REGSHELL(1)

📦
version 4.24.7 · 19 versions
, in fedora 44, ubuntu noble

✨ REGSHELL(1) — the Windows registry browser that thinks it's a unix shell ✨

System Administration tools 🎀 aka the regshell glow-up, bestie

🌸 NAME 🌸

regshell — browse a Windows registry file using readline, like it's no big deal 💅

🦋 SYNOPSIS 🦋

regshell [--help] [--backend=BACKEND] [--credentials=CREDENTIALS]
         [location]

💖 DESCRIPTION 💖

okay so picture this: regshell is a lil utility that lets you browse thru a Windows registry file exactly like you'd use a regular unix shell to wander around a file system. same energy, different vibes. it's giving "cd but make it registry" 🫶

✨ OPTIONS ✨

  • --help — shows you the list of available options. the classic "help me bestie" move 🙈
  • --backend BACKEND — the name of the backend to load. possible values are: creg, regf, dir and rpc. the default is dir. pick your fighter ⭐
  • --credentials=CREDENTIALS — credentials to use, if any. the password should be separated from the user name by a percent sign. yes, a percent sign, no cap 💀

👑 COMMANDS 👑

  • ck|cd <keyname> — go to the specified subkey. it's a road trip 🚗
  • ch|predef [predefined-key-name] — go to the specified predefined key. teleportation era ✨
  • list|ls — list subkeys and values of the current key. show me what you got 👀
  • mkkey|mkdir <keyname> — create a key with the specified keyname as a subkey of the current key. making new friends 🎀
  • rmval|rm <valname> — delete the specified value. bye bestie 💅
  • rmkey|rmdir <keyname> — delete the specified subkey recursively. and everyone under it. whole family tree gone 🫢
  • pwd|pwk — print the full name of the current key. where am i 😭
  • set|update — update the value of a key value. not implemented at the moment, so don't get your hopes up ngl
  • help|? — print a list of available commands. the group chat's pinned message 📌
  • exit|quit — leave regshell. goodbye my love 🌈

🌈 EXAMPLES 🌈

🍓 Browsing thru a nt4 registry file

regshell -b nt4 NTUSER.DAT
$$$PROTO.HIV> ls
K AppEvents
K Console
K Control Panel
K Environment
K Identities
K Keyboard Layout
K Network
K Printers
K Software
K UNICODE Program Groups
K Windows 3.1 Migration Status
$$$PROTO.HIV> exit

🧚 Listing the subkeys of HKEY_CURRENT_USER\AppEvents on a remote computer:

regshell --remote=ncacn_np:aurelia -c "jelmer%secret"
HKEY_CURRENT_MACHINE> predef HKEY_CURRENT_USER
HKEY_CURRENT_USER> cd AppEvents
Current path is: HKEY_CURRENT_USER\AppEvents
HKEY_CURRENT_USER\AppEvents> ls
K EventLabels
K Schemes
HKEY_CURRENT_USER\AppEvents> exit

💜 VERSION 💜

this man page is correct for version 4.0 of the Samba suite. periodt. 📌

🌸 SEE ALSO 🌸

regtree, regdiff, regpatch, gregedit, samba

🎀 AUTHOR 🎀

this utility is part of the Samba[1] suite, which is developed by the global Samba Team[2]. iconic behavior honestly 👑

this manpage and regshell were written by Jelmer Vernooij. thank you for your service 🫶

📎 NOTES 📎

  1. Samba http://www.samba.org/
  2. Samba Team http://www.samba.org/samba/team/

Samba 4.0 · 09/09/2026 — that's the version and the date, and that's the whole vibe check, bestie. go browse some registry files, you absolute main character 💖🦋✨

📦 where this page comes from