5 hivexsh - Windows Registry hive shell
9 hivexsh [-options] [hivefile]
13 This program provides a simple shell for navigating Windows Registry
14 'hive' files. It uses the hivex library for access to these binary
17 Firstly you will need to provide a hive file from a Windows operating
18 system. The hive files are usually located in
19 C<C:\Windows\System32\Config> and have names like C<software>,
20 C<system> etc (without any file extension). For more information
21 about hive files, read L<hivex(3)>. For information about downloading
22 files from virtual machines, read L<virt-cat(1)> and L<guestfish(1)>.
24 You can provide the name of the hive file to examine on the command
29 Or you can start C<hivexsh> without any arguments, and immediately use
30 the C<load> command to load a hive:
34 Welcome to hivexsh, the hivex interactive shell for examining
35 Windows Registry binary hive files.
37 Type: 'help' for help with commands
38 'quit' to quit the shell
43 Navigate through the hive's keys using the C<cd> command, as if it
44 contained a filesystem, and use C<ls> to list the subkeys of the
45 current key. Other commands are listed below.
53 Enable lots of debug messages. If you find a Registry file that this
54 program cannot parse, please enable this option and post the complete
55 output I<and> the Registry hive file in your bug report.
59 Read commands from C<filename> instead of stdin. To write a hivexsh
66 If this option is given, then writes are allowed to the hive
67 (see L</commit> command below, and the discussion of
68 modifying hives in L<hivex(3)/WRITING TO HIVE FILES>).
70 B<Important Note:> Even if you specify this option, nothing is written
71 to a hive unless you call the L</commit> command. If you exit the
72 shell without committing, all changes will be discarded.
74 If this option is not given, then write commands are disabled.
84 Change to the subkey C<path>. Use Windows-style backslashes to
85 separate path elements, and start with a backslash in order to start
86 from the root of the hive. For example:
90 moves from the root node, to the C<Classes> node, to the C<*> node.
91 If you were already at the root node, you could do this instead:
100 Path elements (node names) are matched case insensitively, and
101 characters like space, C<*>, and C<?> have I<no> special significance.
103 C<cd ..> may be used to go to the parent directory.
105 C<cd> without any arguments prints the current path.
107 Be careful with C<cd \> since the readline library has an undocumented
108 behaviour where it will think the final backslash is a continuation
109 (it reads the next line of input and appends it). Put a single space
112 =item B<close> | B<unload>
114 Close the currently loaded hive.
116 If you modified the hive, all uncommitted writes are lost when you
117 call this command (or if the shell exits). You have to call C<commit>
120 =item B<commit> [newfile]
122 Commit changes to the hive. If the optional C<newfile> parameter is
123 supplied, then the hive is written to that file, else the original
126 Note that you have to specify the C<-w> flag, otherwise no writes are
131 Delete the current node and everything beneath it. The current
132 directory is moved up one level (as if you did C<cd ..>) after
135 You cannot delete the root node.
137 =item B<exit> | B<quit>
141 =item B<load> hivefile
143 Load the binary hive named C<hivefile>. The currently loaded hive, if
144 any, is closed. The current directory is changed back to the root
149 List the subkeys of the current hive Registry key. Note this command
150 does not take any arguments.
154 List the (key, value) pairs of the current hive Registry key. If no
155 argument is given then all pairs are displayed. If C<key> is given,
156 then the value of the named key is displayed. If C<@> is given, then
157 the value of the default key is displayed.
159 =item B<setval> nrvals
161 This command replaces all (key, value) pairs at the current node with
162 the values in subsequent input. C<nrvals> is the number of values
163 (ie. (key, value) pairs), and any existing values at this node are
164 deleted. So C<setval 0> just deletes any values at the current node.
166 The command reads 2 * nrvals lines of input, with each pair of
167 lines of input corresponding to a key and a value to add.
169 For example, the following setval command replaces whatever is at the
170 current node with two (key, value) pairs. The default key is set to
171 the UTF16-LE-encoded string "abcd". The other value is named
172 "ANumber" and is a little-endian DWORD 0x12345678.
180 The first line of each pair is the key (the special key C<@> means
181 the default key, but you can also use a blank line).
183 The second line of each pair is the value, which has a special format
184 C<type:value> with possible types summarized in the table below:
186 none No data is stored, and the type is set to 0.
188 string:abc "abc" is stored as a UTF16-LE-encoded
189 string (type 1). Note that only 7 bit
190 ASCII strings are supported as input.
192 expandstring:... Same as string but with type 2.
194 dword:0x01234567 A DWORD (type 4) with the hex value
195 0x01234567. You can also use decimal
196 or octal numbers here.
198 qword:0x0123456789abcdef
199 A QWORD (type 11) with the hex value
200 0x0123456789abcdef. You can also use
201 decimal or octal numbers here.
203 hex:<type>:<hexbytes>
204 hex:1:41,00,42,00,43,00,44,00,00,00
205 This is the generic way to enter any
206 value. <type> is the integer value type.
207 <hexbytes> is a list of pairs of hex
208 digits which are treated as bytes.
209 (Any non-hex-digits here are ignored,
210 so you can separate bytes with commas
211 or spaces if you want).
217 $ guestfish --ro -i Windows7
218 ><fs> download win:c:\windows\system32\config\software software
223 Welcome to hivexsh, the hivex interactive shell for examining
224 Windows Registry binary hive files.
226 Type: 'help' for help with commands
227 'quit' to quit the shell
237 RegisteredApplications
249 L<http://libguestfs.org/>,
255 Richard W.M. Jones (C<rjones at redhat dot com>)
259 Copyright (C) 2009-2010 Red Hat Inc.
261 This program is free software; you can redistribute it and/or modify
262 it under the terms of the GNU General Public License as published by
263 the Free Software Foundation; either version 2 of the License, or
264 (at your option) any later version.
266 This program is distributed in the hope that it will be useful,
267 but WITHOUT ANY WARRANTY; without even the implied warranty of
268 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
269 GNU General Public License for more details.
271 You should have received a copy of the GNU General Public License along
272 with this program; if not, write to the Free Software Foundation, Inc.,
273 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.