Monitoring the Registry

[Cdma1X]

You cannot.

it is 100% possible and tested because i have a software which creates a key and secures it for example only but i don't know how it works.

[trancexx]

it is 100% possible and tested because i have a software which creates a key and secures it for example only but i don't know how it works.

You are right.

Maybe I wrote that premeditatedly, maybe it provoked someone to disprove me, maybe there will be some fruits of that, or maybe... (you know). We'll se

[Cdma1X]

You are right.

Maybe I wrote that premeditatedly, maybe it provoked someone to disprove me, maybe there will be some fruits of that, or maybe... (you know). We'll se

i searched the google

http://www.google.com/search?sourceid=chro...key+in+registry

[duckling78]

(Sorry for resurrecting an old thread again buuut...)

I was playing around with the "reg" command and found the following pretty useful.

The following copies hkcu\software to hkcu\_Backup. On my test machine it takes about 35 seconds to complete (much faster than my AutoIt3 based script I posted above which takes about 3.5 minutes).

reg copy hkcu\software hkcu\_Backup /s

The following compares hkcu\software to hkcu\_Backup. On my test machine this takes about 3 seconds to complete (much faster than my AutoIt3 based script I posted above).

reg compare hkcu\software hkcu\_Backup /s

The output of the reg compare can be piped to a text file or outputted as needed.

I wonder if there is some function library that would give similar performance as reg.exe? Maybe some WMI thing? Investigating further...

*** Edit ***

This only seems to work in Vista.

On XP, it says "Error: Access is denied."

Uhh, anyone know why the error happens on XP and not on Vista?

**********

Edited December 3, 2008 by duckling78

[duckling78]

Found a workaround for WinXP:

for /f "tokens=3 delims=\" %a in ('reg.exe query hkcu\software') do reg copy "hkcu\software\%a" "hkcu\_Backup\%a" /s /f

Then:

for /f "tokens=3 delims=\" %a in ('reg.exe query hkcu\software') do @reg compare "hkcu\software\%a" "hkcu\_Backup\%a" /s

This shows that something in the Microsoft registry key is causing the Access Denied error message from the previous post. Also this completes and maybe can be parsed using AutoIt (although I'll need to clean this up a bit).