Registry.Registry
index
/home/willi/Git/python-registry/Registry/Registry.py

#    This file is part of python-registry.
#
#   Copyright 2011 Will Ballenthin <willi.ballenthin@mandiant.com>
#                    while at Mandiant <http://www.mandiant.com>
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.

 
Modules
       
Registry.RegistryParse
sys

 
Classes
       
Registry.RegistryParse.RegistryStructureDoesNotExist(Registry.RegistryParse.RegistryException)
RegistryKeyHasNoParentException
RegistryKeyNotFoundException
RegistryValueNotFoundException
__builtin__.object
Registry
RegistryKey
RegistryValue

 
class Registry(__builtin__.object)
    A class for parsing and reading from a Windows Registry file.
 
  Methods defined here:
__init__(self, filelikeobject)
Constructor.
Arguments:
- `filelikeobject`: A file-like object with a .read() method.  
      If a Python string is passed, it is interpreted as a filename, 
      and the corresponding file is opened.
open(self, path)
Return a RegistryKey by full path.
Subkeys are separated by the backslash character (''). A trailing backslash may or may
not be present.
The hive name should not be included.
root(self)
Return the first RegistryKey in the hive.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class RegistryKey(__builtin__.object)
    A high level structure for use in traversing the Windows Registry.
RegistryKey is a node in a tree-like structure.
RegistryKey may have a set of values associated with it, as well as a last modified timestamp.
 
  Methods defined here:
__getitem__(self, key)
__init__(self, nkrecord)
Arguments:
- `NKRecord`:
__str__(self)
find_key(self, path)
Perform a search for a RegistryKey with a specific path.
name(self)
Get the name of the key as a string.
 
For example, "Windows" if the key path were /{hive name}/SOFTWARE/Microsoft/Windows
See RegistryKey.path() to get the complete key name.
parent(self)
Get the parent RegistryKey of this key, or raise
RegistryKeyHasNoParentException if it does not exist (for example,
the root key has no parent).
path(self)
Get the full path of the RegistryKey as a string.
For example, "/{hive name}/SOFTWARE/Microsoft/Windows"
subkey(self, name)
Return the subkey with a given name as a RegistryKey.
Raises RegistryKeyNotFoundException if the subkey with the given name does not exist.
subkeys(self)
Return a list of all subkeys. Each element in the list is a RegistryKey.
If the key has no subkeys, the empty list is returned.
timestamp(self)
Get the last modified timestamp as a Python datetime.
value(self, name)
Return the value with the given name as a RegistryValue.
Raises RegistryValueNotFoundExceptiono if the value with the given name does not exist.
values(self)
Return a list containing the values associated with this RegistryKey.
Each element of the list will be a RegistryValue.
If there are no values associated with this RegistryKey, then the
empty list is returned.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class RegistryKeyHasNoParentException(Registry.RegistryParse.RegistryStructureDoesNotExist)
    
Method resolution order:
RegistryKeyHasNoParentException
Registry.RegistryParse.RegistryStructureDoesNotExist
Registry.RegistryParse.RegistryException
exceptions.Exception
exceptions.BaseException
__builtin__.object

Methods defined here:
__init__(self, value)
Constructor.
Arguments:
- `value`: A string description.
__str__(self)

Data descriptors inherited from Registry.RegistryParse.RegistryException:
__weakref__
list of weak references to the object (if defined)

Data and other attributes inherited from exceptions.Exception:
__new__ = <built-in method __new__ of type object>
T.__new__(S, ...) -> a new object with type S, a subtype of T

Methods inherited from exceptions.BaseException:
__delattr__(...)
x.__delattr__('name') <==> del x.name
__getattribute__(...)
x.__getattribute__('name') <==> x.name
__getitem__(...)
x.__getitem__(y) <==> x[y]
__getslice__(...)
x.__getslice__(i, j) <==> x[i:j]
 
Use of negative indices is not supported.
__reduce__(...)
__repr__(...)
x.__repr__() <==> repr(x)
__setattr__(...)
x.__setattr__('name', value) <==> x.name = value
__setstate__(...)
__unicode__(...)

Data descriptors inherited from exceptions.BaseException:
__dict__
args
message

 
class RegistryKeyNotFoundException(Registry.RegistryParse.RegistryStructureDoesNotExist)
    
Method resolution order:
RegistryKeyNotFoundException
Registry.RegistryParse.RegistryStructureDoesNotExist
Registry.RegistryParse.RegistryException
exceptions.Exception
exceptions.BaseException
__builtin__.object

Methods defined here:
__init__(self, value)
Arguments:
- `value`:
__str__(self)

Data descriptors inherited from Registry.RegistryParse.RegistryException:
__weakref__
list of weak references to the object (if defined)

Data and other attributes inherited from exceptions.Exception:
__new__ = <built-in method __new__ of type object>
T.__new__(S, ...) -> a new object with type S, a subtype of T

Methods inherited from exceptions.BaseException:
__delattr__(...)
x.__delattr__('name') <==> del x.name
__getattribute__(...)
x.__getattribute__('name') <==> x.name
__getitem__(...)
x.__getitem__(y) <==> x[y]
__getslice__(...)
x.__getslice__(i, j) <==> x[i:j]
 
Use of negative indices is not supported.
__reduce__(...)
__repr__(...)
x.__repr__() <==> repr(x)
__setattr__(...)
x.__setattr__('name', value) <==> x.name = value
__setstate__(...)
__unicode__(...)

Data descriptors inherited from exceptions.BaseException:
__dict__
args
message

 
class RegistryValue(__builtin__.object)
    This is a high level structure for working with the Windows Registry.
It represents the 3-tuple of (name, type, value) associated with a registry value.
 
  Methods defined here:
__init__(self, vkrecord)
name(self)
Get the name of the value as a string.
The name of the default value is returned as "(default)".
value(self)
value_type(self)
Get the type of the value as an integer constant.
 
One of: 
 - RegSZ = 0x0001
 - RegExpandSZ = 0x0002
 - RegBin = 0x0003
 - RegDWord = 0x0004
 - RegMultiSZ = 0x0007
 - RegQWord = 0x000B
 - RegNone = 0x0000
 - RegBigEndian = 0x0005
 - RegLink = 0x0006
 - RegResourceList = 0x0008
 - RegFullResourceDescriptor = 0x0009
 - RegResourceRequirementsList = 0x000A
value_type_str(self)
Get the type of the value as a string.
 
One of: 
 - RegSZ
 - RegExpandSZ
 - RegBin
 - RegDWord
 - RegMultiSZ
 - RegQWord
 - RegNone
 - RegBigEndian
 - RegLink
 - RegResourceList
 - RegFullResourceDescriptor
 - RegResourceRequirementsList

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

 
class RegistryValueNotFoundException(Registry.RegistryParse.RegistryStructureDoesNotExist)
    
Method resolution order:
RegistryValueNotFoundException
Registry.RegistryParse.RegistryStructureDoesNotExist
Registry.RegistryParse.RegistryException
exceptions.Exception
exceptions.BaseException
__builtin__.object

Methods defined here:
__init__(self, value)
Arguments:
- `value`:
__str__(self)

Data descriptors inherited from Registry.RegistryParse.RegistryException:
__weakref__
list of weak references to the object (if defined)

Data and other attributes inherited from exceptions.Exception:
__new__ = <built-in method __new__ of type object>
T.__new__(S, ...) -> a new object with type S, a subtype of T

Methods inherited from exceptions.BaseException:
__delattr__(...)
x.__delattr__('name') <==> del x.name
__getattribute__(...)
x.__getattribute__('name') <==> x.name
__getitem__(...)
x.__getitem__(y) <==> x[y]
__getslice__(...)
x.__getslice__(i, j) <==> x[i:j]
 
Use of negative indices is not supported.
__reduce__(...)
__repr__(...)
x.__repr__() <==> repr(x)
__setattr__(...)
x.__setattr__('name', value) <==> x.name = value
__setstate__(...)
__unicode__(...)

Data descriptors inherited from exceptions.BaseException:
__dict__
args
message

 
Functions
       
print_all(key)

 
Data
        RegBigEndian = 5
RegBin = 3
RegDWord = 4
RegExpandSZ = 2
RegFullResourceDescriptor = 9
RegLink = 6
RegMultiSZ = 7
RegNone = 0
RegQWord = 11
RegResourceList = 8
RegResourceRequirementsList = 10
RegSZ = 1