python-registry was originally written by Willi Ballenthin, a forensic analyst who wanted
to access the contents of the Windows Registry from his Linux laptop.
python-registry currently provides read-only access to Windows Registry
files, such as
SOFTWARE. The interface is
two-fold: a high-level interface suitable for most tasks, and a low
level set of parsing objects and methods which may be used for advanced
study of the Windows Registry. python-registry is written in pure
Python, making it portable across all major platforms.
python-registry can be downloaded at GitHub here.
Most users will find the
Registry.Registry module most appropriate.
The module exposes three classes: the
Registry organizes parsing and access to the
Windows Registry file. The
RegistryKey is a convenient interface into
the tree-like structure of the Windows Registry. A
RegistryKeys, and may also have values associated with
RegistryValue can be thought of as the tuple (name, datatype,
value) associated with a
RegistryKey. python-registry supports all
major datatypes, such as
Open a Windows Registry file
Its this easy:
1 2 3 4
Print all keys in a Registry
1 2 3 4 5 6 7
Find a key and print all string values
1 2 3 4 5 6 7 8 9 10
Advanced users who wish to study the structure of the Windows Registry
may find the
Registry.RegistryParse module useful. This module
implements all known structures of the Windows Registry.
Static API documentation for python-registry can be found here: Documentation.
python-registry was developed using Python 2.6.5 on Ubuntu Linux. More
importantly, the package was tested against a small set of Windows XP
SP3 Registry files acquired from one of the author’s virtual machines.
testing/RegTester.py will parse the .reg files exported by
Microsoft Regedit and compare the values parsed by python-registry. This
tool can be used to identify regressions and deficiencies in the
development of python-registry.
Nearly all structure definitions used in python-registry came from one of two sources:
Copies of these resources are included in the
of the python-registry source.
The source directory for python-registry contains a
that contains small programs that use python-registry. For example,
regview.py is a read-only clone of Microsoft Window’s Regedit,
implemented in a few hundred lines.
python-registry is released under the Apache v2.0 license.