| [9] | 1 | reglookup |
|---|
| 2 | |
|---|
| 3 | |
|---|
| 4 | =NAME= |
|---|
| [45] | 5 | reglookup - windows NT+ registry reader/lookup tool |
|---|
| [9] | 6 | |
|---|
| 7 | |
|---|
| 8 | =SYNOPSIS= |
|---|
| 9 | reglookup [options] <REGISTRY_FILE> |
|---|
| 10 | |
|---|
| 11 | |
|---|
| 12 | =DESCRIPTION= |
|---|
| [45] | 13 | reglookup is designed to read windows registry elements and |
|---|
| 14 | print them out to stdout in a CSV-like format. It has filtering |
|---|
| 15 | options to narrow the focus of the output. This tool is |
|---|
| 16 | designed to work with on windows NT/2K/XP/2K3 registries, though |
|---|
| 17 | your mileage may vary. |
|---|
| [9] | 18 | |
|---|
| 19 | |
|---|
| 20 | =OPTIONS= |
|---|
| [45] | 21 | -p <PREFIX_FILTER> |
|---|
| 22 | Specify a path prefix filter. Only keys/values under |
|---|
| 23 | this registry path will be output. |
|---|
| [9] | 24 | |
|---|
| [45] | 25 | -t <TYPE_FILTER> |
|---|
| [9] | 26 | Specify a type filter. Only elements which match this |
|---|
| 27 | registry data type will be printed. Acceptable values |
|---|
| [45] | 28 | are: SZ,EXPAND_SZ,BINARY,DWORD,DWORD_BE,LINK,MULTI_SZ, |
|---|
| 29 | RSRC_LIST,RSRC_DESC,RSRC_REQ_LIST,KEY |
|---|
| [9] | 30 | |
|---|
| [45] | 31 | -s Adds four additional columns to output containing |
|---|
| 32 | information from key security descriptors. The columns |
|---|
| 33 | are: owner, group, sacl, dacl. |
|---|
| 34 | (This feature's output probably contains bugs right now.) |
|---|
| 35 | |
|---|
| 36 | -S Disables the printing of security descriptor |
|---|
| 37 | information. |
|---|
| 38 | |
|---|
| [9] | 39 | -v Verbose output. |
|---|
| [45] | 40 | (Currently does little to nothing.) |
|---|
| [9] | 41 | |
|---|
| 42 | |
|---|
| 43 | REGISTRY_FILE |
|---|
| 44 | Required argument. Specifies the location of the |
|---|
| 45 | registry file to read. Typically, these files will be |
|---|
| [45] | 46 | found on a NTFS partition under |
|---|
| [9] | 47 | %SystemRoot%/system32/config. |
|---|
| 48 | |
|---|
| 49 | |
|---|
| 50 | =EXAMPLES= |
|---|
| [45] | 51 | To read and print the contents of an entire system registry |
|---|
| 52 | file: |
|---|
| [9] | 53 | |
|---|
| [28] | 54 | **reglookup /mnt/win/c/WINNT/system32/config/system** |
|---|
| [9] | 55 | |
|---|
| 56 | To limit the output to just those entries under the Services |
|---|
| 57 | key: |
|---|
| 58 | |
|---|
| [45] | 59 | **reglookup -p /ControlSet002/Services /mnt/win/c/WINNT/system32/config/system** |
|---|
| [9] | 60 | |
|---|
| [45] | 61 | To limit the output to all registry values of type BINARY: |
|---|
| [9] | 62 | |
|---|
| [45] | 63 | **reglookup -t BINARY /mnt/win/c/WINNT/system32/config/system** |
|---|
| [9] | 64 | |
|---|
| [45] | 65 | And to limit the output to BINARY values under the Services key: |
|---|
| [9] | 66 | |
|---|
| [45] | 67 | **reglookup -t BINARY -p /ControlSet002/Services /mnt/win/c/WINNT/system32/config/system** |
|---|
| [9] | 68 | |
|---|
| 69 | |
|---|
| 70 | =BUGS= |
|---|
| 71 | The current incarnation of this program has only been tested on |
|---|
| [45] | 72 | windows 2K/XP. |
|---|
| [9] | 73 | |
|---|
| [45] | 74 | Verbose output is not working. |
|---|
| 75 | |
|---|
| [9] | 76 | You'll notice that registry paths aren't all the same as the |
|---|
| [45] | 77 | ones the equivalents you see in the windows registry editor. |
|---|
| 78 | Don't ask me why that is. I just work here. |
|---|
| [9] | 79 | |
|---|
| 80 | This software should be considered unstable at this time. |
|---|
| 81 | |
|---|
| 82 | |
|---|
| 83 | =CREDITS= |
|---|
| [45] | 84 | This program was initially based on editreg.c by |
|---|
| 85 | Richard Sharpe. It has since been rewritten to use a modified |
|---|
| 86 | version the regfio library written by Gerald Carter. Heavy |
|---|
| 87 | modifications to the library and the original command line |
|---|
| 88 | interface have been done by Timothy D. Morgan. |
|---|
| [9] | 89 | |
|---|
| 90 | Please see source code for a full list of copyrights. |
|---|
| 91 | |
|---|
| 92 | |
|---|
| 93 | =LICENSE= |
|---|
| 94 | Please see the file "LICENSE" included with this software |
|---|
| 95 | distribution. |
|---|
| 96 | |
|---|
| 97 | This program is distributed in the hope that it will be useful, |
|---|
| 98 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 99 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 100 | GNU General Public License version 2 for more details. |
|---|
