Latest results from editreg ...

[Richard Sharpe]

Hi,

At SambaXP and on the way back I managed to get more work done on the 
editreg program.

It can now display a registry file in more detail, and can delete keys 
from the tree. It won't take long to get addition of keys and values done, 
and then the next big item is writing the registry tree out in a form that 
Windows can process ...

Here is an example of the output without listing ACLs on the keys:

[root at ns source]# ./bin/editreg -p ~rsharpe/profile/NTUSER.DAT | more
[$$$PROTO.HIV]
[$$$PROTO.HIV\AppEvents]
  Migrated Schemes = REG_SZ : 1
[$$$PROTO.HIV\AppEvents\EventLabels]
[$$$PROTO.HIV\AppEvents\EventLabels\.Default]
  <No Name> = REG_SZ : Default Beep
  DispFileName = REG_SZ : @mmsys.cpl,-5824
[$$$PROTO.HIV\AppEvents\EventLabels\ActivatingDocument]
  <No Name> = REG_SZ : Complete Navigation
[$$$PROTO.HIV\AppEvents\EventLabels\AppGPFault]
  <No Name> = REG_SZ : Program error
  DispFileName = REG_SZ : @mmsys.cpl,-5825
[$$$PROTO.HIV\AppEvents\EventLabels\CCSelect]
  <No Name> = REG_SZ : Select
[$$$PROTO.HIV\AppEvents\EventLabels\Close]
  <No Name> = REG_SZ : Close program
  DispFileName = REG_SZ : @mmsys.cpl,-5826
[$$$PROTO.HIV\AppEvents\EventLabels\CriticalBatteryAlarm]
  <No Name> = REG_SZ : Critical Battery Alarm
  DispFileName = REG_SZ : @mmsys.cpl,-5827
[$$$PROTO.HIV\AppEvents\EventLabels\DeviceConnect]
  <No Name> = REG_SZ : Device Connect

And here is some output showing the ACLs on each element:

[root at ns source]# ./bin/editreg -p -s ~rsharpe/profile/NTUSER.DAT | more
[$$$PROTO.HIV]
;;  SECURITY
;;   Owner: S-1-5-32-544
;;   Group: S-1-5-18
;;    DACL:
;;     ALLOW             F003F 
S-1-5-21-838943839-3216150120-3991299721-2002
;;     ALLOW             F003F S-1-5-18
;;     ALLOW             F003F S-1-5-32-544
;;     ALLOW             20019 S-1-5-12
;;     ALLOW OI,CI,IO 10000000 
S-1-5-21-838943839-3216150120-3991299721-2002
;;     ALLOW OI,CI,IO 10000000 S-1-5-18
;;     ALLOW OI,CI,IO 10000000 S-1-5-32-544
;;     ALLOW OI,CI,IO 80000000 S-1-5-12
[$$$PROTO.HIV\AppEvents]
;;  SECURITY
;;   Owner: S-1-5-32-544
;;   Group: S-1-5-18
;;    DACL:
;;     ALLOW             F003F 
S-1-5-21-838943839-3216150120-3991299721-2002
;;     ALLOW             F003F S-1-5-18
;;     ALLOW             F003F S-1-5-32-544
;;     ALLOW             20019 S-1-5-12
 
Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com