break on
$=SetOption( "Explicit", "ON" )
$=SetOption( "NoVarsInStrings", "ON" )
$=SetOption( "NoMacrosInStrings", "ON" )
global $HKEY_CLASSES_ROOT, $HKEY_CURRENT_USER, $HKEY_LOCAL_MACHINE
global $HKEY_USERS, $HKEY_CURRENT_CONFIG
$HKEY_CLASSES_ROOT = (CDBL(2147483647)+1) ; &80000000
$HKEY_CURRENT_USER = (CDBL(2147483647)+2) ; &80000001
$HKEY_LOCAL_MACHINE = (CDBL(2147483647)+3) ; &80000002
$HKEY_USERS = (CDBL(2147483647)+4) ; &80000003
$HKEY_CURRENT_CONFIG = (CDBL(2147483647)+6) ; &80000005
global $strComputer, $strRegKey, $strRegValueName, $strRegValueType, $RegValue, $tmp
$strComputer = "."
?
";--------------------------------------" ?
"; example 1 : REG_SZ" ?
";--------------------------------------" ?
$strRegKey = "System\CurrentControlSet\Services\TCPIP\Performance"
$strRegValueName = "Open"
$strRegValueType = "REG_SZ"
". SubKeyName : " $strRegKey ?
". ValueName : " $strRegValueName ?
$RegValue = ReadRegistryValue( "HKLM", $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValue( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValueEx( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strComputer )
". value : " $RegValue ?
?
";--------------------------------------" ?
"; example 2 : REG_DWORD" ?
";--------------------------------------" ?
$strRegKey = "System\CurrentControlSet\Services\TCPIP\Performance"
$strRegValueName = "WbemAdapStatus"
$strRegValueType = "REG_DWORD"
". SubKeyName : " $strRegKey ?
". ValueName : " $strRegValueName ?
$RegValue = ReadRegistryValue( "HKLM", $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValue( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValueEx( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strComputer )
". value : " $RegValue ?
?
";--------------------------------------" ?
"; example 3 : REG_BINARY" ?
";--------------------------------------" ?
$strRegKey = "System\CurrentControlSet\Services\TCPIP\Performance"
$strRegValueName = "WbemAdapFileSignature"
$strRegValueType = "REG_BINARY"
". SubKeyName : " $strRegKey ?
". ValueName : " $strRegValueName ?
$RegValue = ReadRegistryValue( "HKLM", $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : "
for each $tmp in $regvalue
DecToHex($tmp) " "
next
?
$RegValue = ReadRegistryValue( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : "
for each $tmp in $regvalue
DecToHex($tmp) " "
next
?
$RegValue = ReadRegistryValueEx( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strComputer )
". value : "
for each $tmp in $regvalue
DecToHex($tmp) " "
next
?
?
";--------------------------------------" ?
"; example 4 : REG_EXPAND_SZ" ?
";--------------------------------------" ?
$strRegKey = "System\CurrentControlSet\Services\TCPIP\Parameters"
$strRegValueName = "DataBasePath"
$strRegValueType = "REG_EXPAND_SZ"
". SubKeyName : " $strRegKey ?
". ValueName : " $strRegValueName ?
$RegValue = ReadRegistryValue( "HKLM", $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValue( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : " $RegValue ?
$RegValue = ReadRegistryValueEx( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strComputer )
". value : " $RegValue ?
?
";--------------------------------------" ?
"; example 5 : REG_MULTI_SZ" ?
";--------------------------------------" ?
$strRegKey = "SYSTEM\CurrentControlSet\Services\Eventlog\Security"
$strRegValueName = "Sources"
$strRegValueType = "REG_MULTI_SZ"
". SubKeyName : " $strRegKey ?
". ValueName : " $strRegValueName ?
$RegValue = ReadRegistryValue( "HKLM", $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : "
for each $tmp in $regvalue
? " . " $tmp
next
?
$RegValue = ReadRegistryValue( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strRegValueType, $strComputer )
". value : "
for each $tmp in $regvalue
? " . " $tmp
next
?
$RegValue = ReadRegistryValueEx( $HKEY_LOCAL_MACHINE, $strRegkey, $strRegValueName, $strComputer )
". value : "
for each $tmp in $regvalue
? " . " $tmp
next
?
exit 0
;-------------------------------------------------------------------------------
; function to read value in the registry (locally or remotely)
;-------------------------------------------------------------------------------
function ReadRegistryValue( $Hive, $strRegkey, $strRegValueName, $strRegType, optional $strComputer )
dim $namespace, $objWMIService, $objRegistry, $hDefKey, $wmiclass, $wmimethod
dim $objInParams, $objOutParams
$ReadRegistryValue = ""
select
case vartype($hive)=8
select
case $Hive = "HKEY_CLASSES_ROOT" $hDefKey = (CDBL(2147483647)+1) ; &80000000
case $Hive = "HKCR" $hDefKey = (CDBL(2147483647)+1) ; &80000000
case $Hive = "HKEY_CURRENT_USER" $hDefKey = (CDBL(2147483647)+2) ; &80000001
case $Hive = "HKCU" $hDefKey = (CDBL(2147483647)+2) ; &80000001
case $Hive = "HKEY_LOCAL_MACHINE" $hDefKey = (CDBL(2147483647)+3) ; &80000002
case $Hive = "HKLM" $hDefKey = (CDBL(2147483647)+3) ; &80000002
case $Hive = "HKEY_USERS" $hDefKey = (CDBL(2147483647)+4) ; &80000003
case $Hive = "HKUS" $hDefKey = (CDBL(2147483647)+4) ; &80000003
case $Hive = "HKEY_CURRENT_CONFIG" $hDefKey = (CDBL(2147483647)+6) ; &80000005
case $Hive = "HKCC" $hDefKey = (CDBL(2147483647)+6) ; &80000005
case 1 exit -1
endselect
case vartype($hive)=5
$hDefKey = $hive
case 1 exit -1
endselect
select
case $strRegType = "REG_SZ" $wmimethod = "GetStringValue"
case $strRegType = "REG_EXPAND_SZ" $wmimethod = "GetExpandedStringValue"
case $strRegType = "REG_MULTI_SZ" $wmimethod = "GetMultiStringValue"
case $strRegType = "REG_DWORD" $wmimethod = "GetDwordValue"
case $strRegType = "REG_QWORD" $wmimethod = "GetQwordValue"
case $strRegType = "REG_BINARY" $wmimethod = "GetBinaryValue"
case 1 exit -2
endselect
;-- Connect to WMI --
$namespace = "root\default"
$objWMIService = GetObject('winmgmts:{impersonationLevel=impersonate,(debug,security)}!\\'+$strComputer+'\'+$namespace)
$wmiclass = "StdRegProv"
$objRegistry = $objWMIService.Get($wmiclass)
$objInParams = $objRegistry.Methods_($wmimethod).InParameters.SpawnInstance_
$objInParams.hDefKey = $hDefKey
$objInParams.sSubKeyName = $strRegKey
$objInParams.sValueName = $strRegValueName
;-- Execute the method to read value in the registry --
$objOutParams = $objWMIService.ExecMethod( $wmiclass, $wmimethod, $objInParams )
if $objOutParams.ReturnValue <> 0
exit $objOutParams.ReturnValue
endif
;-- get the Value parameter that is returned by method --
select
case $strRegType = "REG_SZ" $ReadRegistryValue = $objOutParams.sValue
case $strRegType = "REG_EXPAND_SZ" $ReadRegistryValue = $objOutParams.sValue
case $strRegType = "REG_MULTI_SZ" $ReadRegistryValue = $objOutParams.sValue
case $strRegType = "REG_DWORD" $ReadRegistryValue = $objOutParams.uValue
case $strRegType = "REG_QWORD" $ReadRegistryValue = $objOutParams.uValue
case $strRegType = "REG_BINARY" $ReadRegistryValue = $objOutParams.uValue
endselect
exit 0
endfunction
;-------------------------------------------------------------------------------
; function to read value in the registry (locally or remotely)
;-------------------------------------------------------------------------------
function ReadRegistryValueEx( $Hive, $strRegkey, $strRegValueName, optional $strComputer )
dim $namespace, $objWMIService, $objRegistry
dim $hDefKey, $arrValuesName, $arrValuesType, $RegType, $wmiclass, $wmimethod
dim $objInParams, $objOutParams
$ReadRegistryValueEx = ""
select
case vartype($hive)=8
select
case $Hive = "HKEY_CLASSES_ROOT" $hDefKey = (CDBL(2147483647)+1) ; &80000000
case $Hive = "HKCR" $hDefKey = (CDBL(2147483647)+1) ; &80000000
case $Hive = "HKEY_CURRENT_USER" $hDefKey = (CDBL(2147483647)+2) ; &80000001
case $Hive = "HKCU" $hDefKey = (CDBL(2147483647)+2) ; &80000001
case $Hive = "HKEY_LOCAL_MACHINE" $hDefKey = (CDBL(2147483647)+3) ; &80000002
case $Hive = "HKLM" $hDefKey = (CDBL(2147483647)+3) ; &80000002
case $Hive = "HKEY_USERS" $hDefKey = (CDBL(2147483647)+4) ; &80000003
case $Hive = "HKUS" $hDefKey = (CDBL(2147483647)+4) ; &80000003
case $Hive = "HKEY_CURRENT_CONFIG" $hDefKey = (CDBL(2147483647)+6) ; &80000005
case $Hive = "HKCC" $hDefKey = (CDBL(2147483647)+6) ; &80000005
case 1 exit -1
endselect
case vartype($hive)=5
$hDefKey = $hive
case 1 exit -1
endselect
;-- Connect to WMI --
$namespace = "root\default"
$objWMIService = GetObject('winmgmts:{impersonationLevel=impersonate,(debug,security)}!\\'+$strComputer+'\'+$namespace)
$wmiclass = "StdRegProv"
$objRegistry = $objWMIService.Get($wmiclass)
$wmimethod = "EnumValues"
$objInParams = $objRegistry.Methods_($wmimethod).InParameters.SpawnInstance_
$objInParams.hDefKey = $hDefKey
$objInParams.sSubKeyName = $strRegKey
$objInParams.sValueName = $strRegValueName
;-- Execute the method to read value in the registry --
$objOutParams = $objWMIService.ExecMethod( $wmiclass, $wmimethod, $objInParams )
if $objOutParams.ReturnValue <> 0
exit -3
endif
;-- search $strRegValueName in the array of value name returned --
$arrValuesName = $objOutParams.sNames
$arrValuesType = $objOutParams.Types
dim $i, $imax, $found
$found = 0
$i = -1
$imax = UBound($arrValuesName)
while $i < $imax
$i = $i + 1
if $strRegValueName = $arrValuesName[$i]
$RegType = $arrValuesType[$i]
select
case $RegType = 1 $wmimethod = "GetStringValue"
case $RegType = 2 $wmimethod = "GetExpandedStringValue"
case $RegType = 7 $wmimethod = "GetMultiStringValue"
case $RegType = 4 $wmimethod = "GetDwordValue"
case $RegType = 11 $wmimethod = "GetQwordValue"
case $RegType = 3 $wmimethod = "GetBinaryValue"
endselect
$i = $imax
$found = 1
endif
loop
if not $found
exit -4
endif
$objInParams = $objRegistry.Methods_($wmimethod).InParameters.SpawnInstance_
$objInParams.hDefKey = $hDefKey
$objInParams.sSubKeyName = $strRegKey
$objInParams.sValueName = $strRegValueName
;-- Execute the method to read value in the registry --
$objOutParams = $objWMIService.ExecMethod( $wmiclass, $wmimethod, $objInParams )
if $objOutParams.ReturnValue <> 0
exit $objOutParams.ReturnValue
endif
;-- get the Value parameter that is returned by method --
select
case $RegType = 1 $ReadRegistryValueEx = $objOutParams.sValue
case $RegType = 2 $ReadRegistryValueEx = $objOutParams.sValue
case $RegType = 7 $ReadRegistryValueEx = $objOutParams.sValue
case $RegType = 4 $ReadRegistryValueEx = $objOutParams.uValue
case $RegType = 11 $ReadRegistryValueEx = $objOutParams.uValue
case $RegType = 3 $ReadRegistryValueEx = $objOutParams.uValue
endselect
exit 0
endfunction
