Jump to content

Recommended Posts

Hy to all, 

I am really Sorry to come up with this question but i can't seem to solve the Problem.

Its quite easy, I have been using RegNumKey for Years, but i seemed to lose track of something.

For $ZaehlerLocal = 1 to 1200
      $RegKey = RegEnumKey("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall", $ZaehlerLocal)
      If @error <> 0 then ExitLoop
      $RegKey2=RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\"&$RegKey,"DisplayName")
      $RegKey3=RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\"&$RegKey,"UninstallString")
      $RegKey4=RegRead("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\"&$RegKey,"QuietUninstallString")


      if StringInStr($RegKey,"_Office15")==0 and StringInStr($RegKey2,"(German) 2013")==0 and StringInStr($RegKey,".KB")==0 and StringInStr($RegKey2,"Security update")==0 and StringInStr($RegKey2,"Framework")==0 Then
        FileWrite($FileHandleLocal,$RegKey&";")
        FileWrite($FileHandleLocal,$RegKey2&";")
        FileWrite($FileHandleLocal,$RegKey3&";")
        FileWriteline($FileHandleLocal,$RegKey4&";")
     EndIf
   Next
 

Ive been using this to get all uninstall Strings from the Registry but for some reason, this doesn't work anymore. 

I get some keys but not all, nore does it start with the first registry.

As you can see in the picture, the Registry starts with {13DA9C7C-EBFB-40D0-94A1-55B42883DF21}

but RegNumKey starts with Adressbook.

Any Ideas what I am doing wrong? I tried HKLM64 instead as well, but with same result.

Again sorry to bother, but i can't Find the mistake.

 

2018_01_25_09_14_33_Registrierungs_Editor.png

Link to comment
Share on other sites

You could try:

#include <Array.au3>

Global $aUninstall[1][5]

_RegReadUninstall("HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall")
_RegReadUninstall("HKLM64\Software\Microsoft\Windows\CurrentVersion\Uninstall")

_ArraySort($aUninstall, 0, 1, 0, 1)
_ArrayDisplay($aUninstall)

Func _RegReadUninstall($sRegHive = "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall")
    $i = 1
    While 1
        $sRegKey = RegEnumKey($sRegHive, $i)
            If @error Then ExitLoop
        _ArrayAdd($aUninstall, $sRegHive & '|' & $sRegKey & '|' & RegRead($sRegHive & "\" & $sRegKey, "DisplayName") & "|" & RegRead($sRegHive & "\" & $sRegKey, "UninstallString") & '|' & RegRead($sRegHive & "\" & $sRegKey, "QuietUninstallString"))
        $i += 1
    WEnd
    $aUninstall[0][0] = UBound($aUninstall) - 1
EndFunc

 

Edited by Subz
Forgot to add ArraySort
Link to comment
Share on other sites

4 minutes ago, Subz said:

You could try:

#include <Array.au3>

Global $aUninstall[1][5]

_RegReadUninstall("HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall")
_RegReadUninstall("HKLM64\Software\Microsoft\Windows\CurrentVersion\Uninstall")

_ArrayDisplay($aUninstall)

Func _RegReadUninstall($sRegHive = "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall")
    $i = 1
    While 1
        $sRegKey = RegEnumKey($sRegHive, $i)
            If @error Then ExitLoop
        _ArrayAdd($aUninstall, $sRegHive & '|' & $sRegKey & '|' & RegRead($sRegHive & "\" & $sRegKey, "DisplayName") & "|" & RegRead($sRegHive & "\" & $sRegKey, "UninstallString") & '|' & RegRead($sRegHive & "\" & $sRegKey, "QuietUninstallString"))
        $i += 1
    WEnd
    $aUninstall[0][0] = UBound($aUninstall) - 1
EndFunc

 

Hy, this is nice way to get thinks sorted, but basicly does the same, that my script does. And unfortunatly leaves out the needed keys as well. 

:-(

Link to comment
Share on other sites

1 hour ago, Subz said:

It actually captures those keys they're just added to the bottom, once you sort the array they'll all appear at the top.

I saved the Array to a file, but the Keys were not in that file, nor were the in the Array. For some reason, its not posible to find this key via regnumkey. 

Link to comment
Share on other sites

  • Moderators

@nitron that is why I typically use WMI:

Local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
    If IsObj($oWMI) Then
        $aSystem = $oWMI.ExecQuery("Select * from Win32_Product")
            For $oApp In $aSystem
                ConsoleWrite("Application: " & $oApp.Name & " Version: " & $oApp.Version & @CRLF)
            Next
    Else
        ConsoleWrite("Unable to connect to WMI" & @CRLF)
    EndIf

People with debate WMI vs. Registry; neither is perfect, and WMI can run a little slowly, but I find it less of a headache.

"Profanity is the last vestige of the feeble mind. For the man who cannot express himself forcibly through intellect must do so through shock and awe" - Spencer W. Kimball

How to get your question answered on this forum!

Link to comment
Share on other sites

5 minutes ago, Subz said:

Strange it works for me, I get 700 keys from both HKLM and HKLM64 and can verify thats the correct number of subkeys, maybe you require #RequireAdmin at the top of your script.

I do understand that it is hard to get, but for some reason its wont Work on 400 pc any more. 

 

Edited by nitron
But thanks for your try! I apreachate it
Link to comment
Share on other sites

9 minutes ago, JLogan3o13 said:

@nitron that is why I typically use WMI:

Local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
    If IsObj($oWMI) Then
        $aSystem = $oWMI.ExecQuery("Select * from Win32_Product")
            For $oApp In $aSystem
                ConsoleWrite("Application: " & $oApp.Name & " Version: " & $oApp.Version & @CRLF)
            Next
    Else
        ConsoleWrite("Unable to connect to WMI" & @CRLF)
    EndIf

People with debate WMI vs. Registry; neither is perfect, and WMI can run a little slowly, but I find it less of a headache.

Thanks, that works Fine!!! I still have to retrive the unsinstall key from registry, but at leas all Programs are found!

Thanks

Link to comment
Share on other sites

I get those entries if i use:

_RegReadUninstall('HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall')

 

Spoiler

Renamer - Rename files and folders, remove portions of text from the filename etc.

GPO Tool - Export/Import Group policy settings.

MirrorDir - Synchronize/Backup/Mirror Folders

BeatsPlayer - Music player.

Params Tool - Right click an exe to see it's parameters or execute them.

String Trigger - Triggers pasting text or applications or internet links on specific strings.

Inconspicuous - Hide files in plain sight, not fully encrypted.

Regedit Control - Registry browsing history, quickly jump into any saved key.

Time4Shutdown - Write the time for shutdown in minutes.

Power Profiles Tool - Set a profile as active, delete, duplicate, export and import.

Finished Task Shutdown - Shuts down pc when specified window/Wndl/process closes.

NetworkSpeedShutdown - Shuts down pc if download speed goes under "X" Kb/s.

IUIAutomation - Topic with framework and examples

Au3Record.exe

Link to comment
Share on other sites

On 25.1.2018 at 1:38 PM, JLogan3o13 said:

@nitron that is why I typically use WMI:

Local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
    If IsObj($oWMI) Then
        $aSystem = $oWMI.ExecQuery("Select * from Win32_Product")
            For $oApp In $aSystem
                ConsoleWrite("Application: " & $oApp.Name & " Version: " & $oApp.Version & @CRLF)
            Next
    Else
        ConsoleWrite("Unable to connect to WMI" & @CRLF)
    EndIf

People with debate WMI vs. Registry; neither is perfect, and WMI can run a little slowly, but I find it less of a headache.

One more remark. With WMI i got all Software entries. But, it just worked with Adminrights. The Second it was run in normal account, it dropped the other Software parts as well. I now use Powershell. witch doesn't seem to care, what account you use.

Link to comment
Share on other sites

@nitron did you try what i suggested? what do you get? You see, i have all permissions, but only get all entries when i run it with that registry path.

Spoiler

Renamer - Rename files and folders, remove portions of text from the filename etc.

GPO Tool - Export/Import Group policy settings.

MirrorDir - Synchronize/Backup/Mirror Folders

BeatsPlayer - Music player.

Params Tool - Right click an exe to see it's parameters or execute them.

String Trigger - Triggers pasting text or applications or internet links on specific strings.

Inconspicuous - Hide files in plain sight, not fully encrypted.

Regedit Control - Registry browsing history, quickly jump into any saved key.

Time4Shutdown - Write the time for shutdown in minutes.

Power Profiles Tool - Set a profile as active, delete, duplicate, export and import.

Finished Task Shutdown - Shuts down pc when specified window/Wndl/process closes.

NetworkSpeedShutdown - Shuts down pc if download speed goes under "X" Kb/s.

IUIAutomation - Topic with framework and examples

Au3Record.exe

Link to comment
Share on other sites

On 1.2.2018 at 8:42 PM, careca said:

@nitron did you try what i suggested? what do you get? You see, i have all permissions, but only get all entries when i run it with that registry path.

Yes, I did. For some Reason only a few key are collected. I tried wow64... etc... I tried HKLM64... i tried it i all difrent variations. For some reason, any reg key above Adressbook is ignored. I do it with Powershell now. at least that works, even though i don't like mixinig scripts.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...