™.. Win::Hivex - Online Linux Manual PageSection : 3
Updated : 2015-07-23
Source : perl v5.10.1
Note : User Contributed Perl Documentation
NAMEWin::Hivex − Perl bindings for reading and writing Windows Registry hive files
SYNOPSIS use Win::Hivex;
$h = Win::Hivex−>open ('SOFTWARE');
$root_node = $h−>root ();
print $h−>node_name ($root_node);
DESCRIPTIONThe \*(C`Win::Hivex\*(C'\fR module provides a Perl \s-1XS\s0 binding to the hivex (3) API for reading and writing Windows Registry binary hive files.
ERRORSAll errors turn into calls to \*(C`croak\*(C'\fR (see \fICarp\fR\|(3)).
METHODSopen $h = Win::Hivex−>open ($filename,
[verbose => 1,]
[debug => 1,]
[write => 1,])
Open a Windows Registry binary hive file. The \*(C`verbose\*(C'\fR and \f(CW\*(C`debug\*(C'\fR flags enable different levels of debugging messages. The \*(C`write\*(C'\fR flag is required if you will be modifying the hive file (see ‟WRITING TO HIVE FILES” in hivex (3)). This function returns a hive handle. The hive handle is closed automatically when its reference count drops to 0. root $node = $h−>root ()
Return root node of the hive. All valid hives must contain a root node. This returns a node handle. last_modified $int64 = $h−>last_modified ()
Return the modification time from the header of the hive. The returned value is a Windows filetime. To convert this to a Unix \*(C`time_t\*(C'\fR see: <http://stackoverflow.com/questions/6161776/convert−windows−filetime−to−second−in−unix−linux/6161842#6161842> node_name $string = $h−>node_name ($node)
Return the name of the node. Note that the name of the root node is a dummy, such as \*(C`$$$PROTO.HIV\*(C'\fR (other names are possible: it seems to depend on the tool or program that created the hive in the first place). You can only know the ‟real” name of the root node by knowing which registry file this hive originally comes from, which is knowledge that is outside the scope of this library. node_timestamp $int64 = $h−>node_timestamp ($node)
Return the modification time of the node. The returned value is a Windows filetime. To convert this to a Unix \*(C`time_t\*(C'\fR see: <http://stackoverflow.com/questions/6161776/convert−windows−filetime−to−second−in−unix−linux/6161842#6161842> node_children @nodes = $h−>node_children ($node)
Return an array of nodes which are the subkeys (children) of \*(C`node\*(C'\fR. This returns a list of node handles. node_get_child $node = $h−>node_get_child ($node, $name)
Return the child of node with the name \*(C`name\*(C'\fR, if it exists. The name is matched case insensitively. This returns a node handle, or \*(C`undef\*(C'\fR if the node was not found. node_parent $node = $h−>node_parent ($node)
Return the parent of \*(C`node\*(C'\fR. The parent pointer of the root node in registry files that we have examined seems to be invalid, and so this function will return an error if called on the root node. This returns a node handle. node_values @values = $h−>node_values ($node)
Return the array of (key, value) pairs attached to this node. This returns a list of value handles. node_get_value $value = $h−>node_get_value ($node, $key)
Return the value attached to this node which has the name \*(C`key\*(C'\fR, if it exists. The key name is matched case insensitively. Note that to get the default key, you should pass the empty string "" here. The default key is often written "@", but inside hives that has no meaning and won't give you the default key. This returns a value handle. value_key_len $size = $h−>value_key_len ($val)
Return the length of the key (name) of a (key, value) pair. The length can legitimately be 0, so errno is the necessary mechanism to check for errors. In the context of Windows Registries, a zero-length name means that this value is the default key for this node in the tree. This is usually written as "@". This returns a size. value_key $string = $h−>value_key ($val)
Return the key (name) of a (key, value) pair. The name is reencoded as UTF−8 and returned as a string. The string should be freed by the caller when it is no longer needed. Note that this function can return a zero-length string. In the context of Windows Registries, this means that this value is the default key for this node in the tree. This is usually written as "@". value_type ($type, $len) = $h−>value_type ($val)
Return the data length and data type of the value in this (key, value) pair. See also \*(C`value_value\*(C'\fR which returns all this information, and the value itself. Also, \*(C`value_*\*(C'\fR functions below which can be used to return the value in a more useful form when you know the type in advance. node_struct_length $size = $h−>node_struct_length ($node)
Return the length of the node data structure. This returns a size. value_struct_length $size = $h−>value_struct_length ($val)
Return the length of the value data structure. This returns a size. value_value ($type, $data) = $h−>value_value ($val)
Return the value of this (key, value) pair. The value should be interpreted according to its type (see \*(C`hive_type\*(C'\fR). value_string $string = $h−>value_string ($val)
If this value is a string, return the string reencoded as UTF−8 (as a C string). This only works for values which have type \*(C`hive_t_string\*(C'\fR, \f(CW\*(C`hive_t_expand_string\*(C'\fR or \f(CW\*(C`hive_t_link\*(C'\fR. value_multiple_strings @strings = $h−>value_multiple_strings ($val)
If this value is a multiple-string, return the strings reencoded as UTF−8 (in C, as a NULL-terminated array of C strings, in other language bindings, as a list of strings). This only works for values which have type \*(C`hive_t_multiple_strings\*(C'\fR. value_dword $int32 = $h−>value_dword ($val)
If this value is a DWORD (Windows int32), return it. This only works for values which have type \*(C`hive_t_dword\*(C'\fR or \f(CW\*(C`hive_t_dword_be\*(C'\fR. value_qword $int64 = $h−>value_qword ($val)
If this value is a QWORD (Windows int64), return it. This only works for values which have type \*(C`hive_t_qword\*(C'\fR. commit $h−>commit ([$filename|undef])
Commit (write) any changes which have been made. \*(C`filename\*(C'\fR is the new file to write. If \f(CW\*(C`filename\*(C'\fR is null/undefined then we overwrite the original file (ie. the file name that was passed to \*(C`open\*(C'\fR). Note this does not close the hive handle. You can perform further operations on the hive after committing, including making more modifications. If you no longer wish to use the hive, then you should close the handle after committing. node_add_child $node = $h−>node_add_child ($parent, $name)
Add a new child node named \*(C`name\*(C'\fR to the existing node \f(CW\*(C`parent\*(C'\fR. The new child initially has no subnodes and contains no keys or values. The sk-record (security descriptor) is inherited from the parent. The parent must not have an existing child called \*(C`name\*(C'\fR, so if you want to overwrite an existing child, call \*(C`node_delete_child\*(C'\fR first. This returns a node handle. node_delete_child $h−>node_delete_child ($node)
Delete the node \*(C`node\*(C'\fR. All values at the node and all subnodes are deleted (recursively). The \*(C`node\*(C'\fR handle and the handles of all subnodes become invalid. You cannot delete the root node. node_set_values $h−>node_set_values ($node, \@values)
This call can be used to set all the (key, value) pairs stored in \*(C`node\*(C'\fR. \*(C`node\*(C'\fR is the node to modify. @values is an array of (keys, value) pairs. Each element should be a hashref containing \*(C`key\*(C'\fR, \f(CW\*(C`t\*(C'\fR (type) and \*(C`data\*(C'\fR. Any existing values stored at the node are discarded, and their \*(C`value\*(C'\fR handles become invalid. Thus you can remove all values stored at \*(C`node\*(C'\fR by passing \f(CW\*(C`@values = []\*(C'\fR. node_set_value $h−>node_set_value ($node, $val)
This call can be used to replace a single \*(C`(key, value)\*(C'\fR pair stored in \*(C`node\*(C'\fR. If the key does not already exist, then a new key is added. Key matching is case insensitive. \*(C`node\*(C'\fR is the node to modify.
COPYRIGHTCopyright (C) 2009−2011 Red Hat Inc.
LICENSEPlease see the file COPYING.LIB for the full license.
SEE ALSOhivex (3), hivexsh (1), <http://libguestfs.org>, Sys::Guestfs (3). 0
Johanes Gumabo
Data Size : 34,006 byte
man-Win::Hivex.3pmBuild : 2024-12-05, 20:55 :
Visitor Screen : x
Visitor Counter ( page / site ) : 3 / 165,978
Visitor ID : :
Visitor IP : 3.139.235.100 :
Visitor Provider : AMAZON-02 :
Provider Position ( lat x lon ) : 39.962500 x -83.006100 : x
Provider Accuracy Radius ( km ) : 1000 :
Provider City : Columbus :
Provider Province : Ohio , : ,
Provider Country : United States :
Provider Continent : North America :
Visitor Recorder : Version :
Visitor Recorder : Library :
Online Linux Manual Page : Version : Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page : Library : lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page : Library : lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base : Version : Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base : Library : lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36
Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .
If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.
ERROR : Need New Coding : (parse_manual_page_|249|Win::Hivex.3pm|36/37|el══─{─══.|.el══─{─══. ds -- \|\(em\|
) (htmlprn|149|Win::Hivex.3pm|36/37|.el══─{─══. ds -- — |.el══─{─══. ds -- \|\(em\|
) (parse_manual_page_|249|Win::Hivex.3pm|41|br══─}─══|'br══─}─══
) (htmlprn|149|Win::Hivex.3pm|41|'br══─}─══ |'br══─}─══
) (rof_nr_x|149|Win::Hivex.3pm|51/52|\nF|.ie \nF ══─{─══. de IX
) (rof_unit_scale_px|41|Win::Hivex.3pm|51/52|F|.ie \nF ══─{─══. de IX
) (rof_if|19|Win::Hivex.3pm|51/52|\nF|.ie \nF ══─{─══. de IX
) (htmlprn|149|Win::Hivex.3pm|51/52|.ie \nF ══─{─══. de IX|.ie \nF ══─{─══. de IX
) (rof_escape_sequence|91|Win::Hivex.3pm|53|\$1\t\\n%\t"\\$2" |. tm Index:\\$1\t\\n%\t"\\$2"
) (parse_manual_page_|249|Win::Hivex.3pm|57|══─}─══|.══─}─══
) (htmlprn|149|Win::Hivex.3pm|57|.══─}─══ |.══─}─══
) (rof_escape_sequence|91|Win::Hivex.3pm|145|\*(C`Win::Hivex\*(C'\fR module provides a Perl \s-1XS\s0 binding to the |The \f(CW\*(C`Win::Hivex\*(C'\fR module provides a Perl \s-1XS\s0 binding to the
) (rof_escape_sequence|91|Win::Hivex.3pm|150|\*(C`croak\*(C'\fR (see \fICarp\fR\|(3)). |All errors turn into calls to \f(CW\*(C`croak\*(C'\fR (see \fICarp\fR\|(3)).
) (rof_escape_sequence|91|Win::Hivex.3pm|164|\*(C`verbose\*(C'\fR and \f(CW\*(C`debug\*(C'\fR flags enable different levels of |The \f(CW\*(C`verbose\*(C'\fR and \f(CW\*(C`debug\*(C'\fR flags enable different levels of
) (rof_escape_sequence|91|Win::Hivex.3pm|167|\*(C`write\*(C'\fR flag is required if you will be modifying the |The \f(CW\*(C`write\*(C'\fR flag is required if you will be modifying the
) (rof_escape_sequence|91|Win::Hivex.3pm|190|\*(C`time_t\*(C'\fR see: |To convert this to a Unix \f(CW\*(C`time_t\*(C'\fR see:
) (rof_escape_sequence|91|Win::Hivex.3pm|201|\*(C`$$$PROTO.HIV\*(C'\fR (other names are possible: it seems to depend on the |\&\f(CW\*(C`$$$PROTO.HIV\*(C'\fR (other names are possible: it seems to depend on the
) (rof_escape_sequence|91|Win::Hivex.3pm|215|\*(C`time_t\*(C'\fR see: |To convert this to a Unix \f(CW\*(C`time_t\*(C'\fR see:
) (rof_escape_sequence|91|Win::Hivex.3pm|224|\*(C`node\*(C'\fR. |(children) of \f(CW\*(C`node\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|233|\*(C`name\*(C'\fR, if it exists. |Return the child of node with the name \f(CW\*(C`name\*(C'\fR, if it exists.
) (rof_escape_sequence|91|Win::Hivex.3pm|237|\*(C`undef\*(C'\fR if the node was not found. |This returns a node handle, or \f(CW\*(C`undef\*(C'\fR if the node was not found.
) (rof_escape_sequence|91|Win::Hivex.3pm|244|\*(C`node\*(C'\fR. |Return the parent of \f(CW\*(C`node\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|266|\*(C`key\*(C'\fR, |Return the value attached to this node which has the name \f(CW\*(C`key\*(C'\fR,
) (rof_escape_sequence|91|Win::Hivex.3pm|314|\*(C`value_value\*(C'\fR which returns all this |pair. See also \f(CW\*(C`value_value\*(C'\fR which returns all this
) (rof_escape_sequence|91|Win::Hivex.3pm|315|\*(C`value_*\*(C'\fR functions |information, and the value itself. Also, \f(CW\*(C`value_*\*(C'\fR functions
) (rof_escape_sequence|91|Win::Hivex.3pm|343|\*(C`hive_type\*(C'\fR). |be interpreted according to its type (see \f(CW\*(C`hive_type\*(C'\fR).
) (rof_escape_sequence|91|Win::Hivex.3pm|352|\*(C`hive_t_string\*(C'\fR, \f(CW\*(C`hive_t_expand_string\*(C'\fR or \f(CW\*(C`hive_t_link\*(C'\fR. |\&\f(CW\*(C`hive_t_string\*(C'\fR, \f(CW\*(C`hive_t_expand_string\*(C'\fR or \f(CW\*(C`hive_t_link\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|362|\*(C`hive_t_multiple_strings\*(C'\fR. |works for values which have type \f(CW\*(C`hive_t_multiple_strings\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|370|\*(C`hive_t_dword\*(C'\fR or \f(CW\*(C`hive_t_dword_be\*(C'\fR. |for values which have type \f(CW\*(C`hive_t_dword\*(C'\fR or \f(CW\*(C`hive_t_dword_be\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|378|\*(C`hive_t_qword\*(C'\fR. |works for values which have type \f(CW\*(C`hive_t_qword\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|387|\*(C`filename\*(C'\fR is the new file to write. If \f(CW\*(C`filename\*(C'\fR is null/undefined |\&\f(CW\*(C`filename\*(C'\fR is the new file to write. If \f(CW\*(C`filename\*(C'\fR is null/undefined
) (rof_escape_sequence|91|Win::Hivex.3pm|389|\*(C`open\*(C'\fR). |\&\f(CW\*(C`open\*(C'\fR).
) (rof_escape_sequence|91|Win::Hivex.3pm|401|\*(C`name\*(C'\fR to the existing node \f(CW\*(C`parent\*(C'\fR. |Add a new child node named \f(CW\*(C`name\*(C'\fR to the existing node \f(CW\*(C`parent\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|406|\*(C`name\*(C'\fR, so if you |The parent must not have an existing child called \f(CW\*(C`name\*(C'\fR, so if you
) (rof_escape_sequence|91|Win::Hivex.3pm|407|\*(C`node_delete_child\*(C'\fR |want to overwrite an existing child, call \f(CW\*(C`node_delete_child\*(C'\fR
) (rof_escape_sequence|91|Win::Hivex.3pm|417|\*(C`node\*(C'\fR. All values at the node and all subnodes are |Delete the node \f(CW\*(C`node\*(C'\fR. All values at the node and all subnodes are
) (rof_escape_sequence|91|Win::Hivex.3pm|418|\*(C`node\*(C'\fR handle and the handles of all |deleted (recursively). The \f(CW\*(C`node\*(C'\fR handle and the handles of all
) (rof_escape_sequence|91|Win::Hivex.3pm|427|\*(C`node\*(C'\fR. |stored in \f(CW\*(C`node\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|429|\*(C`node\*(C'\fR is the node to modify. |\&\f(CW\*(C`node\*(C'\fR is the node to modify.
) (rof_escape_sequence|91|Win::Hivex.3pm|432|\*(C`key\*(C'\fR, \f(CW\*(C`t\*(C'\fR (type) |Each element should be a hashref containing \f(CW\*(C`key\*(C'\fR, \f(CW\*(C`t\*(C'\fR (type)
) (rof_escape_sequence|91|Win::Hivex.3pm|433|\*(C`data\*(C'\fR. |and \f(CW\*(C`data\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|436|\*(C`value\*(C'\fR handles become invalid. Thus you can remove all |\&\f(CW\*(C`value\*(C'\fR handles become invalid. Thus you can remove all
) (rof_escape_sequence|91|Win::Hivex.3pm|437|\*(C`node\*(C'\fR by passing \f(CW\*(C`@values = []\*(C'\fR. |values stored at \f(CW\*(C`node\*(C'\fR by passing \f(CW\*(C`@values = []\*(C'\fR.
) (rof_escape_sequence|91|Win::Hivex.3pm|444|\*(C`(key, value)\*(C'\fR pair |This call can be used to replace a single \f(CW\*(C`(key, value)\*(C'\fR pair
) (rof_escape_sequence|91|Win::Hivex.3pm|445|\*(C`node\*(C'\fR. If the key does not already exist, then a |stored in \f(CW\*(C`node\*(C'\fR. If the key does not already exist, then a
) (rof_escape_sequence|91|Win::Hivex.3pm|448|\*(C`node\*(C'\fR is the node to modify. |\&\f(CW\*(C`node\*(C'\fR is the node to modify.
)