Hello Gents,
Following this thread
http://www.boot-land.net/forums/index.php?showtopic=11212, I have decided to use MS WDK (
http://msdn.microsoft.com/en-us/library/ee...7(v=VS.85).aspx) to write a command line tool that will allow one to read and write to an offline registry hive.
Version 0.9 here :
http://reboot.pro/files/file/313-offlinereg/
Command line usage :
OfflineReg a_hive_file a_key_path a_verb a_value_name [a_value]
example : OfflineReg "c:\temp\system" a_key
getvalue a_value_name
example : OfflineReg "c:\temp\system" key\subkey
getvalue a_value_name
example : OfflineReg "c:\temp\system" a_key
setvalue a_string_value_name a_new_value
example : OfflineReg "c:\temp\system" a_key
setvalue a_dword_key a_dword_value 4
example : OfflineReg "c:\temp\system" a_key
setvalue a_qword_key a_qword_value 11
example : OfflineReg "c:\temp\system" a_key
setvalue a_binary_key 0a,0b,0c,0d,0e,0f 3
example : OfflineReg "c:\temp\system" a_key_path
setvalue a_multi_value_name "aa bb cc dd" 7
(setvalue will createvalue if value does not exist yet)
example : OfflineReg "c:\temp\system" a_key
deletevalue a_value
example : OfflineReg "c:\temp\system" a_key
deletekey a_subkey
example : OfflineReg "c:\temp\system" a_key
createkey a_subkey
example : OfflineReg "c:\temp\system" a_key
enumkeys
example : OfflineReg "c:\temp\system" a_key
enumvalues
A real life example :
OfflineReg "D:\Windows\system32\config\system" ControlSet001\Control\ProductOptions getvalue "ProductType".
Should display :
"ProductType"=WinNT
Feedback, suggestions, etc welcome.
Regards,
Erwan.