WINREG

NAME
SYNOPSIS
DESCRIPTION
OPTIONS
EXAMPLE
SEE ALSO
AUTHOR
BUGS

NAME

winreg - text-based access to the Windows registry

SYNOPSIS

winreg [-F FS] [-r name] [-ntvci] [key]

DESCRIPTION

Winreg provides text-based access to the Windows registry. Running winreg with a registry key specified as part of its invocation will result in all the registry tree from that point downwards to be printed on its standard output. By default for every registry key winreg will print its name, type, and value. When winreg is run without specifying a registry key it will read registry data formatted in the same way as its default output format and set (update or create) the corresponding registry values.

The following lines describe the default registry data format read and written by winreg for each defined registry data type. Winreg will not process data types other than the ones described.
REG_BINARY

Winreg will print the word BINARY followed by the data bytes as character-separated two digit hexadecimal values.

REG_DWORD

Winreg will print the word DWORD followed by the value using eight hexadecimal digits.

REG_DWORD_BIG_ENDIAN

Winreg will print the word DWORD_BIG_ENDIAN followed by the value using eight hexadecimal digits. The value’s digits are printed so as to represent a base16 number, i.e. the number 1 is printed as 00000001, not 00010000.

REG_QWORD

Winreg will print the word QWORD followed by the value using 16 hexadecimal digits.

REG_SZ

Winreg will print the word SZ followed by the value as a string with escape codes used for non-printable characters.

REG_MULTI_SZ

Winreg will print the word MULTI_SZ followed by the value as a string with escape codes used for non-printable characters.

REG_EXPAND_SZ

Winreg will print the word EXPAND_SZ followed by the value as a string with escape codes used for non-printable characters.

REG_NONE

Winreg will print the word NONE without any trailing data. A field separator will be printed.

REG_LINK

Winreg will print the word LINK followed by the data bytes as character-separated two digit hexadecimal values.

REG_RESOURCE_LIST

Winreg will print the word RESOURCE_LIST followed by the data bytes as character-separated two digit hexadecimal values.

REG_RESOURCE_REQUIREMENTS_LIST

Winreg will print the word RESOURCE_REQUIREMENTS_LIST followed by the data bytes as character-separated two digit hexadecimal values.

REG_FULL_RESOURCE_DESCRIPTOR

Winreg will print the word FULL_RESOURCE_DESCRIPTOR followed by the data bytes as character-separated two digit hexadecimal values.

When printing string values \character escape codes are used for the characters \, \a, \b, \f, \t, \r, \n, \v, \0 representing the corresponding values as defined by the C programming language. All other non-printable characters (as defined by the C isprint function) are represented using the sequence \x followed by two digit hexadecimals.

A commonly used idiom involves processing Windows registry data as the output of winreg using Unix tools like sed and awk and redirecting their output back to the registry via winreg.

OPTIONS

-F FS

Specify the field separator used to delimit fields (registry key name, type, value) on output. The default field separator is a tab.

-r name

Connect to the registry of the remote machine name, instead of the local registry. Data will be retrieved from and stored to the remote registry. Appropriate permissions must be establshed and services be running; see http://msdn.microsoft.com/library/- default.%asp?url=/library/en-us/sysinfo/base/- regconnectregistry.asp. The name can be a Netbios name (\\host), a Netbios IP-address (\\192.168.1.2), a Netbios fully qualified domain name (\\host.company.com), an Internet host name (\\host), an Internet host IP-address (\\192.168.1.2), or an Internet host fully qualified domain name (\\host.company.- com).

-n

Do not print key names.

-t

Do not print key types.

-v

Do not print key values.

-i

Ignore errors returned by Windows registry operations. The error code will be printed on the standard output, but the program will attempt to continue processing.

-d

Output DWORD and binary data of 1, 2, and 4 bytes in decimal. This can be used to extract performance data (found under HKEY_PERFORMANCE_DATA) in a format that can be used by other analysis tools. Decimal output can not be parsed-back for setting registry values.

-c

Check input by parsing it and print any errors found. No registry keys will be created or modified.

EXAMPLE

winreg -nt HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName\ComputerName
will display a machine’s name.

winreg HKEY_CURRENT_USER | sed -n ’s,C:/home,D:/home,gp’ | winreg
Change all user registry references from c:/home to d:/home.

winreg -r \\pooh HKEY_LOCAL_MACHINE\Software\Netscape | winreg -r \\piglet
Copy the Netscape machine-specific software settings from the registry of the machine poo to the registry of the machine piglet.

SEE ALSO

D. Spinellis. Outwit: Unix tool-based programming meets the Windows world. In USENIX 2000 Technical Conference Proceedings, pages 149-158, San Diego, CA, USA, June 2000, USENIX Association.
Microsoft Corporation. Microsoft Windows NT Server 4.0 Resource Kit. Microsoft Press.
Ron Petrusha and Andrew Schulman. Inside the Windows 95 Registry. O’Reilly & Associates.

AUTHOR

(C) Copyright 1999-2003 Diomidis Spinellis. All rights reserved.

Permission to use, copy, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation.

THIS SOFTWARE IS PROVIDED ‘‘AS IS’’ AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

BUGS

Although reasonable care has been taken to make winreg work with many possible types of registry data, note that incorrect operation by winreg or inappropriate registry data manipulations can render a machine unusable.

At least under Windows 2000 SP2, a failed remote connection is not correctly reported by the Windows API, and may cause the program to display wrong data or silently fail.