/*******************************************************************
*
* Copyright (c) 1999 Microsoft Corporation
*
* DESCRIPTION: an extension to dump the contents of registry keys and values
*
* AUTHOR:
* Based on Code by : danielwe (Dan Weisman)
* ntsd addition by : kksharma (Kshitiz K. Sharma)
*
* DATE:4/20/1999
*
*******************************************************************/
#ifndef KERNEL
#ifndef Print
#define Print dprintf
#endif
#define OFLAG(l) (1L << ((DWORD)#@l - (DWORD)'a'))
#define LINE_NUMBER 0
#define NUM_ASCII_CHARS 16
#define NUM_HEX_CHARS (NUM_ASCII_CHARS * 3)
#define SPACE 7
#define PB_BUFFER_SIZE (NUM_ASCII_CHARS * 50)
VOID dregHelp() {
dprintf("!dreg -[d|w] <keyPath>[![<valueName> | *]] - Dumps registry information\n");
dprintf("!dreg -d ... - Prints binary values as DWORDs\n");
dprintf("!dreg -w ... - Prints binary values as WORDs\n");
dprintf("!dreg <keyPath>!* - Prints all values under <keyPath>\n");
dprintf("!dreg <keyPath> - Prints all subkeys of <keyPath>\n");
dprintf("\n");
dprintf("<keypath> can begin with any of the following:\n");
dprintf("\thklm - HKEY_LOCAL_MACHINE\n");
dprintf("\thkcu - HKEY_CURRENT_USER\n");
dprintf("\thkcr - HKEY_CLASSES_ROOT\n");
dprintf("\thku - HKEY_USERS\n");
dprintf("\tif absent, hklm is assumed\n");
dprintf("\n");
dprintf("Ex:\n");
dprintf("!dreg hkcu\\Software\\Microsoft\n");
dprintf("!dreg System\\CurrentControlSet\\Services\\Tcpip!*\n");
dprintf("!dreg System\\CurrentControlSet\\Services\\Tcpip!Start\n");
}
VOID PrintBinary(PBYTE pbData, DWORD cbData, USHORT uWidth)
{
CHAR line[80];
INT i;
INT ascii = 0;
PBYTE temp = pbData;
BOOL fDone = FALSE;
DWORD cbCount = 0;
CHAR hex_digits[] = "0123456789ABCDEF";
while (!fDone)
{
DWORD cb;
memset(line, 0x20, sizeof(line));
Print("%04X: ", cbCount);
for (ascii = 0,i = LINE_NUMBER, cb = 0;
ascii < NUM_ASCII_CHARS;
ascii++, temp++)
{
if ((DWORD)(temp - pbData) >= cbData)
{
if (cbData < PB_BUFFER_SIZE)
{
fDone = TRUE;
break;
}
else
return;
}
line[i] = hex_digits[(*temp & 0xF0) >> 4];
line[i + 1] = hex_digits[(*temp & 0x0F)];
cb++;
if ((ascii + 1) % uWidth == 0)
{
line[i + 2] = 0x20;
i++;
if (uWidth > 1)
{
line[i + 3] = 0x20;
i++;
}
else if (uWidth == 1 && (!(cb % 4)))
{
line[i + 3] = 0x20;
line[i + 4] = 0x20;
i += 2;
}
}
i += 2;
line[ascii + NUM_HEX_CHARS + SPACE + LINE_NUMBER] =
(isprint(*temp) ? *temp : '.');
cbCount++;
}
line[79] = 0;
Print("%s\n", line);
}
}
VOID PrintMultiSz(PBYTE pbData)
{
LPSTR sz = (LPSTR)pbData;
DWORD csz = 0;
while (*sz)
{
Print("%d: \"%s\"\n", csz, *sz ? sz : "<empty>");
csz++;
sz += lstrlenA(sz) + 1;
}
}
VOID PrintRegistryValue(DWORD dwType, PBYTE pbData, DWORD cbData, USHORT uWidth)
{
switch (dwType)
{
case REG_SZ:
Print("REG_SZ: \"%s\"\n", *pbData ? pbData : "<empty>");
break;
case REG_EXPAND_SZ:
{
CHAR szExpanded[MAX_PATH + 1];
Print("REG_EXPAND_SZ: \"%s\"\n", pbData);
ExpandEnvironmentStringsA((LPCSTR)pbData, (LPSTR)&szExpanded,
MAX_PATH);
Print("expanded = \"%s\"\n", szExpanded);
break;
}
case REG_DWORD:
{
DWORD dwData = * ((DWORD *)pbData);
Print("REG_DWORD: %lu = 0x%08X\n", dwData, dwData);
break;
}
case REG_BINARY:
{
Print("REG_BINARY:\n");
PrintBinary(pbData, cbData, uWidth);
break;
}
case REG_MULTI_SZ:
{
Print("REG_MULTI_SZ:\n");
PrintMultiSz(pbData);
break;
}
}
}
VOID EnumSubKeys(HKEY hkeyRoot, LPSTR szKey)
{
HKEY hkey;
LONG l;
BOOL fFound = FALSE;
l = RegOpenKeyExA(hkeyRoot, szKey, 0, KEY_READ, &hkey);
if (ERROR_SUCCESS == l)
{
FILETIME ft;
DWORD cbName;
CHAR szName[MAX_PATH + 1];
DWORD dwIndex;
for (dwIndex = 0; l == ERROR_SUCCESS; dwIndex++)
{
cbName = MAX_PATH;
l = RegEnumKeyExA(hkey, dwIndex, szName, &cbName, NULL,
NULL, NULL,&ft);
if (ERROR_SUCCESS == l)
{
Print("Subkey: %s\n", szName);
fFound = TRUE;
}
}
RegCloseKey(hkey);
}
else
{
Print("Could not open subkey %s. Error (%d).\n", szKey, l);
}
if (!fFound)
{
Print("No subkeys\n");
}
}
VOID EnumValues(HKEY hkeyRoot, LPSTR szKey, USHORT uWidth)
{
HKEY hkey;
LONG l;
BOOL fFound = FALSE;
l = RegOpenKeyExA(hkeyRoot, szKey, 0, KEY_READ, &hkey);
if (ERROR_SUCCESS == l)
{
DWORD cbMax;
l = RegQueryInfoKeyA(hkey, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, &cbMax, NULL, NULL);
if (ERROR_SUCCESS == l)
{
DWORD cbName;
CHAR szName[MAX_PATH + 1];
DWORD dwIndex;
PBYTE pbData;
DWORD dwType;
DWORD cbData;
pbData = (PBYTE)LocalAlloc(LPTR, cbMax);
if (pbData)
{
for (dwIndex = 0; l == ERROR_SUCCESS; dwIndex++)
{
cbName = MAX_PATH;
cbData = cbMax;
l = RegEnumValueA(hkey, dwIndex, szName, &cbName, NULL,
&dwType, pbData, &cbData);
if (ERROR_SUCCESS == l)
{
Print("Value: \"%s\" - ", szName);
PrintRegistryValue(dwType, pbData, cbData, uWidth);
Print("------------------------------------------------------------------------\n");
fFound = TRUE;
}
}
LocalFree(pbData);
}
}
RegCloseKey(hkey);
}
else
{
Print("Could not open subkey %s. Error (%d).\n", szKey, l);
}
if (!fFound)
{
Print("No values\n");
}
}
/************************************************************************\
* Procedure: Idreg
*
* Description: Dumps registry value
*
* Returns: fSuccess
*
* 4/14/1999 Created DanielWe
*
\************************************************************************/
BOOL Idreg(
DWORD opts,
LPCSTR InString)
{
LONG l;
HKEY hkey;
DWORD cbData = 0;
DWORD dwType;
LPBYTE pbData = NULL;
LPSTR szKey = NULL;
LPSTR szValue = NULL;
CHAR String[512];
LPTSTR lpas = String;
LPTSTR lpasOrig = String;
HKEY hkeyRoot;
strcpy(String, InString);
// Eat leading spaces first
while (*lpas && *lpas == ' ')
{
lpas++;
}
while (*lpas && *lpas != '\\')
{
lpas++;
}
if (!*lpas)
{
// Corner case.. no backslash at all. Assume HKLM and start over
hkeyRoot = HKEY_LOCAL_MACHINE;
lpas = lpasOrig;
}
else
{
// Figure out which hive they want to open
*lpas = 0;
if (!lstrcmpiA(lpasOrig, "hkcu"))
{
hkeyRoot = HKEY_CURRENT_USER;
lpas++;
}
else if (!lstrcmpiA(lpasOrig, "hklm"))
{
hkeyRoot = HKEY_LOCAL_MACHINE;
lpas++;
}
else if (!lstrcmpiA(lpasOrig, "hku"))
{
hkeyRoot = HKEY_USERS;
lpas++;
}
else if (!lstrcmpiA(lpasOrig, "hkcr"))
{
hkeyRoot = HKEY_CLASSES_ROOT;
lpas++;
}
else if (!lstrcmpiA(lpasOrig, "help"))
{
dregHelp();
return FALSE;
}
else
{
hkeyRoot = HKEY_LOCAL_MACHINE;
// Restore the backslash because we assume if they don't use these
// keywords, then they want HKLM
*lpas = '\\';
lpas = lpasOrig;
}
}
szKey = (LPSTR)lpas;
while (*lpas && *lpas != '!')
{
lpas++;
}
if (*lpas)
{
// Null terminate the !
*lpas++ = 0;
// mark beginning of new string
szValue = (LPSTR)lpas;
}
if (szKey == NULL || *szKey == 0)
{
Print("Expected subkey name\n");
dregHelp();
return FALSE;
}
if (szValue == NULL || *szValue == 0)
{
EnumSubKeys(hkeyRoot, szKey);
}
else if (!lstrcmpA(szValue, "*"))
{
EnumValues(hkeyRoot, szKey, (USHORT)opts);
}
else
{
l = RegOpenKeyExA(hkeyRoot, (LPCSTR)szKey, 0, KEY_READ, &hkey);
if (ERROR_SUCCESS == l)
{
l = RegQueryValueExA(hkey, (LPCSTR)szValue, NULL, &dwType, NULL,
&cbData);
if (ERROR_SUCCESS == l)
{
pbData = (LPBYTE)LocalAlloc(LPTR, cbData);
l = RegQueryValueExA(hkey, (LPCSTR)szValue, NULL, &dwType, pbData,
&cbData);
if (ERROR_SUCCESS == l)
{
PrintRegistryValue(dwType, pbData, cbData, (USHORT)opts);
}
LocalFree(pbData);
}
else
{
Print("Could not query value %s!%s. Error (%d).\n", szKey, szValue, l);
}
RegCloseKey(hkey);
}
else
{
Print("Could not open subkey %s. Error (%d).\n", szKey, l);
}
}
return TRUE;
}
#endif // !KERNEL