Impacket registry-read.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Opens a local registry hive read-only to inspect keys and values. It can also derive the boot key from a SYSTEM hive.
| Item | Details |
|---|---|
| Implementation | examples/registry-read.py |
| Category | Secrets / DPAPI / registry / file analysis |
| Size | 174 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/registry-read.py -h for the current option definitions.
Subcommands: enum_key, enum_values, get_value, get_class, walk
| Argument | Description |
|---|---|
-debug | Enable debug output |
-ts | Add a timestamp to each log message |
hive | Registry hive to open |
-name | Registry key; required |
-recursive | Search recursively (default: False) |
Detailed processing flow
Section titled “Detailed processing flow”The tool parses the hive with winregistry.Registry and dispatches enum_key, enum_values, get_value, get_class, and walk to their corresponding functions. It resolves paths to nodes and displays data according to value type.
How it works
Section titled “How it works”A registry hive file is a binary database with a cell allocator and index tree.
winregistry.Registry follows key nodes from the root cell and resolves cell
offsets for subkey and value lists. This command calls that API for each
subcommand; it does not use the remote Registry protocol.
enum_key and enum_values read different lists from the same key node, while
get_value interprets the value type and data cell. get_class retrieves key
class data. To derive a boot key from a SYSTEM hive, it concatenates class strings
from specific LSA keys in order and rearranges them. Preserve raw bytes and types, not only display strings.
walk traverses the tree recursively, so account for cycles in damaged indexes,
excessively deep trees, deleted or free cells, and out-of-range offsets. This tool
does not apply hive transaction logs, so the latest state of a dirty hive may
not be fully reflected. Keep parsing read-only and make changes together with
tests/misc/test_winregistry.py.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
bootKey() | 32 | Module function |
getClass() | 48 | Module function |
getValue() | 63 | Module function |
enumValues() | 77 | Module function |
enumKey() | 99 | Module function |
walk() | 115 | Module function |
main() | 119 | Module function |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket.examples | logger |
impacket | version, winregistry |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The main operation parses local files. Treat input as untrusted: validate offsets, lengths, and format identifiers before accessing data.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- Distinguish a missing input file, a damaged file, an incomplete read, and an unsupported format.
When changing the implementation
Section titled “When changing the implementation”The code depends on impacket.winregistry and standard binary and NT path helpers. The CLI functions are thin wrappers; make changes to cell, index, or value parsing in the library and tests/misc/test_winregistry.py.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/registry-read.py - CLI:
python examples/registry-read.py -h - No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.