reglookup(1)

📦
version 1.0.1+svn296 · 5 versions
, in ubuntu stonking

🎀 reglookup — the manual page, but make it fashion 🎀

okay bestie, pull up a chair because we're about to talk about reglookup, and this lives in section 1 of the manual, so it's reglookup(1) if you're being formal. she's a Windows NT+ registry reader and lookup tool. yes, that registry. the spooky one. let's get into it 💅

✨ NAME ✨

reglookup — Windows NT+ registry reader/lookup tool

✨ SYNOPSIS ✨

reglookup [options] registry-file

✨ DESCRIPTION ✨

so reglookup is literally designed to read windows registry elements and print them out to stdout in a CSV-like format. she has filtering options to narrow the focus of the output, so you're not drowning in a hundred thousand lines, no cap. this tool is designed to work with on Windows NT-based registries. that's her whole thing. 👑

✨ OPTIONS ✨

reglookup accepts the following parameters:

  • -p prefix-filter — specify a path prefix filter. only keys/values under this registry path will be output. it's giving "girl, just show me this one subtree."
  • -t type-filter — specify a type filter. only elements which match this registry data type will be printed. the acceptable values are: NONE, SZ, EXPAND_SZ, BINARY, DWORD, DWORD_BE, LINK, MULTI_SZ, RSRC_LIST, RSRC_DESC, RSRC_REQ_LIST, QWORD and KEY .
  • -h — enables the printing of a column header row. (default) bestie, the header is on unless you say otherwise.
  • -i — printed values inherit the timestamp of their parent key, which is printed along with them. ⚠️ note that this timestamp is not necessarily meaningful for any given value values because timestamps are saved on keys only and you cannot tell which value has been modified since a change to any value of a given key would update the time stamp. so like… she's telling you a time, just maybe not the time. 🙈
  • -H — disables the printing of a column header row. (the anti--h. iconic.)
  • -s — adds five additional columns to output containing information from key security descriptors and rarely used fields. the columns are: owner, group, sacl, dacl, class. (this feature's output has not been extensively tested.) so like, use it, love it, but don't bet your whole life on it, fr fr.
  • -S — disables the printing of security descriptor information. (default)
  • -v — verbose output. she's chatty now. 🗣️
  • registry-file — required argument. specifies the location of the registry file to read. the system registry files should be found under: %SystemRoot%/system32/config.

✨ OUTPUT ✨

reglookup generates comma-separated values (CSV) and writes them to stdout. the format is designed to simplify parsing algorithms of other tools by quoting CSV special characters using a common hexadecimal format. specifically, special characters or non-ascii bytes are converted to "%XX" where XX is the hexadecimal value for the byte. cute, tidy, parseable. 🎀

the number of columns or fields in each line is fixed for a given run of the program, but may vary based on the command line options provided. see the header line for information on which fields are available and what they contain.

🌸 sub-delimiters, aka the plot twist 🌸

some fields in some lines may contain sub-fields which require additional delimiters. if these sub-delimiters occur in these sub-fields, they are also encoded in the same way as commas or other special characters are. currently, the second, third, and fourth level delimiters are "|", ":", and " ", respectively. these are particularly important to take note of when security attributes are printed. please note that these delimiters may occur in fields that are not sub-delimited, and should not be interpreted as special. 🫶

🔐 security attributes, decoded 🔐

security attributes of registry keys have a complex structure which is outlined here. each key will generally have an associated ACL (Access Control List), which is made up of ACEs (Access Control Entries). each ACE is delimited by the secondary delimiter mentioned above, "|". the fields within an ACE are delimited by the third-level delimiter, ":", and consist of a SID, the ACE type (ALLOW, DENY, etc), a list of access rights, and a list of flags. the last two fields are delimited by the fourth-level delimiter " ". these final lists are simply human-readable interpretations of bits.

the access rights abbreviations are listed below along with their Microsoft-assigned names:

  • QRY_VAL — KEY_QUERY_VALUE
  • SET_VAL — KEY_SET_VALUE
  • CREATE_KEY — KEY_CREATE_SUB_KEY
  • ENUM_KEYS — KEY_ENUMERATE_SUB_KEYS
  • NOTIFY — KEY_NOTIFY
  • CREATE_LNK — KEY_CREATE_LINK
  • WOW64_64 — KEY_WOW64_64KEY
  • WOW64_32 — KEY_WOW64_32KEY
  • DELETE — DELETE
  • R_CONT — READ_CONTROL
  • W_DAC — WRITE_DAC
  • W_OWNER — WRITE_OWNER
  • SYNC — SYNCHRONIZE
  • SYS_SEC — ACCESS_SYSTEM_SECURITY
  • MAX_ALLWD — MAXIMUM_ALLOWED
  • GEN_A — GENERIC_ALL
  • GEN_X — GENERIC_EXECUTE
  • GEN_W — GENERIC_WRITE
  • GEN_R — GENERIC_READ

and the meaning of each flag is:

  • OI — Object Inherit
  • CI — Container Inherit
  • NP — Non-Propagate
  • IO — Inherit Only
  • IA — Inherited ACE

please see the following references for more information:

note that some of the bits listed above have either not been allocated by Microsoft, or simply aren't documented. if any bits are set in the above two fields that aren't recognized, a hexadecimal representation of all of these mystery bits will be included in the output. for instance, if the lowest bit and third lowest bit were not recognized while being set, the number "0x5" would be included as an element in the list. 🔍

while the ACL/ACE output format is mostly stable at this point, minor changes may be introduced in future versions.

✨ EXAMPLES ✨

to read and print the contents of an entire system registry file:

reglookup /mnt/win/c/WINNT/system32/config/system

to limit the output to just those entries under the Services key:

reglookup -p /ControlSet002/Services /mnt/win/c/WINNT/system32/config/system

to limit the output to all registry values of type BINARY:

reglookup -t BINARY /mnt/win/c/WINNT/system32/config/system

and to limit the output to BINARY values under the Services key:

reglookup -t BINARY -p /ControlSet002/Services /mnt/win/c/WINNT/system32/config/system

✨ BUGS ✨

this program has been smoke-tested against most current Windows target platforms, but a comprehensive test suite has not yet been developed. (please report results to the development mailing list if you encounter any bugs. sample registry files and/or patches are greatly appreciated.) 💀

the SID conversions haven't been carefully checked for accuracy.

the MTIME conversions appear correctly produce the stored UTC timestamp. however, due to the periodicity of registry writes, and the complexity of the conversion, a small amount of error (on the order of seconds) may be possible. the documentation available online from Microsoft on this field is very poor. 😭

for more information on registry format details, see: http://sentinelchicken.com/research/registry_format/

✨ CREDITS ✨

this program was initially based on editreg.c by Richard Sharpe. it has since been rewritten to use a modified version the regfio library written by Gerald Carter. heavy modifications to the library and the original command line interface have been done by Timothy D. Morgan.

please see source code for a full list of copyrights. 🫡

✨ LICENSE ✨

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details.

✨ SEE ALSO ✨

reglookup-timeline(1) reglookup-recover(1)

ok that's the whole page, bestie. go read some registry hives, you absolute icon. 🦋

and that's a wrap, superstar ✨ this came to you from the File Conversion Utilities, dated 10 October 2026, and it's reglookup(1) — stay curious, stay nerdy, periodt. 💖👑🌈

📦 where this page comes from