Zinthose
24th February 2011 22:52 UTC
!DISCLAIMER!
This data is based on an undocumented registry entry and is only verified on Windows XP and is subject to change.
In Addition, the example only lists 32bit installations unless you tweak it to read from the 64bit registry.
Here's what I know...
Add and Remove Programs dialog lists the Size based from the corresponding ArpCache registry entry.
for example here is the my machines Notepad++ ArpCache Entry
Windows Registry Editor Version 5.00
>***91;HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp ManagementARPCacheNotepad++***93;
>"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,50,ae,00,00,00,00,00,64,22,d7,
82,ab,ae,cb,01,00,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,
61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,6f,00,74,00,65,
00,70,00,61,00,64,00,2b,00,2b,00,5c,00,6e,00,6f,00,74,00,65,00,70,00,61,00,
64,00,2b,00,2b,00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00
>"Changed"=dword:00000000
>
The important entry here is the "SlowInfoCache" value.
There is a pretty good and short article explaining it here:
http://www.pcmag.com/article2/0,2817,1173443,00.asp
Here is an example of reading the data:
"LogicLib.nsh"
>OutFile Test.exe
ShowInstDetails show
Section
## Open Registry Key
System::Call "Advapi32::RegOpenKeyEx(i 0x80000002,t 'SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Notepad++',i 0,i 1,*i .r0)i .r3"
;DetailPrint "Result=$3"
${IfNotThen} $3 = 0 ${|} Abort "Not ARPCache data is available." ${|}
## Check for existance of SlowInfoCache and validate tpye and size
System::Call "Advapi32::RegQueryValueEx(i r0,t 'SlowInfoCache',i 0,*i .r4,i 0,*i .r5)"
${IfNotThen} $3 = 0 ${|} Abort "Not SlowInfoCache data is available." ${|}
${
IfNotThen} $4 = 3 ${|} Abort "SlowInfoCache type is unexpected" ${|}
${IfNotThen} $5 = 552 ${|} Abort "SlowInfoCache size unexpected" ${|}
## Read SlowInfoCache Data
System::Alloc $5
Pop$6
System::Call "Advapi32::RegQueryValueEx(i r0,t 'SlowInfoCache',i 0,*i n,i r6,*i r5)"
${IfNotThen} $3 = 0 ${|} Abort "Error reading SlowInfoCache data" ${|}
System::Call '*$6(&i4 .R1,&i4.R2,&i8.R3,&i4 .s,&i4 .s,&i4 .R5,&w524 .R6)'
## Convert the LastUsed FileTime to a Human readable format
System::Call `*(&i4 s,&i4 s)i .r7`
System::Free $6
System::Call "*(&i2, &i2, &i2, &i2, &i2, &i2, &i2, &i2) i .r3"
System::Call "Kernel32::FileTimeToSystemTime(i $7, i r3)"
System::Call "Kernel32::GetDateFormatA(i 0,i 0,i r3,t 'MM/dd/yyyy',t .R4,i ${NSIS_MAX_STRLEN})"
System::Free $7
## Close Registry Key
System::Call "Advapi32::RegCloseKey(i r0)i .r3"
${IfNotThen} $3 = 0 ${|} Abort "Unable to close registry key" ${|}
## Format the InstallSize into a human readable format ***91;bytes to megabytes***93;
Math::Script "R3=ff(R3/1048576.0,18)+' MB'"
## Display Results
DetailPrint "cbSize=$R1"
DetailPrint "HasName=$R2"
DetailPrint "InstallSize=$R3"
DetailPrint "LastUsed=$R4"
DetailPrint "Frequency=$R5"
DetailPrint "Name=$R6"
>SectionEnd
>
The Frequency value is an indication of the times the program is executed from a traceable shortcut from the Start Menu or Desktop. On the Add & Remove Programs dialog this is expressed as "Rarely", "Occasionally", or "Frequently". I'm not sure what values trigger what title but It could be calculated by tweaking a know value by increments. I think this is also tied to the LastUsed date so it might not be as simple hard value ranges.