5

Is there a tool or method with which I can search the windows registry with regular expressions?

Improve this question

6 Answers 6

Reset to default
5

The free RegAlyzer utility searches by substring, wildcard (*,?), boolean (AND OR NOT), and regular expression:

RegAlyzer is a tool to browse and change the registry. It was created because of a few features we missed in the original regedit tool, from support for exotic value types over background and regular expression search to better bookmarks, displaying .reg files in the accustomed style and a history view.

image

Improve this answer
9

You can use PowerShell with -match:

dir HKCU:\ -rec -ea SilentlyContinue |   

ForEach-Object {   
       if((get-itemproperty -Path $_.PsPath) -match "\wSomestring\w")  
    {   
          $_.PsPath
    }   
}

This will search the HKEY_CURRENT_USER hive.

Improve this answer
3
  • This sounds promising. I have never used PowerShell before, however. I'll give it a try.
    – René Nyffenegger
    Nov 4, 2009 at 18:13
  • 1
    A good overview of regex with -match can be found here: 207.46.16.252/en-us/magazine/2007.11.powershell.aspx
    – user1931
    Nov 4, 2009 at 18:21
  • This works but takes a while to search the whole hive. I'd rather use this because I already have PS installed and like it.
    – Bratch
    Nov 4, 2009 at 19:31
3

If it's just a matter of searching it without changing anything (no Search & Replace), export the whole registry to a .reg file and use your favorite text editor that supports regular expressions (Notepad++, Textpad, PSPad, ...).

To export the whole registry, right-click the Computer node in Registry Editor and select Export.

Watch out, the exported file can be huge. I just tried and the file was 250 MB big.

Encoding update: On WinXP, cygwin's file utility reports the exported data as Unicode text, UTF-16, little-endian.

Improve this answer
2
  • well, yes, I guess that would do, if only the the exported file wouldn't be 256'803'816 bytes in size. Also, I have no idea in what encoding the file is written.
    – René Nyffenegger
    Nov 4, 2009 at 18:12
  • +1. as a bonus, by exporting you've just backed up your registry.
    – quack quixote
    Nov 5, 2009 at 4:32
1

You can use Cygwin.

Open Cygwin terminal and use those commands:

cd /proc/registry32/HKEY_LOCAL_MACHINE
find . -name "*something*"
Improve this answer
3
  • This is way too cool if it worked, but unfortunatly, I get an Error: Current working directory is a virtual Cygwin directory which does not exist for a native Windows application. Can't start native Windows application from here. if I try this.
    – René Nyffenegger
    Jun 25, 2015 at 15:44
  • @RenéNyffenegger Bad to hear that, it doesn't work in your Cygwin installation. I have verified this once again - here is my commands and the output: $ find . -name "*mp3*" ./SOFTWARE/Microsoft/Multimedia/WMPlayer/Extensions/.mp3 ./SOFTWARE/Microsoft/Multimedia/WMPlayer/MIME Types/audio%2Fmp3 ./SOFTWARE/Microsoft/Multimedia/WMPlayer/MIME Types/audio%2Fx-mp3 ... My Cygwin version is quite new: $ uname -a CYGWIN_NT-6.1 PL00039406 2.0.2(0.287/5/3) 2015-05-08 17:00 x86_64 Cygwin
    – adaslaw
    Jun 30, 2015 at 13:37
  • @RenéNyffenegger I've got the suspicion that when you run your 'find' command, then Windows version of find utility is executed. In my case find utility from Cygwin installation in executed.
    – adaslaw
    Jun 30, 2015 at 13:43
0

Even reg.exe does not seem to support it, but it might help getting a list to process with other command line tools. See reg.exe query.

Improve this answer
1
  • Although this is not exactly what I was looking for (because of the missing regex suport), it's certainly an appreciated link/hint.
    – René Nyffenegger
    Nov 4, 2009 at 18:32
0

I use a tool named Regscanner by Nirsoft. It can search registry (with or without Regex) and returns results, you can click matches to open it in Regedit.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .