| [9] | 1 | reglookup |
|---|
| 2 | |
|---|
| 3 | |
|---|
| 4 | =NAME= |
|---|
| 5 | reglookup - Windoze NT/2K/XP registry reader/lookup tool |
|---|
| 6 | |
|---|
| 7 | |
|---|
| 8 | =SYNOPSIS= |
|---|
| 9 | reglookup [options] <REGISTRY_FILE> |
|---|
| 10 | |
|---|
| 11 | |
|---|
| 12 | =DESCRIPTION= |
|---|
| 13 | reglookup is designed to read Windoze registry elements and |
|---|
| 14 | print them out to stdout. It has several filtering options to |
|---|
| 15 | narrow the focus of the output. |
|---|
| 16 | |
|---|
| 17 | |
|---|
| 18 | =OPTIONS= |
|---|
| 19 | -f<PREFIX_FILTER> |
|---|
| 20 | Specify a path filter. Only keys/values under this |
|---|
| 21 | registry path will be output. |
|---|
| 22 | |
|---|
| 23 | -t<TYPE_FILTER> |
|---|
| 24 | Specify a type filter. Only elements which match this |
|---|
| 25 | registry data type will be printed. Acceptable values |
|---|
| 26 | are: SZ,EXPAND_SZ,BIN,DWORD,MULTI_SZ,KEY |
|---|
| 27 | |
|---|
| [15] | 28 | -s Print security descriptors as well as keys/values/data. |
|---|
| 29 | (This feature's output is not standardized, and probably |
|---|
| 30 | contains bugs.) |
|---|
| 31 | |
|---|
| [9] | 32 | -v Verbose output. |
|---|
| 33 | |
|---|
| 34 | |
|---|
| 35 | REGISTRY_FILE |
|---|
| 36 | Required argument. Specifies the location of the |
|---|
| 37 | registry file to read. Typically, these files will be |
|---|
| 38 | found on a Windoze partition under |
|---|
| 39 | %SystemRoot%/system32/config. |
|---|
| 40 | |
|---|
| 41 | |
|---|
| 42 | =EXAMPLES= |
|---|
| 43 | To read and print an entire registry: |
|---|
| 44 | |
|---|
| 45 | **reglookup /mnt/win/c/WINNT/system32/config/system** |
|---|
| 46 | |
|---|
| 47 | To limit the output to just those entries under the Services |
|---|
| 48 | key: |
|---|
| 49 | |
|---|
| 50 | **reglookup -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system** |
|---|
| 51 | |
|---|
| 52 | To limit the output to all registry values of type BIN: |
|---|
| 53 | |
|---|
| 54 | **reglookup -tBIN /mnt/win/c/WINNT/system32/config/system** |
|---|
| 55 | |
|---|
| 56 | And to limit the output to BIN values under the Services key: |
|---|
| 57 | |
|---|
| 58 | **reglookup -tBIN -f'$$$PROTO.HIV/ControlSet002/Services' /mnt/win/c/WINNT/system32/config/system** |
|---|
| 59 | |
|---|
| 60 | |
|---|
| 61 | =BUGS= |
|---|
| 62 | Path filtering is currently a slow hack. |
|---|
| 63 | |
|---|
| 64 | The current incarnation of this program has only been tested on |
|---|
| 65 | Windoze 2000. |
|---|
| 66 | |
|---|
| 67 | You'll notice that registry paths aren't all the same as the |
|---|
| 68 | ones the equivalents you see in Windoze. Don't ask me why that |
|---|
| 69 | is. I just work here. |
|---|
| 70 | |
|---|
| 71 | This software should be considered unstable at this time. |
|---|
| 72 | |
|---|
| 73 | |
|---|
| 74 | =CREDITS= |
|---|
| 75 | This program is based on editreg.c by Richard Sharpe. |
|---|
| 76 | |
|---|
| 77 | It has since been modified by Timothy D. Morgan. |
|---|
| 78 | |
|---|
| 79 | Please see source code for a full list of copyrights. |
|---|
| 80 | |
|---|
| 81 | |
|---|
| 82 | =LICENSE= |
|---|
| 83 | Please see the file "LICENSE" included with this software |
|---|
| 84 | distribution. |
|---|
| 85 | |
|---|
| 86 | This program is distributed in the hope that it will be useful, |
|---|
| 87 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
|---|
| 88 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|---|
| 89 | GNU General Public License version 2 for more details. |
|---|
