Windows System Programming : Listing Registry Keys and Contents

Program 1, lsReg, is a modification of this article (lsW, the file and directory listing program); it processes registry keys and key/value pairs rather than directories and files.

Program 1. lsReg: Listing Registry Keys and Content

#include "Everything.h" BOOL TraverseRegistry(HKEY, LPTSTR, LPTSTR, LPBOOL); BOOL DisplayPair(LPTSTR, DWORD, LPBYTE, DWORD, LPBOOL); BOOL DisplaySubKey(LPTSTR, LPTSTR, PFILETIME, LPBOOL); int _tmain(int argc, LPTSTR argv[]) { BOOL flags[2], ok = TRUE; TCHAR keyName[MAX_PATH+1]; LPTSTR pScan; DWORD i, keyIndex; HKEY hKey, hNextKey; /* Tables of predefined key names and keys */ LPTSTR PreDefKeyNames[] = { _T("HKEY_LOCAL_MACHINE"), _T("HKEY_CLASSES_ROOT"), _T("HKEY_CURRENT_USER"), _T("HKEY_CURRENT_CONFIG"), NULL }; HKEY PreDefKeys[] = { HKEY_LOCAL_MACHINE, HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_CURRENT_CONFIG }; keyIndex = Options( argc, argv, _T("Rl"), &flags[0], &flags[1], NULL); /* "Parse" the search pattern into "key"and "subkey". */ pScan = argv[keyIndex]; for (i = 0; *pScan != _T('\\') && *pScan != _T('\0') && i < MAX_PATH; pScan++, i++) keyName[i] = *pScan; keyName[i] = _T('\0'); if (*pScan == _T('\\')) pScan++; /* Translate predefined key name to an HKEY */ for (i = 0; PreDefKeyNames[i] != NULL && _tcscmp(PreDefKeyNames[i], keyName) != 0; i++) ; hKey = PreDefKeys[i]; RegOpenKeyEx(hKey, pScan, 0, KEY_READ, &hNextKey); hKey = hNextKey; ok = TraverseRegistry(hKey, argv[keyIndex], NULL, flags); RegCloseKey(hKey); return ok ? 0 : 1; } BOOL TraverseRegistry(HKEY hKey, LPTSTR fullKeyName, LPTSTR subKey, LPBOOL flags) /* Traverse registry key and subkeys if the -R option is set. */ { HKEY hSubKey; BOOL recursive = flags[0]; LONG result; DWORD valueType, index; DWORD numSubKeys, maxSubKeyLen, numValues, maxValueNameLen, maxValueLen; DWORD subKeyNameLen, valueNameLen, valueLen; FILETIME lastWriteTime; LPTSTR subKeyName, valueName; LPBYTE value; TCHAR fullSubKeyName[MAX_PATH+1]; /* Open the key handle. */ RegOpenKeyEx(hKey, subKey, 0, KEY_READ, &hSubKey); /* Find max size info regarding the key and allocate storage */ RegQueryInfoKey(hSubKey, NULL, NULL, NULL, &numSubKeys, &maxSubKeyLen, NULL, &numValues, &maxValueNameLen, &maxValueLen, NULL, &lastWriteTime); subKeyName = malloc(TSIZE * (maxSubKeyLen+1)); valueName = malloc(TSIZE * (maxValueNameLen+1)); value = malloc(maxValueLen); /* size in bytes */ /* First pass for key-value pairs. */ /* Assumption: No one edits the registry under this subkey */ /* during this loop. Doing so could change add new values */ for (index = 0; index < numValues; index++) { valueNameLen = maxValueNameLen + 1; /* Don't forget to set */ valueLen = maxValueLen + 1; /* these values */ result = RegEnumValue(hSubKey, index, valueName, &valueNameLen, NULL, &valueType, value, &valueLen); if (result == ERROR_SUCCESS && GetLastError() == 0) DisplayPair(valueName, valueType, value, valueLen, flags); } /* Second pass for subkeys. */ for (index = 0; index < numSubKeys; index++) { subKeyNameLen = maxSubKeyLen + 1; result = RegEnumKeyEx(hSubKey, index, subKeyName, &subKeyNameLen, NULL, NULL, NULL, &lastWriteTime); if (GetLastError() == 0) { DisplaySubKey(fullKeyName, subKeyName, &lastWriteTime, flags); /* Display subkey components if -R is specified */ if (recursive) { _stprintf(fullSubKeyName, _T("%s\\%s"), fullKeyName, subKeyName); TraverseRegistry(hSubKey, fullSubKeyName, subKeyName, flags); } } } _tprintf(_T("\n")); free(subKeyName); free(valueName); free(value); RegCloseKey(hSubKey); return TRUE; } BOOL DisplayPair(LPTSTR valueName, DWORD valueType, LPBYTE value, DWORD valueLen, LPBOOL flags) /* Function to display key-value pairs. */ { LPBYTE pV = value; DWORD i; _tprintf(_T("\n%s = "), valueName); switch (valueType) { case REG_FULL_RESOURCE_DESCRIPTOR: /* 9: hardware description */ case REG_BINARY: /* 3: Binary data in any form. */ for (i = 0; i < valueLen; i++, pV++) _tprintf(_T(" %x"), *pV); break; case REG_DWORD: /* 4: A 32-bit number. */ _tprintf(_T("%x"), (DWORD)*value); break; case REG_EXPAND_SZ: /* 2: null-terminated unexpanded string */ case REG_MULTI_SZ: /* 7: An array of null-terminated strings */ case REG_SZ: /* 1: A null-terminated string. */ _tprintf(_T("%s"), (LPTSTR)value); break; /* ... Several other types */ } return TRUE; } BOOL DisplaySubKey(LPTSTR keyName, LPTSTR subKeyName, PFILETIME pLastWrite, LPBOOL flags) { BOOL longList = flags[1]; SYSTEMTIME sysLastWrite; _tprintf(_T("\n%s"), keyName); if (_tcslen(subKeyName) > 0) _tprintf(_T("\\%s "), subKeyName); if (longList) { FileTimeToSystemTime(pLastWrite, &sysLastWrite); _tprintf(_T("%02d/%02d/%04d %02d:%02d:%02d"), sysLastWrite.wMonth, sysLastWrite.wDay, sysLastWrite.wYear, sysLastWrite.wHour, sysLastWrite.wMinute, sysLastWrite.wSecond); } return TRUE; }

 

Run 1 shows lsReg operation, including using the -l option. The -R option also works, but examples require a lot of vertical space and are omitted.

Run 1. lsReg: Listing Registry Keys, Values, and Data