REG QUERY - Printable Version

REG QUERY - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Coding (https://sinister.li/Forum-Coding--71)
+--- Thread: REG QUERY (/Thread-REG-QUERY)

Pages: 1 2 3

REG QUERY - noize - 05-16-2013

Let's pretend we're using

Code:
reg query HKLM /v Something /s | find /i "keyword-to-search"

It should find any key containing the value "Something" and "keyword-to-search" within the data.
It works perfectly, but how could I manage to get the name of the key containing it (without having to check every single sub-key, is meant)?

Edit: I've already completed the project using the check for every single sub-key, but if still somebody knows a way to do it like that I'd like to hear it.

REG QUERY - noize - 05-16-2013

Let's pretend we're using

Code:
reg query HKLM /v Something /s | find /i "keyword-to-search"

RE: REG QUERY - ArkPhaze - 05-17-2013

Like this?
[Image: MbF8UG7.png]

RE: REG QUERY - noize - 05-18-2013

No, I mean more like this:

Code:
reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\ /v DriverDesc /s | find /i "Broad" 2>nul

My NIC's got "Broad" in the name, which is the data for the value "DriverDesc" in some subkey of that reg path.
When I run this command, I get the line "DriverDesc REG_SZ ...", but how could I get the line just above it, which is the reg path?

What I'd like to do is to either get it by getting the line above it (in some simple way, 'cause I could get it myself in some complex way) or to get the key path with a different QUERY.

RE: REG QUERY - noize - 05-18-2013

No, I mean more like this:

Code:
reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\ /v DriverDesc /s | find /i "Broad" 2>nul

RE: REG QUERY - ArkPhaze - 05-18-2013

You're not looking for the Registry location, you're looking for "Broad", that's why I initially had "HKEY" in there, because a registry location would have this in there... I don't get what you want to do, my script does get the registry path... :huh:

Look at the command prompt I have open in the image I provided lol. Those are all the keys that contain a (sub)key called "Debug."

edit: Ahh, I think I know what you mean now:

Code:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Outlook\Performance
    Debug    REG_DWORD    0x0

For example, if the value "0x0" in this case was "Broad"(?), for any of the paths returned, you want to get the path itself (the line above each key that has a value "Broad")?

Loop through the output then, keep a record of the previous value and the current as you go through the loop, validate that you're looking at the path as your first value by checking the substring for "HKEY", then if the second variable contains what you are looking for, store that first value.

Make a pseudo array (batch doesn't have real arrays)

So:

Code:
set path%incrementVar%={The path}
{increment %incrementVar%'s value by 1}

And then loop from whatever you assigned a path# variable with, using the initial value that was given to incrementVar until you find something which is not defined.

You should logically end up with %path1%, %path2%, etc.... So these are the variables you are looping through to use the paths.

Make sense?

Code:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Outlook\Performance
    Debug    REG_DWORD    0x0

Code:
set path%incrementVar%={The path}
{increment %incrementVar%'s value by 1}

RE: REG QUERY - noize - 05-18-2013

(05-18-2013, 09:37 AM)ArkPhaze Wrote: You're not looking for the Registry location, you're looking for "Broad", that's why I initially had "HKEY" in there, because a registry location would have this in there... I don't get what you want to do, my script does get the registry path... :huh:

Look at the command prompt I have open in the image I provided lol. Those are all the keys that contain a (sub)key called "Debug."

You're never going to get it with this though:

Code:
find /i "Broad"

How does finding "Broad" guarantee that we're finding a registry location? (This is why it doesn't work for you, because from the Reg query output, they don't put that into the path because they take the parent location, exclusive of that subkey itself, thus "Broad" will never exist within those locations unless for some lucky reason it exists in an earlier part of the path.)

*That* is the problem lol.

That's why I did it how I did it for macspoofer (see label keyloop, I believe).

Edit: here it is:

Code:
set i=0
:keyloop
set /a i=i+1
if %i% LSS 10 set n=000%i%
if %i% GTR 9 set n=00%i%
if %i% GTR 99 set n=0%i%
if %i% GTR 999 set n=%i%
reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\%n% /v DriverDesc /s | find /i "%keyword%" 2>nul > nul
if "%errorlevel%"=="0" goto quitloop
goto keyloop
:quitloop

RE: REG QUERY - noize - 05-18-2013

(05-18-2013, 09:37 AM)ArkPhaze Wrote: You're not looking for the Registry location, you're looking for "Broad", that's why I initially had "HKEY" in there, because a registry location would have this in there... I don't get what you want to do, my script does get the registry path... :huh:

Look at the command prompt I have open in the image I provided lol. Those are all the keys that contain a (sub)key called "Debug."

You're never going to get it with this though:

Code:
find /i "Broad"

How does finding "Broad" guarantee that we're finding a registry location? (This is why it doesn't work for you, because from the Reg query output, they don't put that into the path because they take the parent location, exclusive of that subkey itself, thus "Broad" will never exist within those locations unless for some lucky reason it exists in an earlier part of the path.)

*That* is the problem lol.

That's why I did it how I did it for macspoofer (see label keyloop, I believe).

Edit: here it is:

Code:
set i=0
:keyloop
set /a i=i+1
if %i% LSS 10 set n=000%i%
if %i% GTR 9 set n=00%i%
if %i% GTR 99 set n=0%i%
if %i% GTR 999 set n=%i%
reg query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\%n% /v DriverDesc /s | find /i "%keyword%" 2>nul > nul
if "%errorlevel%"=="0" goto quitloop
goto keyloop
:quitloop