Recursive Registry Search Help

[heathy]

So I've search around and found the answer to my problem, sorta. I found this code from PsaltyDS. Now it does work but gives me too much info.

For example using that code if I put in the following values:

$SearchKey = "HKEY_CLASSES_ROOT\Installer\Features"

$SearchString = "SAVmAin"

I get:

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\EMailTools = SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\LiveUpdate = SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\QClient = SAVMain

...more not pasted.

But all I really want is HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638

The key is randomly generated by the SAV installer, so it's not the same on every machine, hence the need to search.

I've tried monkeying with the code but alas my AutoIT skills are sub par.

Can anyone help me out?

TIA

[PsaltyDS]

So I've search around and found the answer to my problem, sorta. I found this code from PsaltyDS. Now it does work but gives me too much info.

For example using that code if I put in the following values:

$SearchKey = "HKEY_CLASSES_ROOT\Installer\Features"

$SearchString = "SAVmAin"

I get:

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\EMailTools = SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\LiveUpdate = SAVMain

HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638\QClient = SAVMain

...more not pasted.

But all I really want is HKEY_CLASSES_ROOT\Installer\Features\89FCFC336D8F94544B96F6245976D638

The key is randomly generated by the SAV installer, so it's not the same on every machine, hence the need to search.

I've tried monkeying with the code but alas my AutoIT skills are sub par.

Can anyone help me out?

TIA

Glad you found that function useful!

I haven't learned RegExp yet (which is the 'right' way to do this), but since you just want the first one it would be easy to get with string manipulation:

expandcollapse popup

$SearchKey = "HKEY_CLASSES_ROOT\Installer\Features"
$SearchString = "SAVmAin"
$Results = _RegSearch($SearchKey, $SearchString)
$ClassGUID = StringTrimLeft($Results, StringLen($SearchKey & "\"))
$ClassGUID = StringLeft($ClassGUID, StringInStr($ClassGUID, "\") - 1)
MsgBox(64, "Results", "ClassGUID for " & $SearchString & " is: " & $ClassGUID)

;*****************************************************
; Function _RegSearch($startkey, $searchval)
;   Performs a recursive search of the registry
;     Starting at $sStartKey, looking for $sSearchVal
; Returns a string containing a list of key names and values.
;   If a key name matches, it is listed as a reg path with trailing backslash:
;     i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
;   If a value name matches, it is listed as a reg path without trailing backslash:
;     i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir
;   If the data matches, the format is path = data:
;       i.e. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WallPaperDir = %SystemRoot%\Web\Wallpaper
;*****************************************************
Func _RegSearch($startkey, $searchval)
    Local $v, $val, $k, $key, $found = ""
   
    ; This loop checks values
    $v = 1
    While 1
        $val = RegEnumVal($startkey, $v)
        If @error = 0 Then
            ; Valid value - test it's name
            If StringInStr($val, $searchval) Then
                $found = $found & $startkey & "\" & $val & @LF
            EndIf
            ; test it's data
            $readval = RegRead($startkey, $val)
            If StringInStr($readval, $searchval) Then
                $found = $found & $startkey & "\" & $val & " = " & $readval & @LF
            EndIf
            $v += 1
        Else
            ; No more values here
            ExitLoop
        EndIf
    WEnd
   
    ; This loop checks subkeys
    $k = 1
    While 1
        $key = RegEnumKey($startkey, $k)
        If @error = 0 Then
            ; Valid key - test it's name
            If StringInStr($key, $searchval) Then
                $found = $found & $startkey & "\" & $key & "\" & @LF
            EndIf
            ; Now search it
            $found = $found & _RegSearch($startkey & "\" & $key, $searchval)
        Else
            ; No more keys here
            ExitLoop
        EndIf
        $k += 1
    WEnd
   
    ; Return results
    Return $found
EndFunc   ;==>_RegSearch

[SmOke_N]

That function looks like it could end up recursing itself

The issue is it's returning multiple instances... if the end user wants the actual return the way they want... I might suggest something like:

Func _RegGetWTFEverYouWantToNameThis($sKey, $sValue, $vDelim = '\\')
    Local $sString = @LF & _RegSearch($sKey, $sValue) & @CRLF
    $sKey = StringReplace($sKey, '\', '\\')
    Local $aSRE = StringRegExp($sString, '(?s)(?i)\n(' & $sKey & '.*?)' & $vDelim & $sValue, 1)
    If IsArray($aSRE) Then Return $aSRE[0]
    Return SetError(1, 0, '')
EndFunc

[PsaltyDS]

That function looks like it could end up recursing itself

The issue is it's returning multiple instances... if the end user wants the actual return the way they want... I might suggest something like:

Func _RegGetWTFEverYouWantToNameThis($sKey, $sValue, $vDelim = '\\')
    Local $sString = @LF & _RegSearch($sKey, $sValue) & @CRLF
    $sKey = StringReplace($sKey, '\', '\\')
    Local $aSRE = StringRegExp($sString, '(?s)(?i)\n(' & $sKey & '.*?)' & $vDelim & $sValue, 1)
    If IsArray($aSRE) Then Return $aSRE[0]
    Return SetError(1, 0, '')
EndFunc

That function is intended to recurse itself. It was written to return ALL matches. That was one of my first recursive search AutoIt functions... be nice!

[heathy]

Ok it looks like I can get what I need out of your modification thanks

Using this as the example:

$SearchKey = "HKEY_CLASSES_ROOT\Installer\Features"

$SearchString = "SAVMain"

I've changed the msgbox to RegDelete($SearchKey & "\" & $ClassGUID)

That also works, except when I run it again. If I run it again then it deletes everything under HKEY_CLASSES_ROOT\Installer\Features that's not good.

What's the best way to have it only delete what it's supposed to?

Your original script that finds individual keys doesn't have this problem when I use RegDelete.

TIA

[PsaltyDS]

Ok it looks like I can get what I need out of your modification thanks

Using this as the example:

$SearchKey = "HKEY_CLASSES_ROOT\Installer\Features"

$SearchString = "SAVMain"

I've changed the msgbox to RegDelete($SearchKey & "\" & $ClassGUID)

That also works, except when I run it again. If I run it again then it deletes everything under HKEY_CLASSES_ROOT\Installer\Features that's not good.

What's the best way to have it only delete what it's supposed to?

Your original script that finds individual keys doesn't have this problem when I use RegDelete.

TIA

The search function doesn't set @error when nothing is found, it just returns an empty string. So if you don't test for that, by something like 'If $Results = "" Then Exit', and you go on with the rest, then $ClassGUID is an empty string too, and so your delete becomes 'RegDelete($SearchKy & "\" & "")'. Just add a test condition for empty results returned.