Finding entries in Windows Registry matching a RE

Discussion in 'Ruby' started by Richard, Jun 6, 2007.

  1. Richard

    Richard Guest

    Hi,

    I'd like to be able to search a named hive for keys whose names match
    a given regular expression.

    I found, for example:

    require 'win32/registry'
    Win32::Registry::HKEY_CURRENT_USER.open('SOFTWARE\\AdwareAlert\
    \AdwareAlert\\RegInfo') do |reg|
    puts reg['OrderNo']
    end

    which let me specify a specific key in the HKCU hive and print the
    value of one of its entries.

    I don't actually know why the foregoing is even syntactically correct
    because http://www.ruby-doc.org/stdlib/libdoc/Win32API/rdoc/classes/Win32/Registry/Constants.html
    says HKEY_CURRENT_USER is a constant in Win32::Registry. Therefore,
    it seems to me that HKEY_CURRENT_USER can't have a method "open".

    Any ideas?
    TIA,
    Richard
    Richard, Jun 6, 2007
    #1
    1. Advertising

  2. On 06.06.2007 07:13, Richard wrote:
    > Hi,
    >
    > I'd like to be able to search a named hive for keys whose names match
    > a given regular expression.
    >
    > I found, for example:
    >
    > require 'win32/registry'
    > Win32::Registry::HKEY_CURRENT_USER.open('SOFTWARE\\AdwareAlert\
    > \AdwareAlert\\RegInfo') do |reg|
    > puts reg['OrderNo']
    > end
    >
    > which let me specify a specific key in the HKCU hive and print the
    > value of one of its entries.
    >
    > I don't actually know why the foregoing is even syntactically correct
    > because http://www.ruby-doc.org/stdlib/libdoc/Win32API/rdoc/classes/Win32/Registry/Constants.html
    > says HKEY_CURRENT_USER is a constant in Win32::Registry.


    Why do you think this should disallow the syntax above? It's perfectly
    valid Ruby code. And that does not have to do anything with the fact
    that HKEY_CURRENT_USER is a constant.

    > Therefore,
    > it seems to me that HKEY_CURRENT_USER can't have a method "open".


    The documentation is probably a bit misleading:

    11:06:11 [~]: ruby -r win32/registry -e
    'k=Win32::Registry::HKEY_CURRENT_USER; p k, k.class,
    k.instance_variables.map {|v| "#{v}=#{k.instan
    ce_variable_get v}"}'
    #<Win32::Registry key="HKEY_CURRENT_USER">
    Win32::Registry
    ["@keyname=HKEY_CURRENT_USER", "@parent=", "@hkey=2147483649",
    "@disposition=2"]

    Does that fix your irritation? :)

    Btw, if you do this you'll see some methods that might actually do what
    you need (find for example).

    ruby -r win32/registry -e 'puts Win32::Registry.instance_methods.sort'

    Kind regards

    robert
    Robert Klemme, Jun 6, 2007
    #2
    1. Advertising

  3. Richard

    Richard Guest

    Hi Robert,

    Thanks for your response. I'm studying the issue and will respond
    with either "Eureka" or a (hopefully) more sophisticated or nuanced
    question.

    Best wishes,
    Richard

    On Jun 6, 5:09 am, Robert Klemme <> wrote:
    > On 06.06.2007 07:13, Richard wrote:
    >
    >
    >
    > > Hi,

    >
    > > I'd like to be able to search a named hive for keys whose names match
    > > a given regular expression.

    >
    > > I found, for example:

    >
    > > require 'win32/registry'
    > > Win32::Registry::HKEY_CURRENT_USER.open('SOFTWARE\\AdwareAlert\
    > > \AdwareAlert\\RegInfo') do |reg|
    > > puts reg['OrderNo']
    > > end

    >
    > > which let me specify a specific key in the HKCU hive and print the
    > > value of one of its entries.

    >
    > > I don't actually know why the foregoing is even syntactically correct
    > > becausehttp://www.ruby-doc.org/stdlib/libdoc/Win32API/rdoc/classes/Win32/Reg...
    > > says HKEY_CURRENT_USER is a constant in Win32::Registry.

    >
    > Why do you think this should disallow the syntax above? It's perfectly
    > valid Ruby code. And that does not have to do anything with the fact
    > that HKEY_CURRENT_USER is a constant.
    >
    > > Therefore,
    > > it seems to me that HKEY_CURRENT_USER can't have a method "open".

    >
    > The documentation is probably a bit misleading:
    >
    > 11:06:11 [~]: ruby -r win32/registry -e
    > 'k=Win32::Registry::HKEY_CURRENT_USER; p k, k.class,
    > k.instance_variables.map {|v| "#{v}=#{k.instan
    > ce_variable_get v}"}'
    > #<Win32::Registry key="HKEY_CURRENT_USER">
    > Win32::Registry
    > ["@keyname=HKEY_CURRENT_USER", "@parent=", "@hkey=2147483649",
    > "@disposition=2"]
    >
    > Does that fix your irritation? :)
    >
    > Btw, if you do this you'll see some methods that might actually do what
    > you need (find for example).
    >
    > ruby -r win32/registry -e 'puts Win32::Registry.instance_methods.sort'
    >
    > Kind regards
    >
    > robert
    Richard, Jun 7, 2007
    #3
  4. On 07/06/07, Richard <> wrote:
    > Hi Robert,
    >
    > Thanks for your response. I'm studying the issue and will respond
    > with either "Eureka" or a (hopefully) more sophisticated or nuanced
    > question.
    >

    Hello,

    I believe that 'key' in registry is that thing that would correspond
    to directory, and things that actually contain something (like file)
    are called 'value'. There should be functions to list subkeys and
    values of a given key (at least once you open it). Unfortunately,
    ruby-doc.org fails to index the win32 stuff properly so your best
    source of information is the ri/extension sources shipped with your
    Windows build of ruby.
    Trying something like (Win32::Registry::HKEY_CURRENT_USER.methods -
    methods).sort or (Win32::Registry::HKEY_CURRENT_USER.methods.open("")
    - methods).sort in irb may give you some idea.

    Thanks

    Michal
    Michal Suchanek, Jun 7, 2007
    #4
  5. Richard

    Richard Guest

    Hi Robert and Michal,

    Thanks for your responses.

    1. I was hung up the the fact that HKEY_CURRENT_USER appears to be a
    constant to me. Heretofore, I never heard of a constant having
    methods.

    # CODE START
    require 'win32/registry'
    require 'show'
    show %@Win32::Registry::HKEY_CURRENT_USER.class@
    # CODE END

    # OUTPUT START
    Win32::Registry::HKEY_CURRENT_USER.class
    => Win32::Registry
    # OUTPUT END

    So I now see that this HKEY_CURRENT_USER is an instance of the
    Win32::Registry class. OK, this is step 1 of my education.

    I've visited the http://www.ruby-doc.org/ for the Win32:Registry
    module
    as well as the Microsoft site for the Registry API. These two things,
    plus the fact that I handled the Registry programatically with VC++/
    MFC a decade earlier, means I should be fine now.

    I am curious about one thing: I haven't been able to see how the above
    construct really works, i.e. where's the code for it? Maybe I didn't
    read the RDoc carefully enough. From Robert's inspection statement,
    it looks like the expression returns an instance of of Win32::Registry
    with an instance variable @key set to HKEY_CURRENT_USER.

    Again, thanks for your responses. I did look at the totality of
    instance methods, though the Ruby-doc stuff is really what I needed to
    look at.

    Best wishes,
    Richard

    P.S. The Microsoft site is http://msdn2.microsoft.com/en-us/library/ms724875.aspx.

    On Jun 6, 5:09 am, Robert Klemme <> wrote:
    > On 06.06.2007 07:13, Richard wrote:
    >
    >
    >
    > > Hi,

    >
    > > I'd like to be able to search a named hive for keys whose names match
    > > a given regular expression.

    >
    > > I found, for example:

    >
    > > require 'win32/registry'
    > > Win32::Registry::HKEY_CURRENT_USER.open('SOFTWARE\\AdwareAlert\
    > > \AdwareAlert\\RegInfo') do |reg|
    > > puts reg['OrderNo']
    > > end

    >
    > > which let me specify a specific key in the HKCU hive and print the
    > > value of one of its entries.

    >
    > > I don't actually know why the foregoing is even syntactically correct
    > > becausehttp://www.ruby-doc.org/stdlib/libdoc/Win32API/rdoc/classes/Win32/Reg...
    > > says HKEY_CURRENT_USER is a constant in Win32::Registry.

    >
    > Why do you think this should disallow the syntax above? It's perfectly
    > valid Ruby code. And that does not have to do anything with the fact
    > that HKEY_CURRENT_USER is a constant.
    >
    > > Therefore,
    > > it seems to me that HKEY_CURRENT_USER can't have a method "open".

    >
    > The documentation is probably a bit misleading:
    >
    > 11:06:11 [~]: ruby -r win32/registry -e
    > 'k=Win32::Registry::HKEY_CURRENT_USER; p k, k.class,
    > k.instance_variables.map {|v| "#{v}=#{k.instan
    > ce_variable_get v}"}'
    > #<Win32::Registry key="HKEY_CURRENT_USER">
    > Win32::Registry
    > ["@keyname=HKEY_CURRENT_USER", "@parent=", "@hkey=2147483649",
    > "@disposition=2"]
    >
    > Does that fix your irritation? :)
    >
    > Btw, if you do this you'll see some methods that might actually do what
    > you need (find for example).
    >
    > ruby -r win32/registry -e 'puts Win32::Registry.instance_methods.sort'
    >
    > Kind regards
    >
    > robert
    Richard, Jun 10, 2007
    #5
  6. Richard

    SonOfLilit Guest

    In Ruby, "constant" means that it's value should not change (that's
    actually just a syntactical convention - you'll only get a value if
    you try A=8; A=9). It also means that it will be stored in a different
    table (or at least treated like it was, with different methods to
    access it etc' - I'm not familiar enough with the MRI to comment).

    Constants are still Ruby variables, which means that they can store a
    reference to any Ruby object.

    E.g.:

    ERROR_STREAM = File.open("log.txt")

    If you're interested in great uses of constants (and class methods
    that behave like it was just a constant) try learning how to use
    _why's ingenious Camping. It is full of amazing uses for those. It's
    an afternoon to learn, especially if you're familiar with Rails.


    Aur
    SonOfLilit, Jun 10, 2007
    #6
  7. Richard

    Richard Guest

    > Constants are still Ruby variables, which means that they can store a
    > reference to any Ruby object.


    Of course! You've eased my brain-cramp :) Thanks.

    > try learning how to use
    > _why's ingenious Camping


    I peeked at "Camping, a Microframework". Lot's of interesting stuff.
    I put it on my TODO list. Thanks.

    Best wishes
    --
    Richard



    On Jun 10, 5:34 am, SonOfLilit <> wrote:
    > In Ruby, "constant" means that it's value should not change (that's
    > actually just a syntactical convention - you'll only get a value if
    > you try A=8; A=9). It also means that it will be stored in a different
    > table (or at least treated like it was, with different methods to
    > access it etc' - I'm not familiar enough with the MRI to comment).
    >
    > Constants are still Ruby variables, which means that they can store a
    > reference to any Ruby object.
    >
    > E.g.:
    >
    > ERROR_STREAM = File.open("log.txt")
    >
    > If you're interested in great uses of constants (and class methods
    > that behave like it was just a constant) try learning how to use
    > _why's ingenious Camping. It is full of amazing uses for those. It's
    > an afternoon to learn, especially if you're familiar with Rails.
    >
    > Aur
    Richard, Jun 14, 2007
    #7
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Leny
    Replies:
    3
    Views:
    16,903
    Daniel
    Feb 1, 2005
  2. Don Bruder
    Replies:
    3
    Views:
    951
    spikeysnack
    Aug 3, 2010
  3. Stefan Ram
    Replies:
    1
    Views:
    386
    Digger
    Sep 13, 2010
  4. techmaccoy

    Help! Registry Listing only Partial Entries??

    techmaccoy, Jan 19, 2005, in forum: ASP .Net Security
    Replies:
    0
    Views:
    102
    techmaccoy
    Jan 19, 2005
  5. Paul  Moore
    Replies:
    2
    Views:
    496
    Paul Moore
    Feb 2, 2012
Loading...

Share This Page