Registry plug-in

Author: Instructor (talk, contrib)

Links

Download v4.2:
Registry.zip (154 KB)

Discussion:
Forum thread

Run with conda execute or install with conda install (see Conda).

Description

This is NSIS plug-in for registry with unicode support on NSIS Unicode. Archive also contains 64-bit and Pocket PC dlls.

Features:

• Powerful registry search:
  • fast algorithm
  • principle of turn in stack (first in -> last out)
  • i.e. search from first registry key to last
  • search for key, value and/or string in any root
  • search with name and/or type
  • search with banner support
  • search with subkeys or not
• Check if registry key exists
• Read value of any type and size
• Write value of any type and size
• Create key
• Delete value (same as DeleteRegValue)
• Delete key (same as DeleteRegKey)
• Delete empty key (if no values and subkeys in it)
• Copy value
• Move value
• Copy key
• Move key
• Export key contents to the file in ansi REGEDIT4 or unicode REGEDIT5 format
• Import key contents from the file to the registry (Note: this does not work on Windows Vista)
• Converts string to hex values
• Converts hex values to string

Usage

Open for search

${registry::Open} "[fullpath]" "[Options]" $var

Find first and next (call one or more times)

${registry::Find} "[handle]" $var1 $var2 $var3 $var4
 
From ReadMe file
 
"[handle]"   handle returned by registry::Open

$var1        "[path]"
$var2        "[value]" or "[key]"
$var3        "[string]"
$var4        "[TYPE]"
	TYPE:
	""                                -Search is finished
	"BANNER"                          -Banner is used, return only path
	"REG_KEY"                         -Registry key is found
	"REG_BINARY"                      -Raw binary data
	"REG_DWORD"                       -Double word in machine format (low-endian on Intel)
	"REG_DWORD_BIG_ENDIAN"            -Double word in big-endian format
	"REG_EXPAND_SZ"                   -String with unexpanded environment variables
	"REG_MULTI_SZ"                    -Multiple strings, next string separated by new line '$\n'
	"REG_NONE"                        -Undefined type
	"REG_SZ"                          -Null-terminated string
	"REG_LINK"                        -Unicode symbolic link
	"REG_RESOURCE_LIST"               -Device-driver resource list
	"REG_FULL_RESOURCE_DESCRIPTOR"    -Resource list in the hardware description
	"REG_RESOURCE_REQUIREMENTS_LIST"  -
	"REG_QWORD"                       -64-bit number
	"INVALID"                         -Invalid type code

Close search (free memory)

${registry::Close} "[handle]"

KeyExists (check if registry key exists)

${registry::KeyExists} "[fullpath]" $var
 
$var == 0   # key exists
$var == -1  # key doesn't exist

Registry Read

${registry::Read} "[fullpath]" "[value]" $var1 $var2

Where:

• $var1 is the value read.
• $var2 is the type read:
  • "" - no value
  • "REG_BINARY"
  • "REG_DWORD"
  • "REG_DWORD_BIG_ENDIAN"
  • "REG_EXPAND_SZ"
  • "REG_MULTI_SZ"
  • "REG_NONE"
  • "REG_SZ"
  • "REG_LINK"
  • "REG_RESOURCE_LIST"
  • "REG_FULL_RESOURCE_DESCRIPTOR"
  • "REG_RESOURCE_REQUIREMENTS_LIST"
  • "REG_QWORD"
  • "INVALID"

Registry Write

${registry::Write} "[fullpath]" "[value]" "[string]" "[TYPE]" $var
 
$var == 0   # success
$var == -1  # error

Registry Extra Read

${registry::ReadExtra} "[fullpath]" "[value]" "[number]" $var1 $var2

Registry Extra Write

${registry::WriteExtra} "[fullpath]" "[value]" "[string]" $var
 
$var == 0   # success
$var == -1  # error

Create Registry Key

${registry::CreateKey} "[fullpath]" $var
$var == 1   # [fullpath] already exists
$var == 0   # [fullpath] successfully created
$var == -1  # error

Delete Registry Value (same as DeleteRegValue)

${registry::DeleteValue} "[fullpath]" "[value]" $var
 
$var == 0   # success
$var == -1  # error

Delete Registry Key (same as DeleteRegKey)

${registry::DeleteKey} "[fullpath]" $var
 
$var == 0   # success
$var == -1  # error

Delete Empty Registry Key (if no values and subkeys in it)

${registry::DeleteKeyEmpty} "[fullpath]" $var
 
$var == 0   # success
$var == -1  # error

Copy Registry Value

${registry::CopyValue} "[fullpath_source]" "[value_source]" "[fullpath_target]" "[value_target]" $var
 
$var == 0   # success
$var == -1  # error

Move Registry Value

${registry::MoveValue} "[fullpath_source]" "[value_source]" "[fullpath_target]" "[value_target]" $var
 
$var == 0   # success
$var == -1  # error

Copy Registry Key

${registry::CopyKey} "[fullpath_source]" "[fullpath_target]\[new_key_name]" $var
 
$var == 0   # success
$var == -1  # error

Move Registry Key

${registry::MoveKey} "[fullpath_source]" "[fullpath_target]\[new_key_name]" $var
 
$var == 0   # success
$var == -1  # error

Registry Export (save to the file in REGEDIT4 format)

${registry::SaveKey} "[fullpath]" "[file]" "[Options]" $var
 
 
$var == 0   # success
$var == -1  # error

Registry Import (restore from the file)

${registry::RestoreKey} "[file]" $var
 
$var == 0   # success
$var == -1  # error

Note: ${registry::RestoreKey} simply exec regedit: regedit /s "[file]"

StrToHex (converts string to hex values)

${registry::StrToHex} "[string]" $var

"[string]" - String to convert

$var - Hex string

HexToStr (converts hex values to string)

${registry::HexToStr} "[hex_string]" $var

"[string]" - Hex string to convert

$var - String

Unload plugin

${registry::Unload}

Tips

REG_QWORD "Gotcha"

When writing values they must be in a quoted hex string exactly 16 characters long.

Example

 ## Set the QWord value to 0
 ${registry::Write} "HKLM\${PathToKey}" "ExecTime" "0000000000000000" "REG_QWORD" $R0