote a little VBScript again to decode the REG_BINARY value and get the wallpaper source. This script is attached to this post (GetWallpaperSource.zip). But the problem is that TranscodedImageCache value also seems to store some other garbage in that value besides the image path. The value I get as output contains these extra bits I don't want before the wallpaper path begins. And my VBScript skills aren't advanced enough to read only a portion of a REG_BINARY value ignoring the initial binary data which is garbage.

So my question is can anyone help me get *just* the wallpaper source in one way or the other by writing any script, VBS or PowerShell or a little program so I can delete the current wallpaper quickly?

Edited September 28, 2013 by xpclient

[MrJinje]

Yeah, I think a powershell way would be easier, I've found some useful Hex bits at sans.org.

http://www.sans.org/windows-security/2010/02/11/powershell-byte-array-hex-convert

Looking at my 8.1 machine the first 24 bytes are garbage, then begins plain text path, followed by hundreds of zero's padding.

Header7a,c3,01,00,c2,87,00,00,05,01,00,00,f1,00,00,00,dc,\  b4,b1,18,d5,ab,ce,01,Header is slightly different each time.7a,c3,01,00,e4,ef,00,00,80,07,00,00,b0,04,00,00,aa,\  ab,d2,f1,28,b5,ce,01,The goods.   This is the path in plain text (as hex)5a,00,3a,00,5c,00,53,00,68,00,61,00,72,00,65,00,64,00,\  5c,00,4b,00,72,00,79,00,74,00,65,00,6e,00,2d,00,52,00,65,00,64,00,44,00,77,\  00,61,00,72,00,66,00,2e,00,6a,00,70,00,67,00"TranscodedImageCache"=hex:7a,c3,01,00,c2,87,00,00,05,01,00,00,f1,00,00,00,dc,\  b4,b1,18,d5,ab,ce,01,5a,00,3a,00,5c,00,53,00,68,00,61,00,72,00,65,00,64,00,\  5c,00,4b,00,72,00,79,00,74,00,65,00,6e,00,2d,00,52,00,65,00,64,00,44,00,77,\  00,61,00,72,00,66,00,2e,00,6a,00,70,00,67,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

I guess the simple way from VBS would be to skip over the first 24 bytes when you run your loop. Start a counter, i = i+1, then make an if i = less than 24 skip to next byte.

[xpclient]

Ah thank you very much. That helped. It is that easy! I fixed my script and updated that script by Leo Davidson to get current wallpaper and delete it. (Attached to post)

DeleteWallpaper.zip

Edited September 28, 2013 by xpclient

[Akiobenjiro]

Ah thank you very much. That helped. It is that easy! I fixed my script  and updated that script by Leo Davidson to get current wallpaper and delete it. (Attached to post)

Thanks, a lot! Great job