3 # Copyright (C) 2009 Red Hat Inc.
5 # This program is free software; you can redistribute it and/or modify
6 # it under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 2 of the License, or
8 # (at your option) any later version.
10 # This program is distributed in the hope that it will be useful,
11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with this program; if not, write to the Free Software
17 # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 use Sys::Guestfs::Lib qw(open_guest get_partitions resolve_windows_path
24 inspect_all_partitions inspect_partition
25 inspect_operating_systems mount_operating_system);
28 use File::Temp qw/tempdir/;
29 use Locale::TextDomain 'libguestfs';
35 virt-win-reg - Display Windows Registry entries from a Windows guest
39 virt-win-reg [--options] domname '\Path\To\Subkey' name ['\Path'...]
41 virt-win-reg [--options] domname '\Path\To\Subkey' @ ['\Path'...]
43 virt-win-reg [--options] domname '\Path\To\Subkey' ['\Path'...]
45 virt-win-reg [--options] disk.img [...] '\Path\To\Subkey' (name|@)
49 This program can display Windows Registry entries from a Windows
52 The first parameter is the libvirt guest name or the raw disk image of
55 Then follow one or more sets of path specifiers. The path must begin
56 with a C<\> (backslash) character, and may be something like
57 C<'\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion'>.
59 The next parameter after that is either a value name, the single
60 at-character C<@>, or missing.
62 If it's a value name, then we print the data associated with that
63 value. If it's C<@>, then we print the default data associated with
64 the subkey. If it's missing, then we print all the data associated
67 If this is confusing, look at the L</EXAMPLES> section below.
69 Usually you should use single quotes to protect backslashes in the
72 Paths and value names are case-insensitive.
74 =head2 SUPPORTED SYSTEMS
76 The program currently supports Windows NT-derived guests starting with
77 Windows XP through to at least Windows 7.
79 Registry support is done for C<\HKEY_LOCAL_MACHINE\SAM>,
80 C<\HKEY_LOCAL_MACHINE\SECURITY>, C<\HKEY_LOCAL_MACHINE\SOFTWARE>,
81 C<\HKEY_LOCAL_MACHINE\SYSTEM> and C<\HKEY_USERS\.DEFAULT>.
83 C<\HKEY_USERS\$SID> and C<\HKEY_CURRENT_USER> are B<not> supported at
88 This program is only meant for simple access to the registry. If you
89 want to do complicated things with the registry, we suggest you
90 download the Registry hive files from the guest using C<libguestfs(3)>
91 or C<guestfish(1)> and access them locally, eg. using C<hivex(3)>,
92 C<hivexml(1)> or C<reged(1)>.
96 $ virt-win-reg MyWinGuest \
97 '\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion' \
99 Microsoft Windows Server 2003
101 $ virt-win-reg MyWinGuest \
102 '\HKEY_LOCAL_MACHINE\System\ControlSet001\Control' SystemBootDevice
103 multi(0)disk(0)rdisk(0)partition(1)
105 $ virt-win-reg MyWinGuest \
106 '\HKEY_LOCAL_MACHINE\System\ControlSet001\Control'
107 "CurrentUser"="USERNAME"
108 "WaitToKillServiceTimeout"="20000"
109 "SystemStartOptions"="NOEXECUTE=OPTOUT FASTDETECT"
110 "SystemBootDevice"="multi(0)disk(0)rdisk(0)partition(1)"
112 (please suggest some more)
132 Display version number and exit.
138 =item B<--connect URI> | B<-c URI>
140 If using libvirt, connect to the given I<URI>. If omitted, then we
141 connect to the default libvirt hypervisor.
143 If you specify guest block devices directly, then libvirt is not used
150 GetOptions ("help|?" => \$help,
151 "version" => \$version,
152 "connect|c=s" => \$uri,
154 pod2usage (1) if $help;
156 my $g = Sys::Guestfs->new ();
157 my %h = $g->version ();
158 print "$h{major}.$h{minor}.$h{release}$h{extra}\n";
162 # Split the command line at the first path. Paths begin with
163 # backslash so this is predictable.
168 for ($i = 0; $i < @ARGV; ++$i) {
169 if (substr ($ARGV[$i], 0, 1) eq "\\") {
170 @lib_args = @ARGV[0 .. ($i-1)];
171 @ARGV = @ARGV[$i .. $#ARGV];
176 pod2usage (__"virt-win-reg: no VM name, disk images or Registry path given") if 0 == @lib_args;
180 $g = open_guest (\@lib_args, address => $uri);
182 $g = open_guest (\@lib_args);
187 # List of possible filesystems.
188 my @partitions = get_partitions ($g);
190 # Now query each one to build up a picture of what's in it.
192 inspect_all_partitions ($g, \@partitions,
193 use_windows_registry => 0);
195 my $oses = inspect_operating_systems ($g, \%fses);
197 my @roots = keys %$oses;
198 die __"no root device found in this operating system image" if @roots == 0;
199 die __"multiboot operating systems are not supported by virt-win-reg" if @roots > 1;
200 my $root_dev = $roots[0];
202 my $os = $oses->{$root_dev};
203 mount_operating_system ($g, $os);
205 # Create a working directory to store the downloaded registry files.
206 my $tmpdir = tempdir (CLEANUP => 1);
208 # Now process each request in turn.
213 for ($i = 0; $i < @ARGV; ++$i) {
216 if (/^\\HKEY_LOCAL_MACHINE\\SAM(\\.*)/i) {
217 $winfile = "/windows/system32/config/sam";
218 $localhive = "$tmpdir/sam";
221 elsif (/^\\HKEY_LOCAL_MACHINE\\SECURITY(\\.*)/i) {
222 $winfile = "/windows/system32/config/security";
223 $localhive = "$tmpdir/security";
226 elsif (/^\\HKEY_LOCAL_MACHINE\\SOFTWARE(\\.*)/i) {
227 $winfile = "/windows/system32/config/software";
228 $localhive = "$tmpdir/software";
231 elsif (/^\\HKEY_LOCAL_MACHINE\\SYSTEM(\\.*)/i) {
232 $winfile = "/windows/system32/config/system";
233 $localhive = "$tmpdir/system";
236 elsif (/^\\HKEY_USERS\\.DEFAULT(\\.*)/i) {
237 $winfile = "/windows/system32/config/default";
238 $localhive = "$tmpdir/default";
242 die "virt-win-reg: $_: not a supported Windows Registry path\n"
245 unless (-f $localhive) {
246 # Check the hive file exists and get the real name.
248 $winfile = $g->case_sensitive_path ($winfile);
249 $g->download ($winfile, $localhive);
252 die "virt-win-reg: $winfile: could not download registry file: $@\n"
256 # What sort of request is it? Peek at the next arg.
257 my $name; # will be: undefined, @ or a name
259 if (substr ($ARGV[$i+1], 0, 1) ne "\\") {
267 @cmd = ("hivexget", $localhive, $path, $name);
269 @cmd = ("hivexget", $localhive, $path);
273 or die "hivexget command failed: $?\n";
284 L<Sys::Guestfs::Lib(3)>,
286 L<http://libguestfs.org/>.
290 Richard W.M. Jones L<http://et.redhat.com/~rjones/>
294 Copyright (C) 2009 Red Hat Inc.
296 This program is free software; you can redistribute it and/or modify
297 it under the terms of the GNU General Public License as published by
298 the Free Software Foundation; either version 2 of the License, or
299 (at your option) any later version.
301 This program is distributed in the hope that it will be useful,
302 but WITHOUT ANY WARRANTY; without even the implied warranty of
303 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
304 GNU General Public License for more details.
306 You should have received a copy of the GNU General Public License
307 along with this program; if not, write to the Free Software
308 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.