Parse:...gistry(3pm)
✨ Parse::Win32Registry ✨
User Contributed Perl Documentation · Parse:...gistry(3pm) — yes bestie, that truncated name is literally just how the man page renders it, iykyk 💅
💖 NAME 💖
Parse::Win32Registry — ok so it parses Windows Registry Files. That's the whole vibe. 🎀
🌸 SYNOPSIS 🌸
Bestie, here's the whole thing, verbatim, no cap:
use strict;
use Parse::Win32Registry qw( :REG_
unpack_windows_time
unpack_unicode_string );
my $filename = shift or die "Filename?";
my $registry = Parse::Win32Registry->new($filename)
or die "'$filename' is not a registry file\n";
my $root_key = $registry->get_root_key
or die "Could not get root key of '$filename'\n";
# The following code works on USER.DAT or NTUSER.DAT files
my $software_key = $root_key->get_subkey(".DEFAULT\\Software")
|| $root_key->get_subkey("Software");
if (defined($software_key)) {
my @user_key_names = (
"Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",
"Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU",
);
foreach my $name (@user_key_names) {
if (my $key = $software_key->get_subkey($name)) {
print "\n", $key->as_string, "\n";
foreach my $value ($key->get_list_of_values) {
print $value->as_string, "\n";
}
}
}
# This demonstrates how you can deal with a binary value
# that contains a Unicode string
foreach my $ver (qw(8.0 9.0 10.0 11.0)) {
my $key_name = "Microsoft\\Office\\$ver\\Common\\UserInfo";
if (my $key = $software_key->get_subkey($key_name)) {
print "\n", $key->as_string, "\n";
my @value_names = qw(UserName UserInitials Company);
foreach my $value_name (@value_names) {
if (my $value = $key->get_value($value_name)) {
print $value->as_string, "\n";
my $data = $value->get_data;
my $string = unpack_unicode_string($data);
print "$value_name = '$string'\n";
}
}
}
}
}
# The following code works on SYSTEM.DAT or SOFTWARE files
my $software_key = $root_key->get_subkey("Software") || $root_key;
if (defined($software_key)) {
my @software_key_names = (
"Microsoft\\Windows\\CurrentVersion",
"Microsoft\\Windows NT\\CurrentVersion",
);
foreach my $name (@software_key_names) {
if (my $key = $software_key->get_subkey($name)) {
print "\n", $key->as_string, "\n";
foreach my $value ($key->get_list_of_values) {
print $value->as_string, "\n";
}
}
}
# This demonstrates how you can deal with a Unix date
# found in a registry value
my $key_name = "Microsoft\\Windows NT\\CurrentVersion";
if (my $curver_key = $software_key->get_subkey($key_name)) {
print "\n", $curver_key->as_string, "\n";
if (my $value = $curver_key->get_value("InstallDate")) {
print $value->as_string, "\n";
my $time = $value->get_data;
print "InstallDate = ",
scalar gmtime $time, " GMT\n";
print "InstallDate = ",
scalar localtime $time, " Local\n";
}
}
}
# The following code works on SYSTEM.DAT or SYSTEM files
my $system_key = $root_key->get_subkey("System") || $root_key;
my $ccs_name = "CurrentControlSet"; # default for Win95
if (my $key = $system_key->get_subkey("Select")) {
my $current_value = $key->get_value("Current");
$ccs_name = sprintf("ControlSet%03d", $current_value->get_data);
print "CurrentControlSet = $ccs_name\n";
}
my $ccs_key = $system_key->get_subkey($ccs_name);
if (defined($ccs_key)) {
my @system_key_names = (
"Control\\ComputerName\\ComputerName",
"Control\\TimeZoneInformation",
);
foreach my $name (@system_key_names) {
if (my $key = $ccs_key->get_subkey($name)) {
print "\n", $key->as_string, "\n";
foreach my $value ($key->get_list_of_values) {
print $value->as_string, "\n";
}
}
}
# This demonstrates how you can deal with a Windows date
# found in a registry value
my $key_name = "Control\\Windows";
if (my $windows_key = $ccs_key->get_subkey($key_name)) {
print "\n", $windows_key->as_string, "\n";
if (my $value = $windows_key->get_value("ShutdownTime")) {
print $value->as_string, "\n";
my $data = $value->get_data;
my $time = unpack_windows_time($data);
print "ShutdownTime = ",
scalar gmtime $time, " GMT\n";
print "ShutdownTime = ",
scalar localtime $time, " Local\n";
}
}
}🦋 DESCRIPTION 🦋
So Parse::Win32Registry is a module for parsing Windows Registry files — it lets you read the keys and values of a registry file without having to go through the Windows API at all. Iconic behaviour honestly. 👑
It gives you an object-oriented interface to the keys and values in a registry file. And registry files? They're structured as trees of keys, where each key contains further subkeys or values. Very demure, very tree-shaped. 🌳
The module is intended to be cross-platform, and it runs on those platforms where Perl will run. If Perl lives there, this lives there. Periodt.
It supports both:
- Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7)
- Windows 95 registry files (Windows 95, 98, Millennium Edition)
It's intended to be used to parse offline registry files.
⚠️ If a registry file is currently in use, you will not be able to open it. Sorry bestie, that's just the rules. But — plot twist — you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access. 🫶
💀 DEPENDENCIES 💀
Requires Perl 5.8.1. All required modules are standard modules. No extra installs, no drama, we love a low-maintenance moment. ✨
👑 METHODS 👑
Start by creating a Registry object from a valid registry file. Then use the Registry object's get_root_key method to obtain the root key of that registry file. That root key is your first Key object. From this key, you can explore the Key and Value objects that comprise the registry file using the methods described below. It's giving main character energy, one object at a time. 💅
Data is read directly from a registry file when a Key or Value object is created, and discarded when the Key or Value object is destroyed. This avoids any delay in parsing an entire registry file to obtain a Key or Value object — because most code only looks at a subset of the keys and values contained in a registry file. Efficient queen. 🧚
🎀 Registry Object Methods 🎀
$registry = Parse::Win32Registry->new( 'filename' )— Creates a new Registry object for the specified registry file. That's it, that's the birth of your registry journey. 🌸$registry->get_root_key— Returns the root Key object of the registry file.
🚨 Heads up: the root key of a registry file is not the same as one of the virtual roots of the registry (HKEY_LOCAL_MACHINE,HKEY_USERS, etc) that you might be familiar with from using tools such asREGEDIT.
The names of root keys vary by operating system and by file. For example, the name of the root key of a Windows XP NTUSER.DAT file is '$$$PROTO.HIV' and the name of the root key of a Windows 98 USER.DAT file is an empty string. Wild, right? 😭
$registry->get_virtual_root_key$registry->get_virtual_root_key( 'virtual root key name' )— Returns the virtual root Key object of the registry file.
In all respects this is exactly the same as the root Key object, except that it pretends to be a virtual root by simply faking its name. It guesses the virtual root key name by looking at the filename of the registry file. For example, if the filename contains 'SYSTEM' the virtual root key will be named 'HKEY_LOCAL_MACHINE\\SYSTEM'. If the guess fails (because the filename is not recognised) the virtual root key will be named 'HKEY_UNKNOWN'.
You can override the guess by supplying your own root key name. You can use this to pass in your preferred root key name. For example, you could pass the filename of the registry file in as the virtual root key name, which would then cause the filename to appear as part of each key's path. Customise your own destiny, bestie. ✨
$registry->get_timestamp— Returns the embedded timestamp for the registry file as a time value (the number of seconds since your computer's epoch) suitable for passing togmtimeorlocaltime.
Only Windows NT registry files have an embedded timestamp.
Returns nothing if the date is out of range or if called on a Windows 95 registry file. 🙈
$registry->get_timestamp_as_string— Returns the timestamp as a ISO 8601 string, for example,'2010-05-30T13:57:11Z'. TheZindicates that the time is GMT ('Zero Meridian').
Returns the string '(undefined)' if the date is out of range or if called on a Windows 95 registry file.
$registry->get_embedded_filename— Returns the embedded filename for the registry file.
Only Windows NT registry files have an embedded filename.
Returns nothing if called on a Windows 95 registry file.
$registry->get_filename— Returns the filename of the registry file. Simple, clean, no notes. 🎀$registry->get_length— Returns the length of the registry file. 📏
🌈 Key Object Methods 🌈
$key->get_name— Returns the name of the key. The root key of a Windows 95 based registry file does not have a name; this is returned as an empty string. Nameless icon behaviour. 💅$key->get_path— Returns the path to the key. This shows the all of the keys from the root key to the current key, joined by the path separator'\'.$key->get_subkey( 'key name' )— Returns a Key object for the specified subkey name. If a key with that name does not exist, nothing will be returned.
You can specify a path to a subkey by separating keys using the path separator '\'. Remember to quote any '\' characters with a preceding '\'. For example:
$key->get_subkey('Software\\Microsoft\\Windows')A path is always relative to the current key. It should start with the name of the first subkey in the path, not the current key. If any key in the path does not exist, nothing will be returned. Lowkey strict but fair. 🦋
$key->get_value( 'value name' )— Returns a Value object for the specified value name. If a value with that name does not exist, nothing will be returned.
...to be continued, bestie 💜
okay so quick vibe check on that default value real quick — the default value (which REGEDIT shows as '(Default)', iconic of it) literally does not have a name. You get at it by handing over an empty string, like $key->get_value(''); 💅
💖 $key->get_value_data( 'value name' )
Returns the data for whatever value name you pass in. If the value doesn't exist, or the value's data doesn't exist, you get nothing back. Periodt.
It's just a shortcut for grabbing a value's data without making a whole intermediate Value object first — no extra steps, no extra object, we're being efficient bestie ✨
So this:
my $value = $key->get_value('value name');
if (defined $value) {
my $data = $value->get_data;
if (defined $data) {
...process data...
}
}can just be replaced with:
my $data = $key->get_value_data('value name');
if (defined $data) {
...process data...
}slay, so much cleaner 🎀
💖 $key->get_list_of_subkeys
Hands you back a list of Key objects that are the subkeys of the current key. If the key has no subkeys? Empty list. That's it, that's the whole thing 🦋
💖 $key->get_list_of_values
Same energy but for values — a list of Value objects for the current key. No values means an empty list comes back. 🌸
💖 $key->get_timestamp
Returns the key's timestamp as a time value — that's the number of seconds since your computer's epoch — and it's ready to pass straight into gmtime or localtime. 👑
Only Windows NT registry keys have a timestamp, just so you know.
And it returns nothing if the date is out of range, or if you call it on a Windows 95 registry key. Ngl, 95 keys just don't have the range 💀
💖 $key->get_timestamp_as_string
Gives you the timestamp as an ISO 8601 string, like for example '2010-05-30T13:57:11Z'. That Z is telling you the time is GMT — aka 'Zero Meridian'. ⭐
Returns the string '(undefined)' if the date is out of range or if you call it on a Windows 95 registry key.
💖 $key->as_string
Returns the path of the key as a string. For Windows NT registry keys, the timestamp gets appended too. ✨
💖 $key->as_regedit_export
Returns the path of the key as a string, but formatted in the Windows Registry Editor Version 5.00 export format. The string gets terminated with a newline character. 🔥
If you use this alongside the get_virtual_root_key method of Registry objects, it should generate key paths that interoperate with the ones REGEDIT exports. iykyk 💅
💖 $key->get_parent
Returns a Key object for the parent of the current key. If the key doesn't have a valid parent key — which normally only happens for the root key — you get nothing back. 🙈
💖 $key->is_root
Returns true if this key is the root key. Short, sweet, main character energy 👑
💖 $key->get_class_name
Returns a string with the class name associated with a key. Lowkey only a very few Windows NT registry keys even have class names.
Returns nothing if the key has no class name, or if you call it on a Windows 95 registry key.
💖 $key->get_security
Returns a Security object holding the security info for the key. Only Windows NT registry keys have security information, no cap.
Returns nothing if you call it on a Windows 95 registry key. 😭
💖 $key->get_subkey_iterator
Returns an iterator for pulling the subkeys of the current key. Every time you call the iterator's get_next method, it hands you back a single Key object. Keys come one by one until you hit the end of the list, and then nothing comes back. 🦋
You use it like this:
my $subkey_iter = $key->get_subkey_iterator;
while (my $subkey = $subkey_iter->get_next) {
# do something with $subkey
...
}Heads up tho — it's usually simpler to just use $key->get_list_of_subkeys. The iterator flex is when you need to control how much processing you're doing at a time, like for programs that need to stay responsive to user actions. That's the whole point 💜
💖 $key->get_value_iterator
Same vibe, but for values. Iterator over the current key's values, and each get_next call returns a single Value object. Values come one by one until the end of the list, then nothing. 🌸
Like so:
my $value_iter = $key->get_value_iterator;
while (my $value = $value_iter->get_next) {
# do something with $value
...
}And again — usually simpler to just use $key->get_list_of_values. fr fr 🫶
💖 $key->get_subtree_iterator
Okay this one is the big one. Returns an iterator for the entire subtree of keys and values beginning at the current key. Each get_next call returns either a Key object, or a Key object and a Value object. Every value comes along with the key it belongs to. Keys or Key/Value pairs come one by one until the end of the list, and then nothing. 👑
Used like this:
my $subtree_iter = $key->get_subtree_iterator;
while (my ($key, $value) = $subtree_iter->get_next) {
if (defined $value) {
# do something with $key and $value
...
}
else {
# do something with $key
...
}
}Keys and values come back in this order:
root_key
root_key\key1
root_key\key1, value1
root_key\key1, value2
root_key\key1\key2
root_key\key1\key2, value3
root_key\key1\key2, value4If you use the iterator in scalar context, only Key objects come back.
my $subtree_iter = $key->get_subtree_iterator;
while (my $key = $subtree_iter->get_next) {
# do something with $key
...
}And keys come back in this order:
root_key
root_key\key1
root_key\key1\key2ngl, it might be simpler to just write a recursive function to process the keys and values:
sub traverse {
my $key = shift;
# do something with $key
...
foreach my $value ($key->get_list_of_values) {
# do something with $value
...
}
foreach my $subkey ($key->get_list_of_subkeys) {
# recursively process $key
traverse($subkey);
}
}
traverse($root_key);💖 $key->walk( \&callback )
Does a recursive descent through all the keys in the subtree starting with the calling key, and calls the callback function for every key it reaches. 🧚
The callback function gets passed the current key.
$key->walk( sub {
my $key = shift;
print $key->as_string, "\n";
} );
$key->walk( sub {
my $key = shift;
print $key->as_regedit_export;
foreach my $value ($key->get_list_of_values) {
print $value->as_regedit_export;
}
} );🎀 Value Object Methods 🎀
💜 $value->get_name
Returns the name of the value. In both Windows NT and Windows 95 based registry files you can get values without a name — and that comes back as an empty string. 💅
💜 $value->get_type
Returns the integer representing the type of the value — where 1 is a REG_SZ, 2 is a REG_EXPAND_SZ, etc. The constants for the value types can be imported from the Parse::Win32Registry module with:
use Parse::Win32Registry qw( :REG_ );💜 $value->get_type_as_string
Returns the type of the value as a string instead of an integer constant, which makes it way more suitable for printed output. ✨
💜 $value->get_data
Returns the data for the value. Okay here's the breakdown bestie, listen up:
REG_SZandREG_EXPAND_SZvalues come back as strings. String data gets converted from Unicode (UCS-2LE) for Windows NT based registry files. Any terminating null characters get removed. 🍓REG_MULTI_SZvalues come back as a list of strings when called in a list context, and as a string with each element separated by the list separator$"when called in a scalar context. (That list separator defaults to the space character. Seeperlvarfor more info.) String data gets converted from Unicode (UCS-2LE) for Windows NT based registry files.
# get REG_MULTI_SZ data as a string
my $data = $multi_sz_value->get_data;
# get REG_MULTI_SZ data as a list
my @data = $multi_sz_value->get_data;REG_DWORDvalues are unpacked and returned as unsigned integers. 🔢- All other types come back as packed binary strings. To pull data out of those packed binary strings you'll need Perl's
unpackfunction, or one of the provided support functions.
Nothing comes back if the data is invalid. 💀
💜 $value->get_data_as_string
Returns the data for a value, but making binary data safe for printed output. 🌈
REG_SZandREG_EXPAND_SZvalues come back directly fromget_data.REG_MULTI_SZvalues get their component strings prefixed by indices, so you can clearly see how many elements there are.REG_DWORDvalues come back as a hexadecimal number followed by its parenthesized decimal equivalent.- All other types of values come back as a string of hex octets.
'(invalid data)' comes back if the data is invalid (i.e. when get_data returns undef).
'(no data)' comes back if get_data returns an empty string. 🙈
💜 $value->get_raw_data
Returns the data for a value exactly as it was read from the registry, without the processing that get_data normally does. 🔥
It's meant for those rare occasions when you need to access binary data that's been inappropriately stored in a REG_SZ, REG_EXPAND_SZ, REG_MULTI_SZ, or REG_DWORD value.
💜 $value->as_string
Returns the name, type, and data for the value as a string, safe for printed output. ✨
'(Default)' gets used for the names of those values that don't have names.
💜 $value->as_regedit_export
Returns the name, type, and data for the value as a string, in the Windows Registry Editor Version 5.00 export format. The string contains line breaks to make sure no line is longer than 80 characters. Each line gets terminated with a newline character. 🎀
okay so the little quirk where values with no name just get an '@' slapped on as their name? that's the whole thing. it's giving placeholder energy but make it functional 💅
This should generate values interoperable with those exported by REGEDIT. no cap.
Security Object Methods 🔐
Okay bestie, so here's the tea: only Windows NT registry files have security info that controls who can access what registry keys. And the way it's stored is so extra — the security entries are scattered all through the registry file, totally separate from the keys they actually apply to. Which honestly sounds chaotic but it's intentional!! It lets the registry share security info between a huge number of keys without wasting space duplicating it. slay, honestly. 🎀
Security entries link to other security entries in a circular chain, each entry linking to the one that precedes it and the one that follows it. very round-robin, very girlboss.
$security->get_security_descriptor— Returns a Security Descriptor Object representing the security descriptor contained in the security information registry entry. 🫶$security->get_next— Returns the next security object.$security->get_previous— Returns the previous security object.$security->get_reference_count— Returns the reference count for the security object.
Security Descriptor Object Methods 👑
A Security Descriptor object represents a security descriptor which contains an owner SID, a primary group SID, a System ACL, and a Discretionary ACL. four components, main character lineup fr fr.
$security_descriptor->get_owner— Returns a SID Object containing the Owner SID. 💜$security_descriptor->get_group— Returns a SID Object containing the primary group SID.$security_descriptor->get_sacl— Returns an ACL Object containing the System ACL. The System ACL contains those ACEs used for auditing. Nothing will be returned if the security descriptor does not contain a System ACL. (so if it's not there, you get nothing, not a fake object, not a maybe — nothing. noted. 🙈)$security_descriptor->get_dacl— Returns an ACL Object containing the Discretionary ACL. The Discretionary ACL contains those ACEs used for access control. Nothing will be returned if the security descriptor does not contain a Discretionary ACL.$security_descriptor->as_stanza— Returns a multi-line string containing the security descriptor formatted for presentation. It will contain a line for the owner SID, the group SID, and each component ACE of the System ACL and the Discretionary ACL. Each line will be terminated by a newline character. ✨
ACL Object Methods 📋
An ACL object represents an Access Control List, which comprises a list of Access Control Entries. that's it, that's the vibe.
$acl->get_list_of_aces— Returns a list of ACE Objects representing the ACEs in the order they appear in the ACL. If the ACL contains no ACEs, nothing will be returned. 💀$acl->as_stanza— Returns a multi-line string containing the ACL formatted for presentation. It will contain a line for each component ACE of the ACL. Each line will be terminated by a newline character.
ACE Object Methods 🦋
An ACE object represents an Access Control Entry. An ACE describes the permissions assigned (the access mask) to a Security Identifier (the trustee). tiny little permission receipt, lowkey iconic.
$ace->get_type— Returns an integer containing the ACE type, where0indicates anACCESS_ALLOWEDACE,1anACCESS_DENIEDACE, and2aSYSTEM_AUDITACE. Typically you will encounterACCESS_ALLOWEDandACCESS_DENIEDACEs in Discretionary ACLs andSYSTEM_AUDITACEs in System ACLs. 🧠$ace->get_type_as_string— Returns the type as a string, rather than integer.$ace->get_flags— Returns an integer containing the ACE flags.$ace->get_access_mask— Returns an integer containing the ACE access mask. The access mask controls what actions the trustee might perform with the object the ACE applies to. 🔥$ace->get_trustee— Returns a SID Object containing the trustee that this ACE is associated with.$ace->as_string— Returns a string containing the ACE formatted for presentation.
SID Object Methods 🆔
A SID object represents a Security Identifier. yes, like S-1-5-..., you know the one.
$sid->get_name— Returns a string containing a name for the SID (e.g."Administrators"forS-1-5-32-544) if it is a "well known" SID. See Microsoft Knowledge Base ArticleKB243330. 📚$sid->as_string— Returns a string containing the SID formatted for presentation.
✨ EXPORTS ✨
Constants 🎀
On request, Parse::Win32Registry will export the registry type constants:
use Parse::Win32Registry qw( :REG_ );The :REG_ tag exports all of the following constants:
REG_NONE
REG_SZ
REG_EXPAND_SZ
REG_BINARY
REG_DWORD
REG_DWORD_BIG_ENDIAN
REG_LINK
REG_MULTI_SZ
REG_RESOURCE_LIST
REG_FULL_RESOURCE_DESCRIPTOR
REG_RESOURCE_REQUIREMENTS_LIST
REG_QWORDYou can import individual types by specifying them, for example:
use Parse::Win32Registry qw( REG_SZ REG_DWORD );💖 SUPPORT FUNCTIONS 💖
Parse::Win32Registry provides a number of support functions, which are exported on request. All of the support functions can be imported with:
use Parse::Win32Registry qw( :functions );Unpacking Binary Data 📦
There are a number of functions for assisting in unpacking binary data found in registry values. These functions are exported on request:
use Parse::Win32Registry qw( unpack_windows_time
unpack_unicode_string
unpack_sid
unpack_ace
unpack_acl
unpack_security_descriptor );These unpack functions also return the length of the packed object when called in a list context. (iykyk — this is the move that makes looping through a big blob actually work 🫶)
For example, to extract one SID:
my $sid = unpack_sid($data);To extract a series of SIDs:
my $pos = 0;
while ($pos < length($data)) {
my ($sid, $packed_len) = unpack_sid(substr($data, $pos));
last if !defined $sid; # abort if SID not defined
# ...do something with $sid...
$pos += $packed_len; # move past the packed SID
}$time = unpack_windows_time( $data )/( $time, $packed_len ) = unpack_windows_time( $data )— Returns the epoch time for the Win32FILETIMEcontained in the supplied binary data. A Win32FILETIMEis a 64-bit integer containing the number of 100-nanosecond intervals since January 1st, 1601 and can sometimes be found in Windows NT registry values.
Returns nothing if the date is earlier than your computer's epoch. The epoch begins at January 1st, 1970 on Unix and Windows machines. 😭
When called in a list context, it will also return the space used in the supplied data by the windows time.
(This function can also be called by its previous name of convert_filetime_to_epoch_time.) ⭐
$str = unpack_unicode_string( $data )/( $str, $packed_len ) = unpack_unicode_string( $data )— Extracts a Unicode (UCS-2LE) string from the supplied binary data. Any terminating null characters are dropped. Unicode (UCS-2LE) strings are sometimes encountered in Windows NT registryREG_BINARYvalues.
Note that Unicode strings contained inREG_SZ,REG_EXPAND_SZ, andREG_MULTI_SZvalues are already automatically decoded by theget_datamethod of a Value object. so don't double-decode bestie, that's the trap 🙈
When called in a list context, it will also return the space used in the supplied data by the Unicode string.
$sid = unpack_sid( $data )/( $sid, $packed_len) = unpack_sid( $data )— Returns a SID Object representing the SID contained in the supplied data. Returns nothing if the supplied data does not appear to contain a valid SID.
When called in a list context, it will also return the space used in the supplied data by the SID.
$ace = unpack_ace( $data )/( $ace, $packed_len ) = unpack_ace( $data )— Returns an ACE Object representing the ACE contained in the supplied data. Returns nothing if the supplied data does not appear to contain a valid ACE.
When called in a list context, it will also return the space used in the supplied data by the ACE.
$acl = unpack_acl( $data )/( $acl, $packed_len ) = unpack_acl( $data )— Returns an ACL Object representing the ACL contained in the supplied data. Returns nothing if the supplied data does not appear to contain a valid ACL.
When called in a list context, it will also return the space used in the supplied data by the ACL.
$sd = unpack_security_descriptor( $data )/( $sd, $packed_len ) = unpack_security_descriptor( $data )— Returns a Security Descriptor Object representing the security descriptor contained in the supplied data. Returns nothing if the supplied data does not appear to contain a valid security descriptor.
When called in a list context, it will also return the space used in the supplied data by the security descriptor.
Formatting Data 🎨
These functions are exported on request:
use Parse::Win32Registry qw( iso8601 hexdump );$str = iso8601( $epoch_time )— Returns the ISO8601 string for the supplied$epoch_time, for example,'2010-05-30T13:57:11Z'. It assumes the supplied$epoch_timeis in UTC, and appends'Z'to indicate this. 🌈
The string '(undefined)' will be returned if the epoch time is out of range.
my $data = $reg_binary_value->get_data;
# extract the Win32 FILETIME starting at the 9th byte of $data
my $time = unpack_windows_time( substr( $data, 8 ) );
my $time_as_string = iso8601( $time );
print "$time_as_string\n";There are a number of ways of displaying a timestamp. For example:
use Parse::Win32Registry qw(iso8601);
use POSIX qw(strftime);
print iso8601($key->get_timestamp);
print scalar(gmtime($key->get_timestamp)), " GMT\n";
print scalar(localtime($key->get_timestamp)), " Local\n";
print strftime("%Y-%m-%d %H:%M:%S GMT",
gmtime($key->get_timestamp)), "\n";
print strftime("%Y-%m-%d %H:%M:%S Local",
localtime($key->get_timestamp)), "\n";...might produce the following output:
2000-08-06T23:42:36Z
Sun Aug 6 23:42:36 2000 GMT
Mon Aug 7 07:42:36 2000 Local
2000-08-06 23:42:36 GMT
2000-08-07 07:42:36 Local$str = hexdump( $data )— Returns a multi-line string containing a hexadecimal dump of the supplied data. Each line will display 16 bytes in hexadecimal and ASCII, and will be terminated by a newline character. 💅
🦋 Processing Multiple Registry Files Simultaneously 🦋
Okay bestie, this is the part where we get ✨ambitious✨. There are three support functions that build iterators so you can chew through the keys and values of multiple registry files at the same time. They're exported on request, like:
use Parse::Win32Registry qw( make_multiple_subkey_iterator
make_multiple_value_iterator
make_multiple_subtree_iterator );Now listen, handling lists of subkeys or values needs a little bit of care, because some of those registry files you're processing might not even contain the subkey or value you're looking at, and the list will just have holes in it, like:
($key1, $key2, undef, $key4)One way to deal with this is to use map to check that a key is defined and hand back undef if the subkey or value isn't there:
@subkeys = map { defined $_ && $_->get_subkey('subkey') || undef } @keys;
@values = map { defined $_ && $_->get_value('value') || undef } @keys;💅 $iter = make_multiple_subkey_iterator( $key1, $key2, $key3, ... )
Returns an iterator for grabbing the subkeys of the Key objects you handed it. Every single time you call the get_next method on that iterator, you get back a reference to a list of Key objects that all share the same name and path. And if any of the supplied Key objects doesn't have a subkey with that name? Then that subkey is just undef. No drama, just vibes.
my $subkey_iter = make_multiple_subkey_iterator($key1, $key2, ...);
while (my ($subkey1, $subkey2, ...) = $subkey_iter->get_next) {
...
}
my $subkey_iter = make_multiple_subkey_iterator($key1, $key2, ...);
while (my @subkeys = $subkey_iter->get_next) {
foreach my $subkey (@subkeys) {
if (defined $subkey) {
...
}
}
}🫶 $iter = make_multiple_value_iterator( $key1, $key2, $key3, ... )
Returns an iterator for grabbing the values of the Key objects you supplied. Each call to get_next gives you back a reference to a list of Value objects that share the same name. And if any of the supplied Key objects is missing a value with that name, that value comes back undef. Same energy as before, different objects.
my $value_iter = make_multiple_value_iterator($key1, $key2, ...);
while (my ($value1, $value2, ...) = $value_iter->get_next) {
...
}🌸 $iter = make_multiple_subtree_iterator( $key1, $key2, $key3, ... )
Returns an iterator for grabbing the immediate subkeys and all the descendant subkeys of the Key objects you supplied. Each call to get_next returns a list of Key objects sharing the same name and path. If any of the supplied Key objects doesn't have a subkey with that name, that subkey will be undef, bestie. It's giving consistent.
Now for the plot twist: each call to the get_next method returns either a reference to a list of Key objects, or a reference to a list of Key objects plus a reference to a list of Value objects — with each list of values tagging along with the list of keys they belong to. And when you hit the end of the list, nothing comes back. That's the signal, periodt.
my $subtree_iter = make_multiple_subtree_iterator($key1, $key2, ...);
while (my $subkeys_ref = $tree_iter->get_next) {
# do something with @$subkeys_ref
}
my $subtree_iter = make_multiple_subtree_iterator($key1, $key2, ...);
while (my ($subkeys_ref, $values_ref) = $tree_iter->get_next) {
if (defined $values_ref) {
# do something with @$subkeys_ref and @$values_ref
for (my $i = 0; $i < @$values_ref; $i++) {
print $values_ref->[$i]->as_string, "\n";
}
...
}
else {
# do something with @$subkeys_ref
my $first_defined_subkey = (grep { defined } @$subkeys_ref)[0];
print $first_defined_subkey->as_string, "\n";
...
}
}💖 Comparing Keys and Values 💖
These functions are exported on request too, obviously:
use Parse::Win32Registry qw( compare_multiple_keys
compare_multiple_values );🔥 @changes = compare_multiple_keys( $key1, $key2, ... );
Returns a list of strings describing the differences it found between the keys you gave it. The keys get compared in the order you supplied them. And if one of the supplied keys is undef, it's assumed to have been deleted. 💀
The possible changes are 'ADDED', and 'DELETED', and — for Windows NT registry keys, which are the ones with timestamps — 'NEWER', and 'OLDER'.
For example, compare_multiple_keys($k1, $k2, $k3) would return the list ('', 'NEWER', '') if $k2 had a more recent timestamp than $k1, but $k3 had the same timestamp as $k2. See how the empty strings are just "no change here"? Love that for us.
You can count the number of changed keys using the grep operator:
my $num_changes = grep { $_ } @changes;🌈 @changes = compare_multiple_values( $value1, $value2, ... );
Returns a list of strings describing the differences it found between the values you gave it. The values are compared in the order you supplied them. And if one of the supplied values is undef, it's assumed to have been deleted. Same deal.
The possible changes are 'ADDED', 'DELETED', and 'CHANGED'.
For example, compare_multiple_keys($v1, $v2, $v3) would return the list ('', 'ADDED', 'CHANGED') if $v2 exists but $v1 did not, and $v3 had different data from $v2.
You can count the number of changed values using the grep operator:
my $num_changes = grep { $_ } @changes;🙈 HANDLING INVALID DATA 🙈
Okay so sometimes the data is just... not it. Here's how the module copes.
The Parse::Win32Registry module will skip keys or values that can't be successfully parsed. Not a crash, not a meltdown, just a skip.
If keys or values can't be parsed, then the get_subkey and get_value methods of Key objects will return nothing.
The get_list_of_subkeys and get_list_of_values methods of Key objects will skip those keys or values that can't be parsed. And if none of the keys or values can be parsed successfully? You get an empty list back. That's it, that's the whole response.
On top of that, values in Windows NT registry files often store their data in a separate area of the registry file. So if the value can be parsed but the data can't, a Value object will still be created — but it will have no data. The get_data method will return nothing. Rude, but honest.
The most robust way of handling keys or values or data is therefore to check that they're defined before processing them. Like, always. No cap.
For example:
my $key = $root_key->get_subkey( "Software\\Perl" );
if ( defined $key ) {
print $key->as_string, "\n";
my $value = $key->get_value( "Version" );
if ( defined $value ) {
print $value->as_string, "\n";
my $data = $value->get_data;
if ( defined $data ) {
# process $data in some way...
}
}
}You might not feel this robustness is necessary for your scripts. Totally valid, it's your life. 🫶
But if you do want to be alerted when there are problems parsing registry keys or values, you can switch on warnings with:
Parse::Win32Registry->enable_warnings;And they can be switched off again with:
Parse::Win32Registry->disable_warnings;✨ LOW-LEVEL METHODS ✨
okay bestie, these methods are for the girlies who wanna peek at the structure of a registry file but with something way more helpful than a hex editor. They are not designed for pulling data out of keys and values — they're designed to make it easier to look at the underlying components of a registry file. periodt. 💅
Windows NT registry files are composed of one or more Hbin blocks. Hbin blocks can contain a series of entries, such as key, value, and security entries, but also includes subkey lists, value lists, key class names, and value data. slay. ✨
Windows 95 registry files are composed of an RGKN block, followed by one or more RGDB blocks. RGKN blocks contain the entries which link the registry keys in the form of a tree. RGDB blocks contain a corresponding entry for each key in the RGKN block. This RGDB entry includes the name of the key and any associated values. For convenience, when iterating the entries in an RGDB block, each will be returned as a key entry followed by zero or more value entries. iconic. 🎀
To see demonstrations of how these methods can be used, look at the regscan.pl, gtkregscope.pl, and wxregscope.pl scripts. no cap. 🔥
💖 Registry Object Methods 💖
$registry->get_block_iterator
Returns an iterator for retrieving all the blocks in a registry file. Each time the get_next method of the iterator is used, it will return a single Block object. Blocks will be returned one by one until the end of the registry file is reached, when nothing will be returned. 💫
Typically you would iterate over all the blocks in a registry file, and iterate over all the entries in each block:
my $block_iter = $registry->get_block_iterator;
while (my $block = $block_iter->get_next) {
my $entry_iter = $block->get_entry_iterator;
while (my $entry = $entry_iter->get_next) {
...
}
}$registry->get_entry_iterator
Returns an iterator for retrieving all the entries in a registry file. Each time the get_next method of the iterator is used, it will return a single Entry object. Entries will be returned one by one until the end of the registry file is reached, when nothing will be returned. 💖
This is simply a more convenient method for retrieving all the entries in a registry file, which does not require you to iterate over each block. iykyk. ✨
🌸 Block Object Methods 🌸
$block->get_entry_iterator
Returns an iterator for retrieving all the entries in a block. Each time the get_next method of the iterator is used, it will return a single Entry object. Entries will be returned one by one until the end of the block is reached, when nothing will be returned. 🦋
my $entry_iter = $block->get_entry_iterator;
while (my $entry = $entry_iter->get_next) {
...
}$block->get_offset
Returns the position of the block relative to the start of the file. 📍
$block->get_length
Returns the length of the block. 📏
$block->parse_info
Returns a string containing a summary of the parser information for the block. 🧾
$block->unparsed
Returns a string containing a hex dump of the unparsed on-disk data for the block header. 🔍
$block->get_raw_bytes
Returns the unparsed on-disk data for the block header. 💾
💜 Entry Object Methods 💜
In addition to the basic methods provided by all entries, if an entry is a key, value, or security entry, it will also provide the methods available to Key, Value, or Security objects. You might therefore find it useful to check what methods are available so that you can use them:
# use Entry object methods...
...
if ($entry->can('get_subkey')) {
# use Key object methods...
}
elsif ($entry->can('get_data')) {
# use Value object methods...
}
elsif ($entry->can('get_security_descriptor')) {
# use Security object methods...
}$entry->get_offset
Returns the position of the entry relative to the start of the file. 📍
$entry->get_length
Returns the length of the entry. 📏
$entry->get_tag
Returns a string containing a descriptive tag for the entry. 🏷️
For Windows NT registry entries, the tags reflect the signatures used to identify them. These are: 'nk' for keys; 'vk' for values; 'sk' for security entries; and 'lf', 'lh', 'li', or 'ri' for subkey lists. Entries that do not have signatures will return an empty string. Unidentified entries include value lists, value data, and the class names of keys. 💀
For Windows 95 registry files, the tag reflects which part of the registry file the entry is from, and will be 'rgkn key', 'rgdb key', or 'rgdb value'. 🌈
$entry->is_allocated
Returns a boolean value indicating the 'allocated' state of a Windows NT registry entry. ✅
This value has no meaning for Windows 95 registry entries. 🙈
$entry->as_string
Returns a string representation of the entry. 📝
If the entry is a valid Key, Value, or Security object, then as_string will call the as_string method of that object. 🎯
$entry->parse_info
Returns a string containing a summary of the parser information for that entry. 🧾
If the entry is a valid Key, Value, or Security object, then parse_info will call the parse_info method of that object. 💅
$entry->unparsed
Returns a string containing a hex dump of the unparsed on-disk data for the entry. 🔍
$entry->get_raw_bytes
Returns the unparsed on-disk data for the entry. 💾
✨ SCRIPTS ✨
Okay bestie, gather round 💖 Every single one of these scripts? Tools. Examples. Little DIY starters for you to remix, modify, and develop into your own thing. No cap.
Wanna peek at a registry file from the command line? Try regdump.pl or regshell.pl. Wanna be all GUI about it? gtkregview.pl or wxregview.pl have you covered, periodt. If you want to compare registry files, try regmultidiff.pl from the command line or gtkregcompare.pl or wxregcompare.pl if you want a GUI. You can edit the scripts to customize them for your own requirements — make them yours, slay.
If you specify subkeys on the command line, note that you need to quote the subkey on Windows if it contains spaces:
regdump.pl ntuser.dat "software\microsoft\windows nt"You will also need to quote backslashes and spaces in Unix shells:
regdump.pl ntuser.dat software\\microsoft\\windows\ ntor use single quotes:
regdump.pl ntuser.dat 'software\microsoft\windows nt'🎀 gtkregcompare.pl 🎀
gtkregcompare.pl is a GTK+ program for comparing multiple registry files. It displays a tree of the registry keys and values highlighting those that have changed. It's giving diff but make it GUI ✨
It requires Gtk2-Perl to be installed.
Filenames of registry files to compare can be supplied on the command line:
gtkregcompare.pl <filename1> <filename2> <filename3> ...You can of course use wildcards when running from a Unix shell.
🌸 gtkregscope.pl 🌸
gtkregscope.pl is a GTK+ registry scanner. It presents all the entries in a registry file returned by the get_block_iterator and get_entry_iterator methods. It uses color to highlight key, value, security, and subkey list entries, and presents the block as a colored map. Aesthetic and informative? We love to see it 💅
It requires Gtk2-Perl to be installed.
A filename can also be supplied on the command line:
gtkregscope.pl <filename>🦋 gtkregview.pl 🦋
gtkregview.pl is a GTK+ registry viewer. It displays a tree of registry keys on the left hand side, a list of values on the right, and a hex dump of the selected value data at the bottom. Layout queen 👑
It requires Gtk2-Perl to be installed.
A filename can also be supplied on the command line:
gtkregview.pl <filename>💜 regclassnames.pl 💜
regclassnames.pl will display registry keys that have class names. Only a very few Windows NT registry key have class names. (Yes, "key" singular in the original, we're keeping it exactly, bestie.)
Type regclassnames.pl on its own to see the help:
regclassnames.pl <filename> [subkey]🔥 regdump.pl 🔥
regdump.pl is used to display the keys and values of a registry file. Main character of CLI registry peeking, fr fr.
Type regdump.pl on its own to see the help:
regdump.pl <filename> [subkey] [-r] [-v] [-x] [-c] [-s] [-o]Options, bestie:
-r,--recurse— traverse all child keys from the root key or the subkey specified-v,--values— display values-x,--hexdump— display value data as a hex dump-c,--class-name— display the class name for the key (if present)-s,--security— display the security information for the key, including the owner and group SIDs, and the system and discretionary ACLs (if present)-o,--owner— display the owner SID for the key (if present)
The contents of the root key will be displayed unless a subkey is specified. Paths to subkeys are always specified relative to the root key. By default, only the subkeys and values immediately underneath the specified key will be displayed. To display all keys and values beneath a key, use the -r or --recurse option.
For example, regdump.pl ntuser.dat might display the following:
$$$PROTO.HIV [2005-01-01T09:00:00Z]
..\AppEvents
..\Console
..\Control Panel
..\Environment
..\Identities
..\Keyboard Layout
..\Printers
..\Software
..\UNICODE Program GroupsFrom here, you can explore the subkeys to find those keys or values you are interested in:
regdump.pl ntuser.dat software
regdump.pl ntuser.dat software\microsoft
...🌈 regexport.pl 🌈
regexport.pl will display registry keys and values in the Windows Registry Editor Version 5.00 format used by REGEDIT on Windows 2000 and later. It's giving export realness.
Type regexport.pl on its own to see the help:
regexport.pl <filename> [subkey] [-r]Options:
-r,--recurse— traverse all child keys from the root key or the subkey specified
Values are always shown for each key displayed.
Subkeys are displayed as comments when not recursing. (Comments are preceded by the ; character.)
🍓 regfind.pl 🍓
regfind.pl is used to search the keys, values, data, or types of a registry file for a matching string. Detective energy 🔍
Type regfind.pl on its own to see the help:
regfind.pl <filename> <search-string> [-k] [-v] [-d] [-t] [-x]Options:
-k,--key— search key names for a match-v,--value— search value names for a match-d,--data— search value data for a match-t,--type— search value types for a match-x,--hexdump— display value data as a hex dump
To search for the string "recent" in the names of any keys or values:
regfind.pl ntuser.dat recent -kvTo search for the string "administrator" in the data of any values:
regfind.pl ntuser.dat administrator -dTo list all REG_MULTI_SZ values:
regfind.pl ntuser.dat -t multi_szSearch strings are not case-sensitive.
🧚 regml.pl 🧚
regml.pl will display those keys with explicit System Mandatory Label ACEs set in the System ACL. This feature was introduced with Windows Vista, and is used by applications such as Internet Explorer running in Protected Mode. Note that if a key does not have an explicit System Mandatory Label ACE, it has Medium Integrity Level. Only Windows NT registry files can contain System Mandatory Label ACEs.
Type regml.pl on its own to see the help:
regml.pl <filename>💖 regmultidiff.pl 💖
regmultidiff.pl can be used to compare multiple registry files and identify the differences between them. Multitasking queen.
Type regmultidiff.pl on its own to see the help:
regmultidiff.pl <file1> <file2> <file3> ... [<subkey>] [-v] [-x] [-l] [-a]Options:
-v,--values— display values-x,--hexdump— display value data as a hex dump-l,--long— show each changed key or value instead of a summary-a,--all— show all keys and values before and after a change
You can limit the comparison by specifying an initial subkey.
👑 regscan.pl 👑
regscan.pl dumps all the entries in a registry file. This will include defunct keys and values that are no longer part of the current active registry. Ghosts of registry past, literally 💀
Type regscan.pl on its own to see the help:
regscan.pl <filename> [-k] [-v] [-s] [-a] [-p] [-u] [-w]Options:
-k,--keys— list only'key'entries-v,--values— list only'value'entries-s,--security— list only'security'entries-a,--allocated— list only'allocated'entries-p,--parse-info— show the technical information for an entry instead of the string representation-u,--unparsed— show the unparsed on-disk entries as a hex dump
Also [-w] is in the synopsis, but the help text doesn't describe it. Not me noticing. 🙈
💅 regsecurity.pl 💅
regsecurity.pl will display the security information contained in a registry files. Only Windows NT registry files contain security information. (And yes, "files" plural after "a" — we're keeping the original wording, no cap.)
Type regsecurity.pl on its own to see the help:
regsecurity.pl <filename>🐚 regshell.pl 🐚
Provides an interactive command shell where you navigate through the keys using cd to change the current key and ls or dir to list the contents of the current key. It's giving terminal slay.
Tab completion of subkey and value names is available. Names containing spaces are supported by quoting names with " characters. Note that names are case sensitive.
A filename should be supplied on the command line:
regshell.pl <filename>Once regshell.pl is running, type help to see the available commands.
It requires Term::ReadLine to be installed.
⭐ regstats.pl ⭐
regstats.pl counts the number of keys and values in a registry file. It will also provide a count of each value type if requested. Math era.
Type regstats.pl on its own to see the help:
regstats.pl <filename> [-t]Options:
-t,--types— count value types
🕰️ regtimeline.pl 🕰️
regtimeline.pl displays keys and values in date order. Timeline core.
As only Windows NT based registry keys provide timestamps, this script only works on Windows NT registry files.
You can limit the display to a given number of days (counting back from the timestamp of the last key).
Type regtimeline.pl on its own to see the help:
regtimeline.pl <filename> [subkey] [-l <number>] [-v] [-x]Options:
-l,--last— display only the last<number>days of registry activity-v,--values— display values-x,--hexdump— display value data as a hex dump
🌳 regtree.pl 🌳
regtree.pl simply displays the registry as an indented tree, optionally displaying the values of each key. Tree vibes, obviously.
Type regtree.pl on its own to see the help:
regtree.pl <filename> [subkey] [-v]Options:
-v,--values— display values
💜 wxregcompare.pl 💜
wxregcompare.pl is a wxWidgets program for comparing multiple registry files. It displays a tree of the registry keys and values, highlighting those that have changed.
It requires wxPerl to be installed.
Filenames of registry files to compare can be supplied on the command line:
wxregcompare.pl <filename1> <filename2> <filename3> ...You can of course use wildcards when running from a Unix shell.
🌸 wxregscope.pl 🌸
wxregscope.pl is a wxWidgets registry scanner. It presents all the entries in a registry file returned by the get_block_iterator and get_entry_iterator methods. It uses color to highlight key, value, security, and subkey list entries.
It requires wxPerl to be installed.
A filename can also be supplied on the command line:
wxregscope.pl <filename>🦋 wxregview.pl 🦋
wxregview.pl is a wxWidgets registry viewer. It displays a tree of registry keys on the left hand side, a list of values on the right, and a hex dump of the selected value data at the bottom. It can also provide a timeline view of all of the registry keys, which can be used to navigate the main tree view by clicking or double-clicking on a timeline key.
It requires wxPerl to be installed.
A filename can also be supplied on the command line:
wxregview.pl <filename>🌟 ACKNOWLEDGEMENTS 🌟
This would not have been possible without the work of those people who have analysed and shared their knowledge of the structure of Windows Registry files, primarily: B.D. (WinReg.txt), Petter Nordahl-Hagen (chntpw), and Richard Sharpe and Jerry Carter (Samba 3). Legends, all of them. 🫶
👑 AUTHOR 👑
James Macfarlane, <jmacfarla@cpan.org>
💖 COPYRIGHT AND LICENSE 💖
okay bestie, final section, the legal era, the paperwork portion of the vibe check 🎀 this is the part everyone skips and honestly? valid. but it's short so let's just hold hands and get through it together 🫶
The copyright on this whole thing belongs to James Macfarlane, and the years are 2006-2012. Like, that's the run. That's the whole window. Copyright (C) 2006-2012 by James Macfarlane. Periodt ✨
Copyright (C) 2006-2012 by James Macfarlane🌸 So what can you actually do with it? 🌸
This library is free software 💅 which means you can:
- redistribute it — hand it out, share it, pass it around like the good word
- modify it — change stuff, remix it, make it yours
- and you do all of that under the same terms as Perl itself
That's it. That's the license. Same terms as Perl itself, no cap. 🐪✨
💀 The scary part (it's always the scary part) 💀
Bestie. Listen. Every single one of these licenses has a paragraph in ALL CAPS and this one is no different, and it is extremely loud on purpose. It is not yelling at you specifically, it is just how lawyers scream into the void. Here it is, exactly as it stands:
THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
Translation for the group chat: there is no warranty. none. zero. nada. Not an express one, not an implied one, and specifically not the implied warranties of merchantibility or fitness for a particular purpose. If it breaks, it breaks, and that's a you-and-your-perl situation 🙈
(Also yes, it says "MERCHANTIBILITY" and not "MERCHANTABILITY" — that's the original text, character for character, and we do not touch the legal text, we respect the legal text 👑)
🦋 that's the whole page, bestie 🦋
You made it. All seven parts. The registry has been Parsed, the low-level methods have been witnessed, the invalid data has been handled (gracefully, I hope 😭), and you are now officially someone who read the whole manpage instead of skimming the SYNOPSIS and guessing. Main character energy, fr fr ⭐
This gorgeous little document comes to you as part of perl v5.36.0, dated 2022-11-19, and its manpage name is Parse:...gistry(3pm) — go forth, perldoc responsibly, and remember: read the warnings, keep the caveats, and never trust a function that doesn't return what it promised 💜🧚🍓
bye bestie, slay, periodt 💖✨🎀
📦 where this page comes from
- debian bookworm: libparse-win32registry-perl 1.1-2 · Artistic-1.0-Perl OR GPL-1.0-or-later
- debian trixie: libparse-win32registry-perl 1.1-2 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu noble: libparse-win32registry-perl 1.1-2 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu resolute: libparse-win32registry-perl 1.1-2 · Artistic-1.0-Perl OR GPL-1.0-or-later
- ubuntu stonking: libparse-win32registry-perl 1.1-2 · Artistic-1.0-Perl OR GPL-1.0-or-later
- 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms