o j@sddlmZddlmZddlZddlZddlZddlmZmZddl m Z ddl m Z ddl m Z dd Zd d Zd d ZddZdddZddZddZedkrXedSdS))division)print_functionN) unhexlifyhexlify)logger)version) winregistrycCs|d}gd}d}|D]}|t|||ddd}q gd}d}tt|D] }||||7}q+tt|dS)NzControlSet001\Control\Lsa\)JDSkew1GBGDatazutf-16le)r r  )rgetClassdecoderangelenprintr)reg baseClasskeystmpKeykey transformssyskeyir*/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/registry-read.pybootKey"s&r,cCsVt|}t|}||}|durdStd|td|ddt|ddS)N[%s]zValue for Class %s:  endz )ntpathdirnamebasenamerr!rhexdump)r" classNameregKeyregClassvaluer*r*r+r2s    rcCs^t|}t|}||}td||durdStd|dd||d|ddS)N[%s] zValue for %s: r.r/rr)r1r2r3getValuer! printValue)r"keyValuer6regValuer8r*r*r+r:As    r:cCs||}|dur dStd|||}t||D]7}td|dd|||d}|dtjkrItd||d|dtdq||d|dqdS) Nr9z %-30s: r.r/zutf-8rr r)findKeyr! enumValuesr:rr REG_BINARYr;)r" searchKeyr&valuesr8datar*r*r+r?Os    r? cCs||}|dur dS||}|D]+}td||f|dur=|dkr0t|d|||dqt|d||f||dqdS)Nz%s%sT\z\%srDz%s\%s)r>enumKeyr!)r"rA isRecursiveindent parentKeyr$r&r*r*r+rFes  rFcCs ||S)N)walk)r"keyNamer*r*r+rJus rJc Csttjtjddd}|jdddd|jddd d|jd d d d|jd dd}|jddd}|jdd ddd|jdddddd|jddd}|jdd ddd|jddd}|jdd ddd|jd d!d}|jdd dd"d|jd#d$d}|jdd dd%dtt j d&kr| t d&| }t|j|jt|j}|jd'krtd(|jt||j|jn7|jd)krt||jn)|jd*krt||jn|jd+krt||jn |jd,krt||j|dS)-NTzReads data from registry hives.)add_help descriptionz-debug store_truezTurn DEBUG output ON)actionhelpz-tsz&Adds timestamp to every logging outputhivestorezregistry hive to openactionsrO)rPdestenum_keyz9enumerates the subkeys of the specified open registry key)rPz-namez registry key)rOrequiredrPz -recursive recursiveFz recursive search (default False))rTrOrVrP enum_valuesz9enumerates the values for the specified open registry key get_valuez3retrieves the data for the specified registry valuezregistry value get_classz3retrieves the data for the specified registry classzregistry class namerJz*walks the registry from the name node downz.registry class name to start walking down fromrENUM_KEYr- ENUM_VALUES GET_VALUE GET_CLASSWALK)r!rBANNERargparseArgumentParser add_argumentadd_subparsers add_parserr sysargv print_helpexit parse_argsrinittsdebugrget_registry_parserrQrOuppernamerFrWr?r:rrJclose) parser subparsersenumkey_parserenumvalues_parsergetvalue_parsergetclass_parser walk_parseroptionsr"r*r*r+mainysF     rz__main__)rD) __future__rrrfrar1binasciirrimpacket.examplesrimpacketrrr,rr:r?rFrJrz__name__r*r*r*r+s&      6