local and remote machine registry export

**Peter Duniho** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

On Fri, 30 May 2008 13:15:01 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

i current have a way to read both local and remote machines registry
keys and
create a textual view (.txt output).

In C#?

i now looking for ways to do export of local and remote mahcine registry
keys into ".reg" file format via C#.

If you already have code that produces text output of the registry, you're
most of the way there. The .reg file format is extremely simple. You
just need to specify specific key paths in square braces, with individual
values following. Here's a reasonable complete discussion:

http://support.microsoft.com/kb/310516

Other than following that specific format, I wouldn't expect much changes
from the code you already have.

is this do able?
what do i need to research to do this?

If you don't already have text output of the registry using .NET, you may
want to look here:
http://msdn.microsoft.com/en-us/libr....registry.aspx

Pete

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

Peter,
thanks for your response.
yes i have C# code to create a textual file of the registry key hive i want.
but i read the 2 kbs and i don't see how to use C# to create the ".reg" file
export.
they talk about using regedit. i can not export remote machine registry keys
this way.

i need to create an export file in ".reg" format for both local and remote
servers (machines).

"Peter Duniho" wrote:

On Fri, 30 May 2008 13:15:01 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:
>

i current have a way to read both local and remote machines registry
keys and
create a textual view (.txt output).

>
In C#?
>

i now looking for ways to do export of local and remote mahcine registry
keys into ".reg" file format via C#.

>
If you already have code that produces text output of the registry, you're
most of the way there. The .reg file format is extremely simple. You
just need to specify specific key paths in square braces, with individual
values following. Here's a reasonable complete discussion:

http://support.microsoft.com/kb/310516

>
Other than following that specific format, I wouldn't expect much changes
from the code you already have.
>

is this do able?
what do i need to research to do this?

>
If you don't already have text output of the registry using .NET, you may
want to look here:
http://msdn.microsoft.com/en-us/libr....registry.aspx
>
Pete
>

**Peter Duniho** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

On Fri, 30 May 2008 15:31:00 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

thanks for your response.
yes i have C# code to create a textual file of the registry key hive i
want.
but i read the 2 kbs and i don't see how to use C# to create the ".reg"
file
export.
they talk about using regedit. i can not export remote machine registry
keys
this way.
>
i need to create an export file in ".reg" format for both local and
remote
servers (machines).

The first article I provided documents the .reg file format. I'm not
aware of any support in .NET to write the format automatically (though it
might yet exist). But the format is so simple that if you already have
code to emit the registry information in _any_ format, it shouldn't take
you more than 15 minutes or so to change the code to comply with the
actual .reg file format. 30 minutes at the outside.

Heck...from scratch, the whole thing should a few hours work at the most,
and quicker for someone already very familiar with .NET.

Pete

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

will the file i create be able to be used by regedit to import on a machine?
i light is still not coming on.

"Peter Duniho" wrote:

On Fri, 30 May 2008 15:31:00 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:
>

thanks for your response.
yes i have C# code to create a textual file of the registry key hive i
want.
but i read the 2 kbs and i don't see how to use C# to create the ".reg"
file
export.
they talk about using regedit. i can not export remote machine registry
keys
this way.

i need to create an export file in ".reg" format for both local and
remote
servers (machines).

>
The first article I provided documents the .reg file format. I'm not
aware of any support in .NET to write the format automatically (though it
might yet exist). But the format is so simple that if you already have
code to emit the registry information in _any_ format, it shouldn't take
you more than 15 minutes or so to change the code to comply with the
actual .reg file format. 30 minutes at the outside.
>
Heck...from scratch, the whole thing should a few hours work at the most,
and quicker for someone already very familiar with .NET.
>
Pete
>

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

i think i can build the string and dword registry key to mimic the regedit
export file. but i'm seeing a problem constructing the "REG_MULTI_ SZ" output
so that it mimics the regedit structure.

my code does a good job of getting the string but i'm not understanding how
to keep the value as binary.

"auldh" wrote:

will the file i create be able to be used by regedit to import on a machine?
i light is still not coming on.
>
>
"Peter Duniho" wrote:
>

On Fri, 30 May 2008 15:31:00 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

thanks for your response.
yes i have C# code to create a textual file of the registry key hive i
want.
but i read the 2 kbs and i don't see how to use C# to create the ".reg"
file
export.
they talk about using regedit. i can not export remote machine registry
keys
this way.
>
i need to create an export file in ".reg" format for both local and
remote
servers (machines).

The first article I provided documents the .reg file format. I'm not
aware of any support in .NET to write the format automatically (though it
might yet exist). But the format is so simple that if you already have
code to emit the registry information in _any_ format, it shouldn't take
you more than 15 minutes or so to change the code to comply with the
actual .reg file format. 30 minutes at the outside.

Heck...from scratch, the whole thing should a few hours work at the most,
and quicker for someone already very familiar with .NET.

Pete

**Peter Duniho** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

On Fri, 30 May 2008 21:21:00 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

will the file i create be able to be used by regedit to import on a
machine?
i light is still not coming on.

Yes. The .reg file format is just a text file with a particular format
for the text contained within.

Again, I direct you to the Microsoft KB article I mentioned earlier, that
describes the format.

Pete

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

Peter you are smarter person than i.
i understand what i read. but using the C# registry class i don't see how to
get the "REG_MULTI_ SZ".

i can get a string output but i can not build the output as created by
regedit:
"WrapperCompone ntList"=hex(7): 4d,00,53,00,44, 00,45,00,00,00, 53,00,45,00,52, 00,\
56,00,45,00,52, 00,5f,00,4d,00, 52,00,53,00,5f, 00,4c,00,4f,00, 43,00,41,00,4c, \
00,00,00,4c,00, 41,00,4e,00,47, 00,55,00,41,00, 47,00,45,00,5f, 00,45,00,4e,00, \
47,00,4c,00,49, 00,53,00,48,00, 55,00,53,00,00, 00,43,00,4f,00, 4d,00,4d,00,55, \
00,4e,00,49,00, 43,00,41,00,54, 00,49,00,4f,00, 4e,00,53,00,5f, 00,43,00,4c,00, \
49,00,45,00,4e, 00,54,00,00,00, 41,00,50,00,50, 00,47,00,45,00, 4e,00,00,00,4d, \
00,4d,00,43,00, 5f,00,53,00,4e, 00,41,00,50,00, 49,00,4e,00,00, 00,54,00,54,00, \
53,00,5f,00,45, 00,4e,00,47,00, 49,00,4e,00,45, 00,00,00,00,00

i need to be able to create registry export file for both local and remote
machine/server that another group can restore via regedit to work in a lab.
the output file needs to mimic the registry export.

however creating a program to run regedit command line will only work on the
local machine. my task is to export the registry for both the master and
slave server so i can provide the data to someone else.

i can get to the string, dword but the muti_sz string is where i'm failing.
they build a string output.

"Peter Duniho" wrote:

On Fri, 30 May 2008 21:21:00 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:
>

will the file i create be able to be used by regedit to import on a
machine?
i light is still not coming on.

>
Yes. The .reg file format is just a text file with a particular format
for the text contained within.
>
Again, I direct you to the Microsoft KB article I mentioned earlier, that
describes the format.
>
Pete
>

**Peter Duniho** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

On Mon, 02 Jun 2008 12:48:01 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

Peter you are smarter person than i.

Maybe. Maybe not. Too early to tell. :)

i understand what i read. but using the C# registry class i don't see
how to
get the "REG_MULTI_ SZ".
>
i can get a string output but i can not build the output as created by
regedit:
"WrapperCompone ntList"=hex(7): 4d,00,53,00,44, 00,45,00,00,00, 53,00,45,00,52, 00,\
56,00,45,00,52, 00,5f,00,4d,00, 52,00,53,00,5f, 00,4c,00,4f,00, 43,00,41,00,4c, \
00,00,00,4c,00, 41,00,4e,00,47, 00,55,00,41,00, 47,00,45,00,5f, 00,45,00,4e,00, \
47,00,4c,00,49, 00,53,00,48,00, 55,00,53,00,00, 00,43,00,4f,00, 4d,00,4d,00,55, \
00,4e,00,49,00, 43,00,41,00,54, 00,49,00,4f,00, 4e,00,53,00,5f, 00,43,00,4c,00, \
49,00,45,00,4e, 00,54,00,00,00, 41,00,50,00,50, 00,47,00,45,00, 4e,00,00,00,4d, \
00,4d,00,43,00, 5f,00,53,00,4e, 00,41,00,50,00, 49,00,4e,00,00, 00,54,00,54,00, \
53,00,5f,00,45, 00,4e,00,47,00, 49,00,4e,00,45, 00,00,00,00,00

Well, what exactly is it that you're having difficulty with?

I mean, I can see a number of places that might trip a person up, but if
you can already output the registry as a .txt file (as you wrote in your
original post), how does that output differ from the above? What do you
need help with specifically?

Pete

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

the output i can create for a "multi_sz" is something like this:
Number of records in WrapperComponen tList = 4
WrapperComponen tList = (REG_MULTI_SZ) DRIVER_US
WrapperComponen tList = (REG_MULTI_SZ) MSDE
WrapperComponen tList = (REG_MULTI_SZ) SERVER_MRS_LOCA L
WrapperComponen tList = (REG_MULTI_SZ) LANGUAGE_ENGLIS HUS

my code:
else if (t == System.Type.Get Type("System.St ring[]"))
{
String[] sval = (String[])regvalue;
sw.WriteLine(St ring.Format("Nu mber of records in {0} =
{1}", valueName, sval.Length.ToS tring()));
for (int i = 0; i < sval.Length; i++)
{
sw.WriteLine("\ t\t{0} = (REG_MULTI_SZ) {1}",
valueName, sval[i]);
}
}
else
{
sw.WriteLine(St ring.Format("\t \tValue Name: {0}; Data:
{1} ; Type: {2}", valueName, regvalue.ToStri ng(), t));
}

creates the output to be strings as seen above.
and according to "regedit" it can not import the structure i have.

the output file needs to have the following format:
"WrapperCompone ntList"=hex(7): 44,00,52,00,49, 00,56,00,45,00, 52,00,5f,00,55, 00,\
53,00,00,00,4d, 00,53,00,44,00, 45,00,00,00,53, 00,45,00,52,00, 56,00,45,00,52, \
00,5f,00,4d,00, 52,00,53,00,5f, 00,4c,00,4f,00, 43,00,41,00,4c, 00,00,00,4c,00, \
41,00,4e,00,47, 00,55,00,41,00, 47,00,45,00,5f, 00,45,00,4e,00, 47,00,4c,00,49, \
00,53,00,48,00, 55,00,53,00,00, 00,00,00

i must be over thinking this cause i'm not having success stepping through
the registry value to create the ascii string above.

"Peter Duniho" wrote:

On Mon, 02 Jun 2008 12:48:01 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:
>

Peter you are smarter person than i.

>
Maybe. Maybe not. Too early to tell. :)
>

i understand what i read. but using the C# registry class i don't see
how to
get the "REG_MULTI_ SZ".

i can get a string output but i can not build the output as created by
regedit:
"WrapperCompone ntList"=hex(7): 4d,00,53,00,44, 00,45,00,00,00, 53,00,45,00,52, 00,\
56,00,45,00,52, 00,5f,00,4d,00, 52,00,53,00,5f, 00,4c,00,4f,00, 43,00,41,00,4c, \
00,00,00,4c,00, 41,00,4e,00,47, 00,55,00,41,00, 47,00,45,00,5f, 00,45,00,4e,00, \
47,00,4c,00,49, 00,53,00,48,00, 55,00,53,00,00, 00,43,00,4f,00, 4d,00,4d,00,55, \
00,4e,00,49,00, 43,00,41,00,54, 00,49,00,4f,00, 4e,00,53,00,5f, 00,43,00,4c,00, \
49,00,45,00,4e, 00,54,00,00,00, 41,00,50,00,50, 00,47,00,45,00, 4e,00,00,00,4d, \
00,4d,00,43,00, 5f,00,53,00,4e, 00,41,00,50,00, 49,00,4e,00,00, 00,54,00,54,00, \
53,00,5f,00,45, 00,4e,00,47,00, 49,00,4e,00,45, 00,00,00,00,00

>
Well, what exactly is it that you're having difficulty with?
>
I mean, I can see a number of places that might trip a person up, but if
you can already output the registry as a .txt file (as you wrote in your
original post), how does that output differ from the above? What do you
need help with specifically?
>
Pete
>

**Peter Duniho** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

On Mon, 02 Jun 2008 13:44:02 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:

the output i can create for a "multi_sz" is something like this: [snip]

Now we're getting somewhere! That example was precisely the sort of
information needed to elaborate on your question.

[...]
creates the output to be strings as seen above.
and according to "regedit" it can not import the structure i have.

Yes, that's true. As the docs say, and as you're aware, there's a
specific format required and that format is different from the one you're
using.

You need to do a couple of things. Ironically, using the managed
RegistryKey class makes things harder in one respect: the data returned is
not actually exactly how the data appears in the registry, so you need to
convert _back_ to the correct format so that you can then write it to the
text file. Were you using the unmanaged API (e.g. RegQueryValueEx ), you'd
just get the appropriate bytes directly (assuming you defined "UNICODE",
which IMHO any modern application should :) ).

Anyway, so the first thing you need to do is generate the necessary byte
array. You can use the Unicode instance of the Encoding class to convert
each string to a string of bytes. The REG_MULTI_SZ format is, as you can
probably tell by looking at the example you posted, a single byte array
containing null-terminated Unicode strings, with one more null-terminator
after the last null-terminated string (basically, it ends in a zero-length
string :) ).

So, you need to enumerate all your strings, convert them to Unicode bytes,
and fill a single byte array with the result. There are lots of ways to
do this, but the simplest is probably just to create a MemoryStream, write
the individual string byte arrays you get (including null-termination) to
the MemoryStream, and then get the bytes out from the MemoryStream at the
end. Don't forget that last zero-length string at the end (the extra
null-terminator).

Once you have this array of bytes, you need to write to the text file,
using hexadecimal formatting. The "X" formatting code can be used for
this, along with normal text output (e.g. StreamWriter.Wr iteLine(), which
you already seem to be using). Make sure you specify a 2-character field
width for each byte, and of course separate them with commas, exactly as
in your example. I don't actually know if the line-continuations are
required or if you can simply emit one long line. But you might want to
include the line-continuations even if they're not mandatory, since it
makes the file easier to read (granted, not many people are going to be
reading the byte values directly, but still... :) ).

Hope that helps. :)

Pete

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:55 PM

Re: local and remote machine registry export

Peter,
once again thanks.
i will do the research and work on this. this is great tips.

"Peter Duniho" wrote:

On Mon, 02 Jun 2008 13:44:02 -0700, auldh
<auldh@discussi ons.microsoft.c omwrote:
>

the output i can create for a "multi_sz" is something like this: [snip]

>
Now we're getting somewhere! That example was precisely the sort of
information needed to elaborate on your question.
>

[...]
creates the output to be strings as seen above.
and according to "regedit" it can not import the structure i have.

>
Yes, that's true. As the docs say, and as you're aware, there's a
specific format required and that format is different from the one you're
using.
>
You need to do a couple of things. Ironically, using the managed
RegistryKey class makes things harder in one respect: the data returned is
not actually exactly how the data appears in the registry, so you need to
convert _back_ to the correct format so that you can then write it to the
text file. Were you using the unmanaged API (e.g. RegQueryValueEx ), you'd
just get the appropriate bytes directly (assuming you defined "UNICODE",
which IMHO any modern application should :) ).
>
Anyway, so the first thing you need to do is generate the necessary byte
array. You can use the Unicode instance of the Encoding class to convert
each string to a string of bytes. The REG_MULTI_SZ format is, as you can
probably tell by looking at the example you posted, a single byte array
containing null-terminated Unicode strings, with one more null-terminator
after the last null-terminated string (basically, it ends in a zero-length
string :) ).
>
So, you need to enumerate all your strings, convert them to Unicode bytes,
and fill a single byte array with the result. There are lots of ways to
do this, but the simplest is probably just to create a MemoryStream, write
the individual string byte arrays you get (including null-termination) to
the MemoryStream, and then get the bytes out from the MemoryStream at the
end. Don't forget that last zero-length string at the end (the extra
null-terminator).
>
Once you have this array of bytes, you need to write to the text file,
using hexadecimal formatting. The "X" formatting code can be used for
this, along with normal text output (e.g. StreamWriter.Wr iteLine(), which
you already seem to be using). Make sure you specify a 2-character field
width for each byte, and of course separate them with commas, exactly as
in your example. I don't actually know if the line-continuations are
required or if you can simply emit one long line. But you might want to
include the line-continuations even if they're not mandatory, since it
makes the file easier to read (granted, not many people are going to be
reading the byte values directly, but still... :) ).
>
Hope that helps. :)
>
Pete
>

**=?Utf-8?B?YXVsZGg=?=** · Jun 27 '08, 07:57 PM

Re: local and remote machine registry export

just to finish this thread i thought i add what i have found.

when i created my registry export file i used StreamWriter without any
specific codepage encoding.

not mention in the MSDN links is that the output "reg" file should be
"Encoding.Unico de" specifiec.

now when i create the output file with StreamWriter and "Encoding.Unico de" i
can get a perfect replication of the regedit export.

thanks for all your help.

local and remote machine registry export

local and remote machine registry export

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment