regshell - Man Page

Windows registry file browser using readline

Synopsis

regshell [--help] [--backend=BACKEND] [--credentials=CREDENTIALS] [location]

Description

regshell is a utility that lets you browse thru a Windows registry file as if you were using a regular unix shell to browse thru a file system.

Options

--help: Show list of available options.
--backend BACKEND: Name of backend to load. Possible values are: creg, regf, dir and rpc. The default is dir.
--credentials=CREDENTIALS: Credentials to use, if any. Password should be separated from user name by a percent sign.

Commands

ck|cd <keyname>: Go to the specified subkey.
ch|predef [predefined-key-name]: Go to the specified predefined key.
list|ls: List subkeys and values of the current key.
mkkey|mkdir <keyname>: Create a key with the specified keyname as a subkey of the current key.
rmval|rm <valname>: Delete the specified value.
rmkey|rmdir <keyname>: Delete the specified subkey recursively.
pwd|pwk: Print the full name of the current key.
set|update: Update the value of a key value. Not implemented at the moment.
help|?: Print a list of available commands.
exit|quit: Leave regshell.

Examples

Browsing thru a nt4 registry file

regshell -b nt4 NTUSER.DAT
$$$PROTO.HIV> ls
K AppEvents
K Console
K Control Panel
K Environment
K Identities
K Keyboard Layout
K Network
K Printers
K Software
K UNICODE Program Groups
K Windows 3.1 Migration Status
$$$PROTO.HIV> exit

Listing the subkeys of HKEY_CURRENT_USER\AppEvents on a remote computer:

regshell --remote=ncacn_np:aurelia -c "jelmer%secret"
HKEY_CURRENT_MACHINE> predef HKEY_CURRENT_USER
HKEY_CURRENT_USER> cd AppEvents
Current path is: HKEY_CURRENT_USER\AppEvents
HKEY_CURRENT_USER\AppEvents> ls
K EventLabels
K Schemes
HKEY_CURRENT_USER\AppEvents> exit