Python interface to the regfi library.
◆ getVersion()
def pyregfi.getVersion |
( |
| ) |
|
Returns the (py)regfi library version.
- Returns
- A string indicating the version
◆ getLogMessages()
def pyregfi.getLogMessages |
( |
| ) |
|
Retrieves messages produced by regfi during parsing and interpretation.
The regfi C library may generate log messages stored in a special thread-safe global data structure. These messages should be retrieved periodically or after each major operation by callers to determine if any errors or warnings should be reported to the user. Failure to retrieve these could result in excessive memory consumption.
Referenced by pyregfi.Hive.__init__(), and pyregfi.HiveIterator.descend().
◆ setLogMask()
def pyregfi.setLogMask |
( |
|
log_types | ) |
|
Sets the types of log messages to record.
- Parameters
-
log_types | A sequence of message types that regfi should generate. Message types can be found in the LOG_TYPES enumeration. |
- Returns
- True on success, False on failure. Failures are rare, but could indicate that global logging is not operating as expected.
Example:
setLogMask((LOG_TYPES.ERROR, LOG_TYPES.WARN, LOG_TYPES.INFO))
The message mask is a global (all hives, iterators), thread-specific value. For more information, see regfi_log_set_mask.
◆ openHive()
def pyregfi.openHive |
( |
|
path | ) |
|
Opens a file as a registry hive.
- Parameters
-
path | The file path of a hive, as one would provide to the open() built-in |
- Returns
- A new Hive instance
Definition: structures.py:62
def find_value(self, name)
Selects the first value which has the specified name.
Definition: __init__.py:1054
def current_path(self)
Obtains the current path of the iterator.
Definition: __init__.py:1134
Definition: structures.py:202
def up(self)
Causes the iterator to ascend to the current Key's parent.
Definition: __init__.py:976
def fetch_classname(self)
Retrieves the class name for this key.
Definition: __init__.py:579
A Microsoft security descriptor For more information, see: http://msdn.microsoft.com/en-us/library/aa...
Definition: winsec.py:160
def current_key(self)
Retrieves the current key.
Definition: __init__.py:1085
_length
Definition: __init__.py:358
Definition: structures.py:74
def prev_security(self)
Loads the "previous" Security record in the hive.
Definition: __init__.py:348
def next_subkey(self)
Selects the next subkey in the current Key's list.
Definition: __init__.py:1013
def fetch_data(self)
Retrieves the Value's data according to advertised type.
Definition: __init__.py:664
def fetch_raw_data(self)
Retrieves raw representation of Value's data.
Definition: __init__.py:699
Definition: structures.py:65
descriptor
The winsec.SecurityDescriptor for this SK record.
Definition: __init__.py:325
def ancestry(self)
Obtains a list of the current key's ancestry.
Definition: __init__.py:1112
_constructor
Definition: __init__.py:365
def next_security(self)
Loads the "next" Security record in the hive.
Definition: __init__.py:338
object
The object GUID as a Python UUID May be None.
Definition: winsec.py:136
int type
The type of entry as an integer.
Definition: winsec.py:123
offset
Definition: __init__.py:299
raw_file
Definition: __init__.py:752
Definition: structures.py:68
def find_subkey(self, name)
Selects the first subkey which has the specified name.
Definition: __init__.py:1039
def is_root(self)
Checks to see if this Key is the root of its Hive.
Definition: __init__.py:610
def next_value(self)
Selects the next value in the current Key's list.
Definition: __init__.py:1026
values
A ValueList object representing the list of Values stored on this Key.
Definition: __init__.py:504
Definition: structures.py:71
int flags
The flags as an integer.
Definition: winsec.py:126
Represents a Microsoft access control entry, which are elements of access control lists.
Definition: winsec.py:121
def current_value(self)
Retrieves the currently selected value.
Definition: __init__.py:1076
string name_encoding
The string encoding used to store the Key's name ("ascii" or "utf-16-le")
Definition: __init__.py:517
int access_mask
The access mask/permissions as an integer.
Definition: winsec.py:129
Abstract class for most objects returned by the library.
Definition: __init__.py:257
_key_base
Definition: __init__.py:357
def getLogMessages()
Retrieves messages produced by regfi during parsing and interpretation.
Definition: __init__.py:215
def setLogMask(log_types)
Sets the types of log messages to record.
Definition: __init__.py:238
_base
Definition: __init__.py:259
string name_encoding
The string encoding used to store the Value's name ("ascii" or "utf-16-le")
Definition: __init__.py:631
Registry key These represent registry keys (REGFI_NK records) and provide access to their subkeys,...
Definition: __init__.py:306
_fetch_num
Definition: __init__.py:362
def get_parent(self)
Retrieves this key's parent key.
Definition: __init__.py:598
tuple name_raw
The raw Value name as an uninterpreted bytearray.
Definition: __init__.py:625
def __init__(self, fh)
Constructor.
Definition: __init__.py:792
inherited_object
The inherited object GUID as a Python UUID May be None.
Definition: winsec.py:140
Definition: structures.py:50
Definition: structures.py:56
string trustee
The trustee's SID as a string.
Definition: winsec.py:132
Definition: structures.py:1
Definition: structures.py:47
_lock
Definition: __init__.py:877
def subtree(self, path)
Creates a HiveIterator initialized at the specified path in the hive.
Definition: __init__.py:855
_find_element
Definition: __init__.py:363
def get(self, name, default)
Fetches the requested element by name, or the default value if the lookup fails.
Definition: __init__.py:428
def first_subkey(self)
Selects first subkey of current key.
Definition: __init__.py:987
def down(self, subkey_name=None)
Descends the iterator to a subkey.
Definition: __init__.py:952
_fh
Definition: __init__.py:753
_hive
Definition: __init__.py:356
A special purpose iterator for registry hives.
Definition: __init__.py:873
list sacl
The system access control list represented as a list of ACE objects.
Definition: winsec.py:170
Definition: structures.py:59
def openHive(path)
Opens a file as a registry hive.
Definition: __init__.py:251
file
Definition: __init__.py:751
def first_value(self)
Selects first value of current Key.
Definition: __init__.py:1000
Abstract class for ValueList and SubkeyList.
Definition: __init__.py:354
_current
Definition: __init__.py:359
subkeys
A SubkeyList object representing the list of subkeys stored on this Key.
Definition: __init__.py:508
tuple name_raw
The raw Key name as an uninterpreted bytearray.
Definition: __init__.py:511
def __getitem__(self, name)
Retrieves a list element by name.
Definition: __init__.py:407
Definition: structures.py:53
_iter
Definition: __init__.py:875
string group
The security descriptor's group SID, as a string.
Definition: winsec.py:165
_hive
Definition: __init__.py:258
list dacl
The discretionary access control list represented as a list of ACE objects.
Definition: winsec.py:175
string owner
The security descriptor's owner SID, as a string.
Definition: winsec.py:162
def getVersion()
Returns the (py)regfi library version.
Definition: __init__.py:204
Registry value (metadata)
Definition: __init__.py:310
An enumeration of log message types.
Definition: __init__.py:156
def fetch_security(self)
Retrieves the Security properties for this key.
Definition: __init__.py:566
def __eq__(self, other)
Test for equality.
Definition: __init__.py:298
Represents a single registry hive (file)
Definition: __init__.py:750
def current_subkey(self)
Retrieves the currently selected subkey.
Definition: __init__.py:1067
_get_element
Definition: __init__.py:364
def __len__(self)
Length of list.
Definition: __init__.py:386
def descend(self, path)
Traverse downward multiple levels.
Definition: __init__.py:1098
An enumeration of registry Value data types.
Definition: __init__.py:120
Represents a registry SK record which contains a security descriptor.
Definition: __init__.py:317
The list of values associated with a Key.
Definition: __init__.py:487
_iteration_root
Definition: __init__.py:876
The list of subkeys associated with a Key.
Definition: __init__.py:466
_hive
Definition: __init__.py:874