Holger Posted March 18, 2005 Posted March 18, 2005 (edited) Just for learning, looking or leaving Search for a value in the registry. Take it and modify like you want expandcollapse popup#include <GUIConstants.au3> GUICreate("Test",500,80) $info_text = GUICtrlCreateLabel("",10,10,480,60) GUISetState() Global $found = "" SearchReg("HKCU","Version") ;SearchReg("HKLM","ProductName") GUIDelete() Msgbox(0,"",$found) Exit ;***************************************************** ; Recursive search-function ;***************************************************** Func SearchReg($startkey,$searchval) Local $startkey,$val,$i,$key,$searchval,$z $i = 1 While 1 $key = RegEnumKey($startkey,$i) If @error <> 0 Then ExitLoop GUICtrlSetData($info_text,$startkey & "\" & $key) $z = 1 While 1 $val = RegEnumVal($startkey & "\" & $key,$z) If @error <> 0 Then ExitLoop If StringInStr($val,$searchval) Then $found = $found & "ValueName, " & $startkey & "\" & $key & ", " & $val & @LF $readval = RegRead($startkey & "\" & $key,$val) If $readval <> "" And StringInStr($readval,$searchval) Then $found = $found & "Value, " & $startkey & "\" & $key & ", " & $val & ", " & $readval & @LF $z = $z + 1 WEnd SearchReg($startkey & "\" & $key,$searchval) $i = $i + 1 WEnd ;Sleep(1); just 1 idle milli second -> not used at the moment EndFunc Regards Holger Edited March 18, 2005 by Holger usera and JoshuaBarnette 2 Old project:GUI/Tray menu with icons and colors Other old stuff:IconFileScanner, TriState/ThreeState GUI TreeView, GUI ContextMenu created out of a TreeView
PsaltyDS Posted August 10, 2006 Posted August 10, 2006 (edited) Just for learning, looking or leaving Search for a value in the registry. Take it and modify like you want ... Regards Holger Don't like the re$triction$ on the REGFIND.exe in the resource kit, so... Tweaked to use local variables only in the function and format to taste: expandcollapse popup$SearchKey = "HKLM\SOFTWARE\Microsoft" $SearchString = "Files" $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString) $Timer = TimerDiff($Timer) / 1000 MsgBox(64, "Results", "Results of search for: " & $SearchString & @CRLF & _ "Time taken (in seconds): " & $Timer & @CRLF & _ "---------------------------------------" & @CRLF & _ $Results) ;***************************************************** ; Function _RegSearch($startkey, $searchval) ; Performs a recursive search of the registry ; Starting at $sStartKey, looking for $sSearchVal ; Returns a string containing a list of key names and values. ; If the key or value name contain the $sSearchVal, it is listed as a reg path: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion ; If the data contains the $sSearchVal, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir = C:\Program Files\Common Files ;***************************************************** Func _RegSearch($startkey, $searchval) Local $val, $i, $key, $z, $found = "" $i = 1 While 1 $key = RegEnumKey($startkey, $i) If @error <> 0 Then ExitLoop $z = 1 While 1 $val = RegEnumVal($startkey & "\" & $key, $z) If @error <> 0 Then ExitLoop If StringInStr($val, $searchval) Then $found = $found & $startkey & "\" & $key & "\" & $val & @LF EndIf $readval = RegRead($startkey & "\" & $key, $val) If $readval <> "" And StringInStr($readval, $searchval) Then $found = $found & $startkey & "\" & $key & "\" & $val & " = " & $readval & @LF EndIf $z = $z + 1 WEnd _RegSearch($startkey & "\" & $key, $searchval) $i = $i + 1 WEnd Return $found EndFunc ;==>SearchReg But surely there's a COM object provider for this... somewhere...??? P.S. The sample search in the demo above took about 25sec on my XP box. Edited August 10, 2006 by PsaltyDS Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
markloman Posted August 15, 2006 Posted August 15, 2006 When there are no subkeys below $startkey and the search value is directly below $startkey, this value will not be found.
PsaltyDS Posted August 16, 2006 Posted August 16, 2006 When there are no subkeys below $startkey and the search value is directly below $startkey, this value will not be found.I'm in my Windows-free zone... as soon as I come out I'll fix that... thanks for the heads up. Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
PsaltyDS Posted August 16, 2006 Posted August 16, 2006 (edited) When there are no subkeys below $startkey and the search value is directly below $startkey, this value will not be found. I think it's fixed. I also tweaked the results format a little, so you can tell the difference between a key name match and a value name match (by the trailing backslash). Let me know if it works for you! expandcollapse popup$SearchKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" $SearchString = "Wall" $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString) $Timer = TimerDiff($Timer) / 1000 MsgBox(64, "_RegSearch() Test", "Results of searching registry:" & @CRLF & _ "In: " & $SearchKey & @CRLF & _ "For: " & $SearchString & @CRLF & _ "Time taken (in seconds): " & $Timer & @CRLF & _ "---------------------------------------" & @CRLF & _ $Results) ;***************************************************** ; Function _RegSearch($startkey, $searchval) ; Performs a recursive search of the registry ; Starting at $sStartKey, looking for $sSearchVal ; Returns a string containing a list of key names and values. ; If a key name matches, it is listed as a reg path with trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ; If a value name matches, it is listed as a reg path without trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir ; If the data matches, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper ;***************************************************** Func _RegSearch($startkey, $searchval) Local $v, $val, $k, $key, $found = "" ; This loop checks values $v = 1 While 1 $val = RegEnumVal($startkey, $v) If @error = 0 Then ; Valid value - test it's name If StringInStr($val, $searchval) Then $found = $found & $startkey & "\" & $val & @LF EndIf ; test it's data $readval = RegRead($startkey, $val) If StringInStr($readval, $searchval) Then $found = $found & $startkey & "\" & $val & " = " & $readval & @LF EndIf $v += 1 Else ; No more values here ExitLoop EndIf WEnd ; This loop checks subkeys $k = 1 While 1 $key = RegEnumKey($startkey, $k) If @error = 0 Then ; Valid key - test it's name If StringInStr($key, $searchval) Then $found = $found & $startkey & "\" & $key & "\" & @LF EndIf ; Now search it $found = $found & _RegSearch($startkey & "\" & $key, $searchval) Else ; No more keys here ExitLoop EndIf $k += 1 WEnd ; Return results Return $found EndFunc ;==>_RegSearch Edited August 16, 2006 by PsaltyDS Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
markloman Posted August 21, 2006 Posted August 21, 2006 Excellent! Thanks for the quick change! This one works perfect (as far as I can tell).
PsaltyDS Posted July 30, 2008 Posted July 30, 2008 Updated the _RegSearch() function to include flags for matching only Keys, Values, or Data: expandcollapse popup#include <Array.au3>; Only for _ArrayDisplay() in demo $SearchKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" $SearchString = "Wall" ; Find all $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString) $Timer = TimerDiff($Timer) / 1000 MsgBox(64, "_RegSearch() Test", "Results of searching registry (all):" & @CRLF & _ "In: " & $SearchKey & @CRLF & _ "For: " & $SearchString & @CRLF & _ "Time taken (in seconds): " & $Timer & @CRLF & _ "---------------------------------------" & @CRLF & _ $Results) ; Find only key names $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString, 1) $Timer = TimerDiff($Timer) / 1000 MsgBox(64, "_RegSearch() Test", "Results of searching registry (Keys names only):" & @CRLF & _ "In: " & $SearchKey & @CRLF & _ "For: " & $SearchString & @CRLF & _ "Time taken (in seconds): " & $Timer & @CRLF & _ "---------------------------------------" & @CRLF & _ $Results) ; Find only Value names $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString, 2) $Timer = TimerDiff($Timer) / 1000 MsgBox(64, "_RegSearch() Test", "Results of searching registry (value names only):" & @CRLF & _ "In: " & $SearchKey & @CRLF & _ "For: " & $SearchString & @CRLF & _ "Time taken (in seconds): " & $Timer & @CRLF & _ "---------------------------------------" & @CRLF & _ $Results) ; Find only data, return as an array $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString, 4, 1) $Timer = TimerDiff($Timer) / 1000 _ArrayDisplay($Results, "Results (data only)") ;***************************************************** ; Function _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; Add bits together for multiple match types, default is 7 (all) ; $fArray = Return an array of results vice the string (defualt = False) ; Performs a recursive search of the registry starting at $sStartKey, looking for $sSearchVal ; Returns a string containing a list of key names and values. ; If a key name matches, it is listed as a reg path with trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ; If a value name matches, it is listed as a reg path without trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir ; If the data matches, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper ; If $fArray is True, then return data is an array with [0] = count. ;***************************************************** ; Change Log: ; v1.0.0.0 | 03/17/05 | Original SearchReg() by Holger ; v2.0.0.0 | 08/10/06 | Native AutoIt version by PsaltyDS ; v2.0.0.1 | 08/16/06 | Fixed bug reported by markloman ; v2.0.1.0 | 07/30/08 | Added $iType and $fArray parameters ;***************************************************** Func _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) Local $v, $sVal, $k, $sKey, $sFound = "" ; Generate type flags If Not BitAND($iType, 0x07) Then Return SetError(1, 0, 0); No returns selected Local $fKeys = BitAND($iType, 0x1), $fValue = BitAND($iType, 0x2), $fData = BitAND($iType, 0x4) ; This checks values and data in the current key If ($fValue Or $fData) Then $v = 1 While 1 $sVal = RegEnumVal($sStartKey, $v) If @error = 0 Then ; Valid value - test its name If $fValue And StringInStr($sVal, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & @LF ; test its data If $fData Then $readval = RegRead($sStartKey, $sVal) If StringInStr($readval, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & " = " & $readval & @LF EndIf EndIf $v += 1 Else ; No more values here ExitLoop EndIf WEnd EndIf ; This loop checks subkeys $k = 1 While 1 $sKey = RegEnumKey($sStartKey, $k) If @error = 0 Then ; Valid key - test it's name If $fKeys And StringInStr($sKey, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sKey & "\" & @LF ; Now search it $sFound &= _RegSearch($sStartKey & "\" & $sKey, $sSearchVal, $iType) Else ; No more keys here ExitLoop EndIf $k += 1 WEnd ; Return results If StringRight($sFound, 1) = @LF Then $sFound = StringTrimRight($sFound, 1) If $fArray Then Return StringSplit($sFound, @LF) Else Return $sFound EndIf EndFunc ;==>_RegSearch Comments always welcome! Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
PsaltyDS Posted November 12, 2008 Posted November 12, 2008 (edited) Tweaked version 2.0.2.0 of _RegSearch() to fix bug. When $fArray = True and no matches are found, it was returning an array with [0] = 1 and [1] = "". Now correctly returns 1-element array with [0] = 0. expandcollapse popup;***************************************************** ; Function _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; Add bits together for multiple match types, default is 7 (all) ; $fArray = Return an array of results vice the string (defualt = False) ; Performs a recursive search of the registry starting at $sStartKey, looking for $sSearchVal ; Returns a string containing a list of key names and values. ; If a key name matches, it is listed as a reg path with trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ; If a value name matches, it is listed as a reg path without trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir ; If the data matches, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper ; If $fArray is True, then return data is an array with [0] = count. ;***************************************************** ; Change Log: ; v1.0.0.0 | 03/17/05 | Original SearchReg() by Holger ; v2.0.0.0 | 08/10/06 | Native AutoIt version by PsaltyDS ; v2.0.0.1 | 08/16/06 | Fixed bug reported by markloman ; v2.0.1.0 | 07/30/08 | Added $iType and $fArray parameters ; v2.0.2.0 | 11/12/08 | Fixed bug returning array [0] = 1 vice 0 for none found ;***************************************************** Func _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) Local $v, $sVal, $k, $sKey, $sFound = "", $avFound[1] = [0] ; Generate type flags If Not BitAND($iType, 0x07) Then Return SetError(1, 0, 0); No returns selected Local $fKeys = BitAND($iType, 0x1), $fValue = BitAND($iType, 0x2), $fData = BitAND($iType, 0x4) ; This checks values and data in the current key If ($fValue Or $fData) Then $v = 1 While 1 $sVal = RegEnumVal($sStartKey, $v) If @error = 0 Then ; Valid value - test its name If $fValue And StringInStr($sVal, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & @LF ; test its data If $fData Then $readval = RegRead($sStartKey, $sVal) If StringInStr($readval, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & " = " & $readval & @LF EndIf EndIf $v += 1 Else ; No more values here ExitLoop EndIf WEnd EndIf ; This loop checks subkeys $k = 1 While 1 $sKey = RegEnumKey($sStartKey, $k) If @error = 0 Then ; Valid key - test it's name If $fKeys And StringInStr($sKey, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sKey & "\" & @LF ; Now search it $sFound &= _RegSearch($sStartKey & "\" & $sKey, $sSearchVal, $iType) Else ; No more keys here ExitLoop EndIf $k += 1 WEnd ; Return results If StringRight($sFound, 1) = @LF Then $sFound = StringTrimRight($sFound, 1) If $fArray Then If StringStripWS($sFound, 8) <> "" Then $avFound = StringSplit($sFound, @LF) Return $avFound Else Return $sFound EndIf EndFunc ;==>_RegSearch Edited November 12, 2008 by PsaltyDS Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
PsaltyDS Posted June 22, 2010 Posted June 22, 2010 Tweaked version 2.0.3.0, fixing bug reported by squid808: expandcollapse popup;***************************************************** ; Function _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; Add bits together for multiple match types, default is 7 (all) ; $fArray = Return an array of results vice the string (defualt = False) ; Performs a recursive search of the registry starting at $sStartKey, looking for $sSearchVal ; Returns a string containing a list of key names and values. ; If a key name matches, it is listed as a reg path with trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ; If a value name matches, it is listed as a reg path without trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir ; If the data matches, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper ; If $fArray is True, then return data is an array with [0] = count. ;***************************************************** ; Change Log: ; v1.0.0.0 | 03/17/05 | Original SearchReg() by Holger ; v2.0.0.0 | 08/10/06 | Native AutoIt version by PsaltyDS ; v2.0.0.1 | 08/16/06 | Fixed bug reported by markloman ; v2.0.1.0 | 07/30/08 | Added $iType and $fArray parameters ; v2.0.2.0 | 11/12/08 | Fixed bug returning array [0] = 1 vice 0 for none found ; v2.0.3.0 | 06/22/10 | Fixed bug appending some result strings together reported by squid808 ;***************************************************** Func _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) Local $v, $sVal, $k, $sKey, $sFound = "", $sFoundSub = "", $avFound[1] = [0] ; Trim trailing backslash, if present If StringRight($sStartKey, 1) = "\" Then $sStartKey = StringTrimRight($sStartKey, 1) ; Generate type flags If Not BitAND($iType, 0x07) Then Return SetError(1, 0, 0); No returns selected Local $fKeys = BitAND($iType, 0x1), $fValue = BitAND($iType, 0x2), $fData = BitAND($iType, 0x4) ; This checks values and data in the current key If ($fValue Or $fData) Then $v = 1 While 1 $sVal = RegEnumVal($sStartKey, $v) If @error = 0 Then ; Valid value - test its name If $fValue And StringInStr($sVal, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & @LF ; test its data If $fData Then $readval = RegRead($sStartKey, $sVal) If StringInStr($readval, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & " = " & $readval & @LF EndIf EndIf $v += 1 Else ; No more values here ExitLoop EndIf WEnd EndIf ; This loop checks subkeys $k = 1 While 1 $sKey = RegEnumKey($sStartKey, $k) If @error = 0 Then ; Valid key - test it's name If $fKeys And StringInStr($sKey, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sKey & "\" & @LF ; Now search it $sFoundSub = _RegSearch($sStartKey & "\" & $sKey, $sSearchVal, $iType, False) ; use string mode to test sub keys If $sFoundSub <> "" Then $sFound &= $sFoundSub & @LF Else ; No more keys here ExitLoop EndIf $k += 1 WEnd ; Return results If StringRight($sFound, 1) = @LF Then $sFound = StringTrimRight($sFound, 1) If $fArray Then If StringStripWS($sFound, 8) <> "" Then $avFound = StringSplit($sFound, @LF) Return $avFound Else Return $sFound EndIf EndFunc ;==>_RegSearch Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
PsaltyDS Posted June 23, 2010 Posted June 23, 2010 (edited) New version 2.1.0.0: - Added $iType flag for RegExp pattern - Added Pseudo-pattern "*" to match all (internally translates to "." RegExp pattern) Demo script (only shows new functionallity): #include <Array.au3>; Only for _ArrayDisplay() in demo $SearchKey = "HKLM\SOFTWARE\AutoIt v3" ; Find only values, return as an array $SearchString = "*" ; find all values $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString, 2, 1) $Timer = TimerDiff($Timer) / 1000 _ArrayDisplay($Results, "Results (data only) in " & $Timer & " seconds") ; Find only values, by RegExp, return as an array $SearchString = "(?<=Install)Dir" ; find "Dir", only where preceded by "Install", using a RegExp look-behind assertion $Timer = TimerInit() $Results = _RegSearch($SearchKey, $SearchString, 2+8, 1) $Timer = TimerDiff($Timer) / 1000 _ArrayDisplay($Results, "Results (data only) in " & $Timer & " seconds") _RegSearch() Function: expandcollapse popup;***************************************************** ; Function: _RegSearch ; ; Purpose: Performs a recursive search of the registry starting at $sStartKey, looking for $sSearchVal ; ; Syntax: _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for, or RegExp pattern to use if $iType bit 3 is set ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; 8 = $sSearchVal is a RegExp pattern (default is StringInStr) ; Add bits together for multiple match types, default is 7 (all types, StringInStr matching) ; $fArray = Return an array of results vice the string ([0] = count) ; ; Return value: On success, returns a string containing a @LF delimited list of matching key names and values: ; Where a key name matches, it is listed as a reg path with trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ; Where a value name matches, it is listed as a reg path without trailing backslash: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir ; Where the data matches, the format is path = data: ; i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper ; On failure, returns 0 and sets @error. ; ; Notes: No matches is not an error, returns "" or an array with [0] = 0 depending on $fArray ; Default StringInStr() matches are not case sensitive. ;***************************************************** ; Change Log: ; v1.0.0.0 | 03/17/05 | Original SearchReg() by Holger ; v2.0.0.0 | 08/10/06 | Native AutoIt version by PsaltyDS ; v2.0.0.1 | 08/16/06 | Fixed bug reported by markloman ; v2.0.1.0 | 07/30/08 | Added $iType and $fArray parameters ; v2.0.2.0 | 11/12/08 | Fixed bug returning array [0] = 1 vice 0 for none found ; v2.0.3.0 | 06/22/10 | Fixed bug appending some result strings together reported by squid808 ; v2.1.0.0 | 06/23/10 | Added $iType option for RegExp patterns, and pseudo wildcard "*" ;***************************************************** Func _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) Local $v, $sVal, $k, $sKey, $sFound = "", $sFoundSub = "", $avFound[1] = [0] ; Trim trailing backslash, if present If StringRight($sStartKey, 1) = "\" Then $sStartKey = StringTrimRight($sStartKey, 1) ; Generate type flags If Not BitAND($iType, 0x07) Then Return SetError(1, 0, 0); No returns selected Local $fKeys = BitAND($iType, 0x1), $fValue = BitAND($iType, 0x2), $fData = BitAND($iType, 0x4), $fRegExp = BitAND($iType, 0x8) ; Check for wildcard If (Not $fRegExp) And ($sSearchVal == "*") Then ; Use RegExp pattern "." to match anything $iType += 0x8 $fRegExp = 0x8 $sSearchVal = "." EndIf ; This checks values and data in the current key If ($fValue Or $fData) Then $v = 1 While 1 $sVal = RegEnumVal($sStartKey, $v) If @error = 0 Then ; Valid value - test its name If $fValue Then If $fRegExp Then If StringRegExp($sVal, $sSearchVal, 0) Then $sFound &= $sStartKey & "\" & $sVal & @LF Else If StringInStr($sVal, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & @LF EndIf EndIf ; test its data If $fData Then $readval = RegRead($sStartKey, $sVal) If $fRegExp Then If StringRegExp($readval, $sSearchVal, 0) Then $sFound &= $sStartKey & "\" & $sVal & " = " & $readval & @LF Else If StringInStr($readval, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sVal & " = " & $readval & @LF EndIf EndIf $v += 1 Else ; No more values here ExitLoop EndIf WEnd EndIf ; This loop checks subkeys $k = 1 While 1 $sKey = RegEnumKey($sStartKey, $k) If @error = 0 Then ; Valid key - test it's name If $fKeys Then If $fRegExp Then If StringRegExp($sKey, $sSearchVal, 0) Then $sFound &= $sStartKey & "\" & $sKey & "\" & @LF Else If StringInStr($sKey, $sSearchVal) Then $sFound &= $sStartKey & "\" & $sKey & "\" & @LF EndIf EndIf ; Now search it $sFoundSub = _RegSearch($sStartKey & "\" & $sKey, $sSearchVal, $iType, False) ; use string mode to test sub keys If $sFoundSub <> "" Then $sFound &= $sFoundSub & @LF Else ; No more keys here ExitLoop EndIf $k += 1 WEnd ; Return results If StringRight($sFound, 1) = @LF Then $sFound = StringTrimRight($sFound, 1) If $fArray Then If StringStripWS($sFound, 8) <> "" Then $avFound = StringSplit($sFound, @LF) Return $avFound Else Return $sFound EndIf EndFunc ;==>_RegSearch Edit: Added clarifying verbiage to definition of $sSearchVal in header. Edited June 28, 2010 by PsaltyDS JoshuaBarnette 1 Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
Scriptonize Posted June 28, 2010 Posted June 28, 2010 That is a very nice script. Thank you for sharing it.I'm doing some test searches against my registry.All is working fine with the above example, but I need some help.I'm trying to find the meaning of the different flags in "_RegSearch($SearchKey, $SearchString, 2+8, 1)".ThanksScriptonize If you learn from It, it's not a mistake
PsaltyDS Posted June 28, 2010 Posted June 28, 2010 (edited) I'm trying to find the meaning of the different flags in "_RegSearch($SearchKey, $SearchString, 2+8, 1)". Look at the "Where:" section of the function header for the explanation of parameters: ; Syntax: _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for, or RegExp pattern to use if $iType bit 3 is set ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; 8 = $sSearchVal is a RegExp pattern (default is StringInStr) ; Add bits together for multiple match types, default is 7 (all types, StringInStr matching) ; $fArray = Return an array of results vice the string ([0] = count) The $iType parameter is bit-mapped to the type of data you want back. You can control multiple types to be returned by setting/clearing bits in that parameter. The example you asked about sets bit 21 (2) plus bit 23 (8), which results in only value names being matched (not key names or data), plus $sSearchVal will be treated as a RegExp pattern. I added some more verbiage to the definition of $sSearchVal to clarify that point. Edited June 28, 2010 by PsaltyDS Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
Scriptonize Posted June 29, 2010 Posted June 29, 2010 Jeez, I completely missed that comment with explanation. Sorry for that. Anyway, thanks for helping clearing things up. I appreciate it. Scriptonize Look at the "Where:" section of the function header for the explanation of parameters: ; Syntax: _RegSearch($sStartKey, $sSearchVal, $iType = 0x07, $fArray = False) ; ; Where: $sStartKey = Reg path at which to begin search ; $sSearchVal = The string to search for, or RegExp pattern to use if $iType bit 3 is set ; $iType = Matching types to return: ; 1 = Key names ; 2 = Value names ; 4 = Value data ; 8 = $sSearchVal is a RegExp pattern (default is StringInStr) ; Add bits together for multiple match types, default is 7 (all types, StringInStr matching) ; $fArray = Return an array of results vice the string ([0] = count) The $iType parameter is bit-mapped to the type of data you want back. You can control multiple types to be returned by setting/clearing bits in that parameter. The example you asked about sets bit 21 (2) plus bit 23 (8), which results in only value names being matched (not key names or data), plus $sSearchVal will be treated as a RegExp pattern. I added some more verbiage to the definition of $sSearchVal to clarify that point. If you learn from It, it's not a mistake
Keithdib Posted July 18, 2011 Posted July 18, 2011 Hi This is really useful script, thanks But how can I add and extra variable? I want to add an extra level of search... so I want it to search in the uninstall key [allready achived] then search for a certain app vendor [again I have done this] but I also want to add another key value.. the "UninstallString" this is so I can scan for this to use to uninstall an application from multiple machines [the app does not allways use the same uninstall string] thanks KeithDib
PsaltyDS Posted July 18, 2011 Posted July 18, 2011 Get the results back as an array, then loop through that for the next level of search. Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
Keithdib Posted July 18, 2011 Posted July 18, 2011 I wish I knew how to do that, I am new to this thanks
PsaltyDS Posted July 18, 2011 Posted July 18, 2011 Try this: #include <Array.au3> Global $sUninstallKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" Global $sValName = "UninstallString" ; Get array of all "UninstallString" values $aUninstallKeys = _RegSearch($sUninstallKey, $sValName, 2, True) ; 2 = Match on Value Names only, True = return array ; Create 2D array for data Global $aUninstallStrings[UBound($aUninstallKeys)][2] = [[$aUninstallKeys[0], ""]] ; Populate 2D array with value location and data For $n = 1 To $aUninstallKeys[0] $aUninstallStrings[$n][0] = $aUninstallKeys[$n] $aUninstallStrings[$n][1] = RegRead(StringTrimRight($aUninstallStrings[$n][0], StringLen($sValName)), $sValName) Next ; Display results _ArrayDisplay($aUninstallStrings) Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
Keithdib Posted July 18, 2011 Posted July 18, 2011 Hi I get an error C:\Users\KeithDib\Desktop\New AutoIt v3 Script (5).au3(19,64) : ERROR: _RegSearch(): undefined function. $aUninstallKeys = _RegSearch($sUninstallKey, $sValName, 2, True) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ C:\Users\KeithDib\Desktop\New AutoIt v3 Script (5).au3 - 1 error(s), 0 warning(s) cheers
PsaltyDS Posted July 19, 2011 Posted July 19, 2011 Well, yeah, you have to add the function. Copy it from Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law
twitchyliquid64 Posted July 19, 2011 Posted July 19, 2011 Very nice! I shall use this for my botnet killer. ongoing projects:-firestorm: Largescale P2P Social NetworkCompleted Autoit Programs/Scripts: Variable Pickler | Networked Streaming Audio (in pure autoIT) | firenet p2p web messenger | Proxy Checker | Dynamic Execute() Code Generator | P2P UDF | Graph Theory Proof of Concept - Breadth First search
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now