™.. hivexsh - Online Linux Manual PageSection : 1
Updated : 2011-06-28
Source : hivex-1.3.3
Note : Windows Registry
NAMEhivexsh − Windows Registry hive shell
SYNOPSIS​ hivexsh [−options] [hivefile]
DESCRIPTIONThis program provides a simple shell for navigating Windows Registry ​'hive' files. It uses the hivex library for access to these binary files. Firstly you will need to provide a hive file from a Windows operating system. The hive files are usually located in ​\*(C`C:\eWindows\eSystem32\eConfig\*(C'\fR and have names like \f(CW\*(C`software\*(C'\fR, ​\*(C`system\*(C'\fR etc (without any file extension). For more information about hive files, read hivex (3). For information about downloading files from virtual machines, read virt−cat (1) and guestfish (1). You can provide the name of the hive file to examine on the command line. For example: ​ hivexsh software Or you can start \*(C`hivexsh\*(C'\fR without any arguments, and immediately use the \*(C`load\*(C'\fR command to load a hive: ​ $ hivexsh ​ ​ Welcome to hivexsh, the hivex interactive shell for examining ​ Windows Registry binary hive files. ​ ​ Type: 'help' for help with commands ​ 'quit' to quit the shell ​ ​ > load software ​ software\> Navigate through the hive's keys using the \*(C`cd\*(C'\fR command, as if it contained a filesystem, and use \*(C`ls\*(C'\fR to list the subkeys of the current key. Other commands are listed below.
OPTIONS−d Enable lots of debug messages. If you find a Registry file that this program cannot parse, please enable this option and post the complete output and the Registry hive file in your bug report. −f filename Read commands from \*(C`filename\*(C'\fR instead of stdin. To write a hivexsh script, use: ​ #!/usr/bin/hivexsh −f −w If this option is given, then writes are allowed to the hive (see ‟commit” command below, and the discussion of modifying hives in ‟WRITING TO HIVE FILES” in hivex (3)). ​Important Note: Even if you specify this option, nothing is written to a hive unless you call the ‟commit” command. If you exit the shell without committing, all changes will be discarded. If this option is not given, then write commands are disabled.
COMMANDSadd name Add a subkey named \*(C`name\*(C'\fR below the current node. The name may contain spaces and punctuation characters, and does not need to be quoted. The new key will have no subkeys and no values (see \*(C`setval\*(C'\fR). There must be no existing subkey called \*(C`name\*(C'\fR, or this command will fail. To replace an existing subkey, delete it first like this: ​ cd name ​ del cd path Change to the subkey \*(C`path\*(C'\fR. Use Windows-style backslashes to separate path elements, and start with a backslash in order to start from the root of the hive. For example: ​ cd \Classes\* moves from the root node, to the \*(C`Classes\*(C'\fR node, to the \f(CW\*(C`*\*(C'\fR node. If you were already at the root node, you could do this instead: ​ cd Classes\* or even: ​ cd Classes ​ cd * Path elements (node names) are matched case insensitively, and characters like space, \*(C`*\*(C'\fR, and \f(CW\*(C`?\*(C'\fR have \fIno\fR special significance. ​\*(C`cd ..\*(C'\fR may be used to go to the parent directory. ​\*(C`cd\*(C'\fR without any arguments prints the current path. Be careful with \*(C`cd \e\*(C'\fR since the readline library has an undocumented behaviour where it will think the final backslash is a continuation (it reads the next line of input and appends it). Put a single space after the backslash. close | unload Close the currently loaded hive. If you modified the hive, all uncommitted writes are lost when you call this command (or if the shell exits). You have to call \*(C`commit\*(C'\fR to write changes. commit [newfile] Commit changes to the hive. If the optional \*(C`newfile\*(C'\fR parameter is supplied, then the hive is written to that file, else the original file is overwritten. Note that you have to specify the \*(C`\-w\*(C'\fR flag, otherwise no writes are allowed. del Delete the current node and everything beneath it. The current directory is moved up one level (as if you did \*(C`cd ..\*(C'\fR) after this command. You cannot delete the root node. exit | quit Exit the shell. load hivefile Load the binary hive named \*(C`hivefile\*(C'\fR. The currently loaded hive, if any, is closed. The current directory is changed back to the root node. ls List the subkeys of the current hive Registry key. Note this command does not take any arguments. lsval [key] List the (key, value) pairs of the current hive Registry key. If no argument is given then all pairs are displayed. If \*(C`key\*(C'\fR is given, then the value of the named key is displayed. If \*(C`@\*(C'\fR is given, then the value of the default key is displayed. setval nrvals This command replaces all (key, value) pairs at the current node with the values in subsequent input. \*(C`nrvals\*(C'\fR is the number of values (ie. (key, value) pairs), and any existing values at this node are deleted. So \*(C`setval 0\*(C'\fR just deletes any values at the current node. The command reads 2 * nrvals lines of input, with each pair of lines of input corresponding to a key and a value to add. For example, the following setval command replaces whatever is at the current node with two (key, value) pairs. The default key is set to the UTF16−LE−encoded string ‟abcd”. The other value is named ​‟ANumber” and is a little-endian DWORD 0x12345678. ​ setval 2 ​ @ ​ string:abcd ​ ANumber ​ dword:12345678 The first line of each pair is the key (the special key \*(C`@\*(C'\fR means the default key, but you can also use a blank line). The second line of each pair is the value, which has a special format ​\*(C`type:value\*(C'\fR with possible types summarized in the table below: ​ none No data is stored, and the type is set to 0. ​ ​ string:abc "abc" is stored as a UTF16−LE−encoded ​ string (type 1). Note that only 7 bit ​ ASCII strings are supported as input. ​ ​ expandstring:... Same as string but with type 2. ​ ​ dword:0x01234567 A DWORD (type 4) with the hex value ​ 0x01234567. You can also use decimal ​ or octal numbers here. ​ ​ qword:0x0123456789abcdef ​ A QWORD (type 11) with the hex value ​ 0x0123456789abcdef. You can also use ​ decimal or octal numbers here. ​ ​ hex:<type>:<hexbytes> ​ hex:1:41,00,42,00,43,00,44,00,00,00 ​ This is the generic way to enter any ​ value. <type> is the integer value type. ​ <hexbytes> is a list of pairs of hex ​ digits which are treated as bytes. ​ (Any non−hex−digits here are ignored, ​ so you can separate bytes with commas ​ or spaces if you want).
EXAMPLE​ $ guestfish −−ro −i Windows7 ​ ><fs> download win:c:\windows\system32\config\software software ​ ><fs> quit ​ ​ $ hivexsh software ​ ​ Welcome to hivexsh, the hivex interactive shell for examining ​ Windows Registry binary hive files. ​ ​ Type: 'help' for help with commands ​ 'quit' to quit the shell ​ ​ software\> ls ​ ATI Technologies ​ Classes ​ Clients ​ Intel ​ Microsoft ​ ODBC ​ Policies ​ RegisteredApplications ​ Sonic ​ Wow6432Node ​ software\> quit
SEE ALSO​hivex (3), ​hivexget (1), ​hivexml (1), ​virt−win−reg (1), ​guestfs (3), <http://libguestfs.org/>, ​virt−cat (1), ​virt−edit (1).
AUTHORSRichard W.M. Jones (\*(C`rjones at redhat dot com\*(C'\fR)
COPYRIGHTCopyright (C) 2009−2010 Red Hat Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of ​MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ​GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110−1301 USA. 0
Johanes Gumabo
Data Size   :   27,962 byte
man-hivexsh.1Build   :   2024-12-05, 20:55   :  
Visitor Screen   :   x
Visitor Counter ( page / site )   :   3 / 165,352
Visitor ID   :     :  
Visitor IP   :   3.143.7.53   :  
Visitor Provider   :   AMAZON-02   :  
Provider Position ( lat x lon )   :   39.962500 x -83.006100   :   x
Provider Accuracy Radius ( km )   :   1000   :  
Provider City   :   Columbus   :  
Provider Province   :   Ohio ,   :   ,
Provider Country   :   United States   :  
Provider Continent   :   North America   :  
Visitor Recorder   :   Version   :  
Visitor Recorder   :   Library   :  
Online Linux Manual Page   :   Version   :   Online Linux Manual Page - Fedora.40 - march=x86-64 - mtune=generic - 24.12.05
Online Linux Manual Page   :   Library   :   lib_c - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Online Linux Manual Page   :   Library   :   lib_m - 24.10.03 - march=x86-64 - mtune=generic - Fedora.40
Data Base   :   Version   :   Online Linux Manual Page Database - 24.04.13 - march=x86-64 - mtune=generic - fedora-38
Data Base   :   Library   :   lib_c - 23.02.07 - march=x86-64 - mtune=generic - fedora.36
Very long time ago, I have the best tutor, Wenzel Svojanovsky . If someone knows the email address of Wenzel Svojanovsky , please send an email to johanes_gumabo@yahoo.co.id .
If error, please print screen and send to johanes_gumabo@yahoo.co.id
Under development. Support me via PayPal.
ERROR : Need New Coding :         (parse_manual_page_|249|hivexsh.1|36/37|el══─{─══.|.el══─{─══. ds -- \|\(em\| )         (htmlprn|149|hivexsh.1|36/37|.el══─{─══. ds --  —  |.el══─{─══. ds -- \|\(em\| )         (parse_manual_page_|249|hivexsh.1|41|br══─}─══|'br══─}─══ )         (htmlprn|149|hivexsh.1|41|'br══─}─══ |'br══─}─══ )         (rof_nr_x|149|hivexsh.1|51/52|\nF|.ie \nF ══─{─══. de IX )         (rof_unit_scale_px|41|hivexsh.1|51/52|F|.ie \nF ══─{─══. de IX )         (rof_if|19|hivexsh.1|51/52|\nF|.ie \nF ══─{─══. de IX )         (htmlprn|149|hivexsh.1|51/52|.ie \nF ══─{─══. de IX|.ie \nF ══─{─══. de IX )         (rof_escape_sequence|91|hivexsh.1|53|\$1\t\\n%\t"\\$2" |. tm Index:\\$1\t\\n%\t"\\$2" )         (parse_manual_page_|249|hivexsh.1|57|══─}─══|.══─}─══ )         (htmlprn|149|hivexsh.1|57|.══─}─══ |.══─}─══ )         (rof_escape_sequence|91|hivexsh.1|147|\*(C`C:\eWindows\eSystem32\eConfig\*(C'\fR and have names like \f(CW\*(C`software\*(C'\fR, |\&\f(CW\*(C`C:\eWindows\eSystem32\eConfig\*(C'\fR and have names like \f(CW\*(C`software\*(C'\fR, )         (rof_escape_sequence|91|hivexsh.1|148|\*(C`system\*(C'\fR etc (without any file extension). For more information |\&\f(CW\*(C`system\*(C'\fR etc (without any file extension). For more information )         (rof_escape_sequence|91|hivexsh.1|159|\*(C`hivexsh\*(C'\fR without any arguments, and immediately use |Or you can start \f(CW\*(C`hivexsh\*(C'\fR without any arguments, and immediately use )         (rof_escape_sequence|91|hivexsh.1|160|\*(C`load\*(C'\fR command to load a hive: |the \f(CW\*(C`load\*(C'\fR command to load a hive: )         (rof_escape_sequence|91|hivexsh.1|175|\*(C`cd\*(C'\fR command, as if it |Navigate through the hive's keys using the \f(CW\*(C`cd\*(C'\fR command, as if it )         (rof_escape_sequence|91|hivexsh.1|176|\*(C`ls\*(C'\fR to list the subkeys of the |contained a filesystem, and use \f(CW\*(C`ls\*(C'\fR to list the subkeys of the )         (rof_escape_sequence|91|hivexsh.1|187|\*(C`filename\*(C'\fR instead of stdin. To write a hivexsh |Read commands from \f(CW\*(C`filename\*(C'\fR instead of stdin. To write a hivexsh )         (rof_escape_sequence|91|hivexsh.1|208|\*(C`name\*(C'\fR below the current node. The name may |Add a subkey named \f(CW\*(C`name\*(C'\fR below the current node. The name may )         (rof_escape_sequence|91|hivexsh.1|212|\*(C`setval\*(C'\fR). |The new key will have no subkeys and no values (see \f(CW\*(C`setval\*(C'\fR). )         (rof_escape_sequence|91|hivexsh.1|214|\*(C`name\*(C'\fR, or this command will |There must be no existing subkey called \f(CW\*(C`name\*(C'\fR, or this command will )         (rof_escape_sequence|91|hivexsh.1|223|\*(C`path\*(C'\fR. Use Windows-style backslashes to |Change to the subkey \f(CW\*(C`path\*(C'\fR. Use Windows-style backslashes to )         (rof_escape_sequence|91|hivexsh.1|231|\*(C`Classes\*(C'\fR node, to the \f(CW\*(C`*\*(C'\fR node. |moves from the root node, to the \f(CW\*(C`Classes\*(C'\fR node, to the \f(CW\*(C`*\*(C'\fR node. )         (rof_escape_sequence|91|hivexsh.1|246|\*(C`*\*(C'\fR, and \f(CW\*(C`?\*(C'\fR have \fIno\fR special significance. |characters like space, \f(CW\*(C`*\*(C'\fR, and \f(CW\*(C`?\*(C'\fR have \fIno\fR special significance. )         (rof_escape_sequence|91|hivexsh.1|248|\*(C`cd ..\*(C'\fR may be used to go to the parent directory. |\&\f(CW\*(C`cd ..\*(C'\fR may be used to go to the parent directory. )         (rof_escape_sequence|91|hivexsh.1|250|\*(C`cd\*(C'\fR without any arguments prints the current path. |\&\f(CW\*(C`cd\*(C'\fR without any arguments prints the current path. )         (rof_escape_sequence|91|hivexsh.1|252|\*(C`cd \e\*(C'\fR since the readline library has an undocumented |Be careful with \f(CW\*(C`cd \e\*(C'\fR since the readline library has an undocumented )         (rof_escape_sequence|91|hivexsh.1|261|\*(C`commit\*(C'\fR |call this command (or if the shell exits). You have to call \f(CW\*(C`commit\*(C'\fR )         (rof_escape_sequence|91|hivexsh.1|265|\*(C`newfile\*(C'\fR parameter is |Commit changes to the hive. If the optional \f(CW\*(C`newfile\*(C'\fR parameter is )         (rof_escape_sequence|91|hivexsh.1|269|\*(C`\-w\*(C'\fR flag, otherwise no writes are |Note that you have to specify the \f(CW\*(C`\-w\*(C'\fR flag, otherwise no writes are )         (rof_escape_sequence|91|hivexsh.1|274|\*(C`cd ..\*(C'\fR) after |directory is moved up one level (as if you did \f(CW\*(C`cd ..\*(C'\fR) after )         (rof_escape_sequence|91|hivexsh.1|283|\*(C`hivefile\*(C'\fR. The currently loaded hive, if |Load the binary hive named \f(CW\*(C`hivefile\*(C'\fR. The currently loaded hive, if )         (rof_escape_sequence|91|hivexsh.1|293|\*(C`key\*(C'\fR is given, |argument is given then all pairs are displayed. If \f(CW\*(C`key\*(C'\fR is given, )         (rof_escape_sequence|91|hivexsh.1|294|\*(C`@\*(C'\fR is given, then |then the value of the named key is displayed. If \f(CW\*(C`@\*(C'\fR is given, then )         (rof_escape_sequence|91|hivexsh.1|299|\*(C`nrvals\*(C'\fR is the number of values |the values in subsequent input. \f(CW\*(C`nrvals\*(C'\fR is the number of values )         (rof_escape_sequence|91|hivexsh.1|301|\*(C`setval 0\*(C'\fR just deletes any values at the current node. |deleted. So \f(CW\*(C`setval 0\*(C'\fR just deletes any values at the current node. )         (rof_escape_sequence|91|hivexsh.1|319|\*(C`@\*(C'\fR means |The first line of each pair is the key (the special key \f(CW\*(C`@\*(C'\fR means )         (rof_escape_sequence|91|hivexsh.1|323|\*(C`type:value\*(C'\fR with possible types summarized in the table below: |\&\f(CW\*(C`type:value\*(C'\fR with possible types summarized in the table below: )         (rof_escape_sequence|91|hivexsh.1|393|\*(C`rjones at redhat dot com\*(C'\fR) |Richard W.M. Jones (\f(CW\*(C`rjones at redhat dot com\*(C'\fR) )