hivexget: Get values from a Windows Registry hive

$ hivexget system '\ControlSet001\Control'
"PreshutdownOrder"=hex(7):77,00,75,00,61[...]
"WaitToKillServiceTimeout"="12000"
"CurrentUser"="USERNAME"
"BootDriverFlags"=dword:00000000"
"ServiceControlManagerExtension"=str(2):"%systemroot%\\system32\\scext.dll"
"SystemStartOptions"=" NOEXECUTE=OPTIN"
"SystemBootDevice"="multi(0)disk(0)rdisk(0)partition(2)"
"FirmwareBootDevice"="multi(0)disk(0)rdisk(0)partition(1)"
$ hivexget system '\ControlSet001\Control' SystemBootDevice
multi(0)disk(0)rdisk(0)partition(2)

There is also a tool (hivexml) to convert the registry hive into an XML file.

These are low-level tools at the moment. These are the basis for writing a nice, usable, high-level virt-win-reg program for grabbing values out of a Windows guest.

About these ads

3 Comments

Filed under Uncategorized

3 responses to “hivexget: Get values from a Windows Registry hive

  1. Oron Peled

    Nice. A usability improvement would
    be to map ‘/’ into ‘\’ so people can run
    hivexget system /ControlSet001/Control SystemBootDevice

    No need for shell escaping.
    Hmmm… the next thing would be to provide bash_complete function ;-)

  2. rich

    Oron, that’s a bit tricky in fact because Windows Registry path elements might contain a forwards “/” character.

  3. Pingback: Tip: virt-win-reg: CurrentControlSet in Windows Registry « Richard WM Jones

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s