local and remote machine registry export

  • Thread starter Thread starter auldh
  • Start date Start date
A

auldh

i current have a way to read both local and remote machines registry keys and
create a textual view (.txt output).

i now looking for ways to do export of local and remote mahcine registry
keys into ".reg" file format via C#.

is this do able?
what do i need to research to do this?

or is where i need to windows WinApi?
 
Peter,
thanks for your response.
yes i have C# code to create a textual file of the registry key hive i want.
but i read the 2 kbs and i don't see how to use C# to create the ".reg" file
export.
they talk about using regedit. i can not export remote machine registry keys
this way.

i need to create an export file in ".reg" format for both local and remote
servers (machines).
 
will the file i create be able to be used by regedit to import on a machine?
i light is still not coming on.
 
i think i can build the string and dword registry key to mimic the regedit
export file. but i'm seeing a problem constructing the "REG_MULTI_SZ" output
so that it mimics the regedit structure.

my code does a good job of getting the string but i'm not understanding how
to keep the value as binary.
 
Peter you are smarter person than i.
i understand what i read. but using the C# registry class i don't see how to
get the "REG_MULTI_SZ".

i can get a string output but i can not build the output as created by
regedit
"WrapperComponentList"=hex(7):4d,00,53,00,44,00,45,00,00,00,53,00,45,00,52,00,\
56,00,45,00,52,00,5f,00,4d,00,52,00,53,00,5f,00,4c,00,4f,00,43,00,41,00,4c,\
00,00,00,4c,00,41,00,4e,00,47,00,55,00,41,00,47,00,45,00,5f,00,45,00,4e,00,\
47,00,4c,00,49,00,53,00,48,00,55,00,53,00,00,00,43,00,4f,00,4d,00,4d,00,55,\
00,4e,00,49,00,43,00,41,00,54,00,49,00,4f,00,4e,00,53,00,5f,00,43,00,4c,00,\
49,00,45,00,4e,00,54,00,00,00,41,00,50,00,50,00,47,00,45,00,4e,00,00,00,4d,\
00,4d,00,43,00,5f,00,53,00,4e,00,41,00,50,00,49,00,4e,00,00,00,54,00,54,00,\
53,00,5f,00,45,00,4e,00,47,00,49,00,4e,00,45,00,00,00,00,00

i need to be able to create registry export file for both local and remote
machine/server that another group can restore via regedit to work in a lab.
the output file needs to mimic the registry export.

however creating a program to run regedit command line will only work on the
local machine. my task is to export the registry for both the master and
slave server so i can provide the data to someone else.

i can get to the string, dword but the muti_sz string is where i'm failing.
they build a string output.
 
the output i can create for a "multi_sz" is something like this:
Number of records in WrapperComponentList = 4
WrapperComponentList = (REG_MULTI_SZ) DRIVER_US
WrapperComponentList = (REG_MULTI_SZ) MSDE
WrapperComponentList = (REG_MULTI_SZ) SERVER_MRS_LOCAL
WrapperComponentList = (REG_MULTI_SZ) LANGUAGE_ENGLISHUS

my code:
else if (t == System.Type.GetType("System.String[]"))
{
String[] sval = (String[])regvalue;
sw.WriteLine(String.Format("Number of records in {0} =
{1}", valueName, sval.Length.ToString()));
for (int i = 0; i < sval.Length; i++)
{
sw.WriteLine("\t\t{0} = (REG_MULTI_SZ) {1}",
valueName, sval);
}
}
else
{
sw.WriteLine(String.Format("\t\tValue Name: {0}; Data:
{1} ; Type: {2}", valueName, regvalue.ToString(), t));
}

creates the output to be strings as seen above.
and according to "regedit" it can not import the structure i have.

the output file needs to have the following format:
"WrapperComponentList"=hex(7):44,00,52,00,49,00,56,00,45,00,52,00,5f,00,55,00,\
53,00,00,00,4d,00,53,00,44,00,45,00,00,00,53,00,45,00,52,00,56,00,45,00,52,\
00,5f,00,4d,00,52,00,53,00,5f,00,4c,00,4f,00,43,00,41,00,4c,00,00,00,4c,00,\
41,00,4e,00,47,00,55,00,41,00,47,00,45,00,5f,00,45,00,4e,00,47,00,4c,00,49,\
00,53,00,48,00,55,00,53,00,00,00,00,00

i must be over thinking this cause i'm not having success stepping through
the registry value to create the ascii string above.
 
Peter,
once again thanks.
i will do the research and work on this. this is great tips.

Peter Duniho said:
the output i can create for a "multi_sz" is something like this: [snip]
Click to expand...

Now we're getting somewhere! That example was precisely the sort of
information needed to elaborate on your question.
[...]
creates the output to be strings as seen above.
and according to "regedit" it can not import the structure i have.
Click to expand...

Yes, that's true. As the docs say, and as you're aware, there's a
specific format required and that format is different from the one you're
using.

You need to do a couple of things. Ironically, using the managed
RegistryKey class makes things harder in one respect: the data returned is
not actually exactly how the data appears in the registry, so you need to
convert _back_ to the correct format so that you can then write it to the
text file. Were you using the unmanaged API (e.g. RegQueryValueEx), you'd
just get the appropriate bytes directly (assuming you defined "UNICODE",
which IMHO any modern application should :) ).

Anyway, so the first thing you need to do is generate the necessary byte
array. You can use the Unicode instance of the Encoding class to convert
each string to a string of bytes. The REG_MULTI_SZ format is, as you can
probably tell by looking at the example you posted, a single byte array
containing null-terminated Unicode strings, with one more null-terminator
after the last null-terminated string (basically, it ends in a zero-length
string :) ).

So, you need to enumerate all your strings, convert them to Unicode bytes,
and fill a single byte array with the result. There are lots of ways to
do this, but the simplest is probably just to create a MemoryStream, write
the individual string byte arrays you get (including null-termination) to
the MemoryStream, and then get the bytes out from the MemoryStream at the
end. Don't forget that last zero-length string at the end (the extra
null-terminator).

Once you have this array of bytes, you need to write to the text file,
using hexadecimal formatting. The "X" formatting code can be used for
this, along with normal text output (e.g. StreamWriter.WriteLine(), which
you already seem to be using). Make sure you specify a 2-character field
width for each byte, and of course separate them with commas, exactly as
in your example. I don't actually know if the line-continuations are
required or if you can simply emit one long line. But you might want to
include the line-continuations even if they're not mandatory, since it
makes the file easier to read (granted, not many people are going to be
reading the byte values directly, but still... :) ).

Hope that helps. :)

Pete
Click to expand...
 
just to finish this thread i thought i add what i have found.

when i created my registry export file i used StreamWriter without any
specific codepage encoding.

not mention in the MSDN links is that the output "reg" file should be
"Encoding.Unicode" specifiec.

now when i create the output file with StreamWriter and "Encoding.Unicode" i
can get a perfect replication of the regedit export.

thanks for all your help.
 
Hello, can you tell me how to export the xp registry with streamwriter in c# ?



auld wrote:

just to finish this thread i thought i add what i have found.
10-Jun-08

just to finish this thread i thought i add what i have found

when i created my registry export file i used StreamWriter without an
specific codepage encoding

not mention in the MSDN links is that

Previous Posts In This Thread:

On Freitag, 30. Mai 2008 16:15
auld wrote:

local and remote machine registry export
i current have a way to read both local and remote machines registry keys an
create a textual view (.txt output)

i now looking for ways to do export of local and remote mahcine registr
keys into "

On Freitag, 30. Mai 2008 16:35
Peter Duniho wrote:

Re: local and remote machine registry export
In C#

If you already have code that produces text output of the registry, you ar
most of the way there. The .reg file format is extremely simple. Yo
just need to specify specific key paths in s

On Freitag, 30. Mai 2008 18:31
auld wrote:

Peter,thanks for your response.
Peter
thanks for your response
yes i have C# code to create a textual file of the registry key hive i want
but i read the 2 kbs and i do not see how to use C# to create the ".reg" fil
export
they

On Freitag, 30. Mai 2008 19:50
Peter Duniho wrote:

Re: local and remote machine registry export
The first article I provided documents the .reg file format. I am no
aware of any support in .NET to write the format automatically (though i
might yet exist). But the format is so simple that if

On Samstag, 31. Mai 2008 00:21
auld wrote:

will the file i create be able to be used by regedit to import on a machine?
will the file i create be able to be used by regedit to import on a machine
i light is still not coming on

:

On Samstag, 31. Mai 2008 00:26
auld wrote:

i think i can build the string and dword registry key to mimic the regedit
i think i can build the string and dword registry key to mimic the regedi
export file. but i'm seeing a problem constructing the "REG_MULTI_SZ" outpu
so that it mimics the regedit structure

my cod

On Samstag, 31. Mai 2008 03:11
Peter Duniho wrote:

Re: local and remote machine registry export
Yes. The .reg file format is just a text file with a particular forma
for the text contained within

Again, I direct you to the Microsoft KB article I mentioned earlier, tha
describes the format.

Peter you are smarter person than i.i understand what i read.
Peter you are smarter person than i
i understand what i read. but using the C# registry class i do not see how t
get the "REG_MULTI_SZ"

i can get a string output but i can not build the output as

Re: local and remote machine registry export
Maybe. Maybe not. Too early to tell. :



,00,52,00,
,00,4c,
,4e,00,
,00,55,
,4c,00,
,00,4d,
,54,00,

Well, what exactly is it that you are having difficulty with

I mean, I can see a nu

Re: local and remote machine registry export
the output i can create for a "multi_sz" is something like this
Number of records in WrapperComponentList =
WrapperComponentList = (REG_MULTI_SZ) DRIVER_U
WrapperComponentList = (REG_MULTI_SZ) MSD

Re: local and remote machine registry export
Now we are getting somewhere! That example was precisely the sort o
information needed to elaborate on your question

Yes, that is true. As the docs say, and as you are aware, there is
specific

On Dienstag, 3. Juni 2008 09:33
auld wrote:

Peter,once again thanks.i will do the research and work on this.
Peter
once again thanks
i will do the research and work on this. this is great tips

:

On Dienstag, 10. Juni 2008 09:39
auld wrote:

just to finish this thread i thought i add what i have found.
just to finish this thread i thought i add what i have found

when i created my registry export file i used StreamWriter without any
specific codepage encoding.

not mention in the MSDN links is that

EggHeadCafe - Software Developer Portal of Choice
VB.NET-XML based Dynamic Menu Component using Recursion Technique
http://www.eggheadcafe.com/tutorial...8a33-d71170550fcb/vbnetxml-based-dynamic.aspx
 
Hello, can you tell me how to export the xp registry with the streamwriter in c#?



auld wrote:

just to finish this thread i thought i add what i have found.
10-Jun-08

just to finish this thread i thought i add what i have found.

when i created my registry export file i used StreamWriter without any
specific codepage encoding.

not mention in the MSDN links is that

Previous Posts In This Thread:

On Freitag, 30. Mai 2008 16:15
auld wrote:

local and remote machine registry export
i current have a way to read both local and remote machines registry keys and
create a textual view (.txt output).

i now looking for ways to do export of local and remote mahcine registry
keys into "

On Freitag, 30. Mai 2008 16:35
Peter Duniho wrote:

Re: local and remote machine registry export
In C#?


If you already have code that produces text output of the registry, you are
most of the way there. The .reg file format is extremely simple. You
just need to specify specific key paths in s

On Freitag, 30. Mai 2008 18:31
auld wrote:

Peter,thanks for your response.
Peter,
thanks for your response.
yes i have C# code to create a textual file of the registry key hive i want.
but i read the 2 kbs and i do not see how to use C# to create the ".reg" file
export.
they

On Freitag, 30. Mai 2008 19:50
Peter Duniho wrote:

Re: local and remote machine registry export
The first article I provided documents the .reg file format. I am not
aware of any support in .NET to write the format automatically (though it
might yet exist). But the format is so simple that if

On Samstag, 31. Mai 2008 00:21
auld wrote:

will the file i create be able to be used by regedit to import on a machine?
will the file i create be able to be used by regedit to import on a machine?
i light is still not coming on.


:

On Samstag, 31. Mai 2008 00:26
auld wrote:

i think i can build the string and dword registry key to mimic the regedit
i think i can build the string and dword registry key to mimic the regedit
export file. but i'm seeing a problem constructing the "REG_MULTI_SZ" output
so that it mimics the regedit structure.

my cod

On Samstag, 31. Mai 2008 03:11
Peter Duniho wrote:

Re: local and remote machine registry export
Yes. The .reg file format is just a text file with a particular format
for the text contained within.

Again, I direct you to the Microsoft KB article I mentioned earlier, that
describes the format.

Peter you are smarter person than i.i understand what i read.
Peter you are smarter person than i.
i understand what i read. but using the C# registry class i do not see how to
get the "REG_MULTI_SZ".

i can get a string output but i can not build the output as

Re: local and remote machine registry export
Maybe. Maybe not. Too early to tell. :)

=


,00,52,00,\
,00,4c,\
,4e,00,\
,00,55,\
,4c,00,\
,00,4d,\
,54,00,\

Well, what exactly is it that you are having difficulty with?

I mean, I can see a nu

Re: local and remote machine registry export
the output i can create for a "multi_sz" is something like this:
Number of records in WrapperComponentList = 4
WrapperComponentList = (REG_MULTI_SZ) DRIVER_US
WrapperComponentList = (REG_MULTI_SZ) MSD

Re: local and remote machine registry export
Now we are getting somewhere! That example was precisely the sort of
information needed to elaborate on your question.


Yes, that is true. As the docs say, and as you are aware, there is a
specific

On Dienstag, 3. Juni 2008 09:33
auld wrote:

Peter,once again thanks.i will do the research and work on this.
Peter,
once again thanks.
i will do the research and work on this. this is great tips.

:

On Dienstag, 10. Juni 2008 09:39
auld wrote:

just to finish this thread i thought i add what i have found.
just to finish this thread i thought i add what i have found.

when i created my registry export file i used StreamWriter without any
specific codepage encoding.

not mention in the MSDN links is that

On Freitag, 23. Oktober 2009 06:57
Tim Taler wrote:

export registry
Hello, can you tell me how to export the xp registry with streamwriter in c# ?

EggHeadCafe - Software Developer Portal of Choice
Pure Javascript Martin Browser Fractals
http://www.eggheadcafe.com/tutorial...4-87a1e53898a5/pure-javascript-martin-br.aspx
 
Tim Taler wrote in
Hello, can you tell me how to export the xp registry with the
streamwriter in c#?
Click to expand...

What are you trying to do:

1. Read the file?
2. Walk the values and create a file to recreate the registry?

If read the file, I would aim at a binary reader, but realize that the
registry is constantly accessed, so this is likely to end up with
errors.

If walk the values, then you need full registry access and you start
with the top key values:

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG

and then walk through each subkey.

Either of these is likely to be fraught with danger, so the better
question is "why are you trying to do this?" The answer to that question
will reveal the true problem domain rather than the currently attempted
solution.

Peace and Grace,



--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

Twitter: @gbworld
Blog: http://gregorybeamer.spaces.live.com

*******************************************
| Think outside the box! |
*******************************************
 
Tim said:
Hello, can you tell me how to export the xp registry with the streamwriter in c#?
Click to expand...
P/Invoke to RegSaveKey() or RegSaveKeyEx() and forget about the stream writer.
 
2. Walk the values and create a file to recreate the registry?
Click to expand...

Yes, backup of the registry before modify it, was the idea! But it doesn't
work I don't know why I tried many different thing. The regsavekey() did only
write a 0kb file.


UIntPtr HKEY_CURRENT_USER = new UIntPtr(0x80000001u);
UIntPtr HKEY_LOCAL_MACHINE = new UIntPtr(0x80000002u);

// IntPtr HKEY_CURRENT_USER = new IntPtr(&H80000001);
// IntPtr HKEY_CURRENT_USER = new IntPtr(-2147483647);
// int HKEY_CURRENT_USER = &H80000001;

UIntPtr HKKU;
int ret = 0;
int rett = 0;
//SECURITY_ATTRIBUTES nigs = new SECURITY_ATTRIBUTES();

rett = RegOpenKeyEx(HKEY_CURRENT_USER, "null", 0, KEY_READ, out HKKU);

//rett = RegOpenKeyEx(HKEY_CURRENT_USER, "null", 0, 0x20019,out HKKU);

// rett = RegOpenKeyA(HKEY_CURRENT_USER, "null", ref HKKU);

ret = RegSaveKey(HKKU, "E:\\test", IntPtr.Zero);

//RegSaveKey(hkey, "c:\\a.reg", NULL);

---------------------------------------------------------------------------------------------
//[DllImport("advapi32.dll", EntryPoint = "RegSaveKey")]
//public static extern int RegSaveKeyA(int hKey, string lpFile,
// ref SECURITY_ATTRIBUTES lpSecurityAttributes);
[DllImport("advapi32.dll")]
private static extern int RegCloseKey(IntPtr hKey);


[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
public static extern int RegOpenKeyEx(
UIntPtr hKey,
string subKey,
int ulOptions,
int samDesired,
out UIntPtr hkResult);

[DllImport("advapi32")]
static extern int RegSaveKey(IntPtr hKey, string fileout, IntPtr
secdesc);

[DllImport("advapi32.dll", SetLastError = true)]
static extern int RegOpenKeyA(int hKey, string lpSubKey, ref int
phkResult);

[StructLayout(LayoutKind.Sequential)]
public struct SECURITY_ATTRIBUTES
{
public int nLength;
public IntPtr lpSecurityDescriptor;
public int bInheritHandle;
}

//[StructLayout(LayoutKind.Sequential)]
//public class SECURITY_ATTRIBUTES
//{
// public int nLength;
// public unsafe byte* lpSecurityDescriptor;
// public int bInheritHandle;
//}

//public const int TOKEN_ADJUST_PRIVILEGES = 0x00000020;
//public const int TOKEN_QUERY = 0x00000008;
//public const int SE_PRIVILEGE_ENABLED = 0x00000002;
//public const string SE_RESTORE_NAME = "SeRestorePrivilege";
//public const string SE_BACKUP_NAME = "SeBackupPrivilege";
//public const uint HKEY_USERS = 0x80000003;
//public string shortname;
//bool unloaded = false;
 
Yes, backup of the registry before modify it, was the idea! But it doesn't
work I don't know why I tried many different thing. The regsavekey() did only
write a 0kb file.
Click to expand...
RegSaveKey() exports hives directly and therefore requires fiddling with
privileges, which is incredibly cumbersome. If I'd realized that I would
have suggested something far simpler (if less slick): invoke reg.exe to do
the heavy lifting. It's a command-line tool included in Windows from XP
upwards (and downloadable for Windows 2000) that can perform most registry
operations, including saving and loading to disk (save/restore,
export/import). Use Process.Start() with a ProcessStartInfo specifying
..CreateNoWindow = true.
 
Back
Top