pyregfi
Namespaces | Classes | Functions
pyregfi Namespace Reference

Namespaces

 structures
 
 winsec
 

Classes

class  _GenericList
 Abstract class for ValueList and SubkeyList. More...
 
class  _StructureWrapper
 Abstract class for most objects returned by the library. More...
 
class  DATA_TYPES
 An enumeration of registry Value data types. More...
 
class  Hive
 Represents a single registry hive (file) More...
 
class  HiveIterator
 A special purpose iterator for registry hives. More...
 
class  Key
 Registry key These represent registry keys (REGFI_NK records) and provide access to their subkeys, values, and other metadata. More...
 
class  LOG_TYPES
 An enumeration of log message types. More...
 
class  Security
 Represents a registry SK record which contains a security descriptor. More...
 
class  SubkeyList
 The list of subkeys associated with a Key. More...
 
class  Value
 Registry value (metadata) More...
 
class  ValueList
 The list of values associated with a Key. More...
 

Functions

def getVersion ()
 Returns the (py)regfi library version. More...
 
def getLogMessages ()
 Retrieves messages produced by regfi during parsing and interpretation. More...
 
def setLogMask (log_types)
 Sets the types of log messages to record. More...
 
def openHive (path)
 Opens a file as a registry hive. More...
 

Detailed Description

Python interface to the regfi library.

Function Documentation

◆ getVersion()

def pyregfi.getVersion ( )

Returns the (py)regfi library version.

Returns
A string indicating the version

◆ getLogMessages()

def pyregfi.getLogMessages ( )

Retrieves messages produced by regfi during parsing and interpretation.

The regfi C library may generate log messages stored in a special thread-safe global data structure. These messages should be retrieved periodically or after each major operation by callers to determine if any errors or warnings should be reported to the user. Failure to retrieve these could result in excessive memory consumption.

Referenced by pyregfi.Hive.__init__(), and pyregfi.HiveIterator.descend().

◆ setLogMask()

def pyregfi.setLogMask (   log_types)

Sets the types of log messages to record.

Parameters
log_typesA sequence of message types that regfi should generate. Message types can be found in the LOG_TYPES enumeration.
Returns
True on success, False on failure. Failures are rare, but could indicate that global logging is not operating as expected.

Example:

setLogMask((LOG_TYPES.ERROR, LOG_TYPES.WARN, LOG_TYPES.INFO))

The message mask is a global (all hives, iterators), thread-specific value. For more information, see regfi_log_set_mask.

◆ openHive()

def pyregfi.openHive (   path)

Opens a file as a registry hive.

Parameters
pathThe file path of a hive, as one would provide to the open() built-in
Returns
A new Hive instance
pyregfi.structures.REGFI_DATA
Definition: structures.py:62
pyregfi.HiveIterator.find_value
def find_value(self, name)
Selects the first value which has the specified name.
Definition: __init__.py:1054
pyregfi.HiveIterator.current_path
def current_path(self)
Obtains the current path of the iterator.
Definition: __init__.py:1134
pyregfi.structures.REGFI_DATA__interpreted
Definition: structures.py:202
pyregfi.HiveIterator.up
def up(self)
Causes the iterator to ascend to the current Key's parent.
Definition: __init__.py:976
pyregfi.Key.fetch_classname
def fetch_classname(self)
Retrieves the class name for this key.
Definition: __init__.py:579
pyregfi.winsec.SecurityDescriptor
A Microsoft security descriptor For more information, see: http://msdn.microsoft.com/en-us/library/aa...
Definition: winsec.py:160
pyregfi.HiveIterator.current_key
def current_key(self)
Retrieves the current key.
Definition: __init__.py:1085
pyregfi._GenericList._length
_length
Definition: __init__.py:358
pyregfi.structures.REGFI_RAW_FILE
Definition: structures.py:74
pyregfi.Security.prev_security
def prev_security(self)
Loads the "previous" Security record in the hive.
Definition: __init__.py:348
pyregfi.HiveIterator.next_subkey
def next_subkey(self)
Selects the next subkey in the current Key's list.
Definition: __init__.py:1013
pyregfi.Value.fetch_data
def fetch_data(self)
Retrieves the Value's data according to advertised type.
Definition: __init__.py:664
pyregfi.Value.fetch_raw_data
def fetch_raw_data(self)
Retrieves raw representation of Value's data.
Definition: __init__.py:699
pyregfi.structures.REGFI_NK
Definition: structures.py:65
pyregfi.Security.descriptor
descriptor
The winsec.SecurityDescriptor for this SK record.
Definition: __init__.py:325
pyregfi.HiveIterator.ancestry
def ancestry(self)
Obtains a list of the current key's ancestry.
Definition: __init__.py:1112
pyregfi._GenericList._constructor
_constructor
Definition: __init__.py:365
pyregfi.Security.next_security
def next_security(self)
Loads the "next" Security record in the hive.
Definition: __init__.py:338
pyregfi.winsec.ACE.object
object
The object GUID as a Python UUID May be None.
Definition: winsec.py:136
pyregfi.winsec.ACE.type
int type
The type of entry as an integer.
Definition: winsec.py:123
pyregfi._StructureWrapper.offset
offset
Definition: __init__.py:299
pyregfi.Hive.raw_file
raw_file
Definition: __init__.py:752
pyregfi.structures.REGFI_ITERATOR
Definition: structures.py:68
pyregfi.HiveIterator.find_subkey
def find_subkey(self, name)
Selects the first subkey which has the specified name.
Definition: __init__.py:1039
pyregfi.Key.is_root
def is_root(self)
Checks to see if this Key is the root of its Hive.
Definition: __init__.py:610
pyregfi.HiveIterator.next_value
def next_value(self)
Selects the next value in the current Key's list.
Definition: __init__.py:1026
pyregfi.Key.values
values
A ValueList object representing the list of Values stored on this Key.
Definition: __init__.py:504
pyregfi.structures.REGFI_FILE
Definition: structures.py:71
pyregfi.winsec.ACE.flags
int flags
The flags as an integer.
Definition: winsec.py:126
pyregfi.winsec.ACE
Represents a Microsoft access control entry, which are elements of access control lists.
Definition: winsec.py:121
pyregfi.HiveIterator.current_value
def current_value(self)
Retrieves the currently selected value.
Definition: __init__.py:1076
pyregfi.winsec.WINSEC_DOM_SID
Definition: winsec.py:43
pyregfi.Key.name_encoding
string name_encoding
The string encoding used to store the Key's name ("ascii" or "utf-16-le")
Definition: __init__.py:517
pyregfi.winsec.ACE.access_mask
int access_mask
The access mask/permissions as an integer.
Definition: winsec.py:129
pyregfi._StructureWrapper
Abstract class for most objects returned by the library.
Definition: __init__.py:257
pyregfi._GenericList._key_base
_key_base
Definition: __init__.py:357
pyregfi.getLogMessages
def getLogMessages()
Retrieves messages produced by regfi during parsing and interpretation.
Definition: __init__.py:215
pyregfi.setLogMask
def setLogMask(log_types)
Sets the types of log messages to record.
Definition: __init__.py:238
pyregfi._StructureWrapper._base
_base
Definition: __init__.py:259
pyregfi.Value.name_encoding
string name_encoding
The string encoding used to store the Value's name ("ascii" or "utf-16-le")
Definition: __init__.py:631
pyregfi.Key
Registry key These represent registry keys (REGFI_NK records) and provide access to their subkeys,...
Definition: __init__.py:306
pyregfi.winsec.WINSEC_ACL
Definition: winsec.py:49
pyregfi._GenericList._fetch_num
_fetch_num
Definition: __init__.py:362
pyregfi.Key.get_parent
def get_parent(self)
Retrieves this key's parent key.
Definition: __init__.py:598
pyregfi.Value.name_raw
tuple name_raw
The raw Value name as an uninterpreted bytearray.
Definition: __init__.py:625
pyregfi.Hive.__init__
def __init__(self, fh)
Constructor.
Definition: __init__.py:792
pyregfi.winsec.ACE.inherited_object
inherited_object
The inherited object GUID as a Python UUID May be None.
Definition: winsec.py:140
pyregfi.structures.REGFI_SK
Definition: structures.py:50
pyregfi.structures.REGFI_VALUE_LIST
Definition: structures.py:56
pyregfi.winsec.ACE.trustee
string trustee
The trustee's SID as a string.
Definition: winsec.py:132
pyregfi.structures
Definition: structures.py:1
pyregfi.structures.REGFI_VK
Definition: structures.py:47
pyregfi.HiveIterator._lock
_lock
Definition: __init__.py:877
pyregfi.Hive.subtree
def subtree(self, path)
Creates a HiveIterator initialized at the specified path in the hive.
Definition: __init__.py:855
pyregfi._GenericList._find_element
_find_element
Definition: __init__.py:363
pyregfi._GenericList.get
def get(self, name, default)
Fetches the requested element by name, or the default value if the lookup fails.
Definition: __init__.py:428
pyregfi.HiveIterator.first_subkey
def first_subkey(self)
Selects first subkey of current key.
Definition: __init__.py:987
pyregfi.HiveIterator.down
def down(self, subkey_name=None)
Descends the iterator to a subkey.
Definition: __init__.py:952
pyregfi.Hive._fh
_fh
Definition: __init__.py:753
pyregfi._GenericList._hive
_hive
Definition: __init__.py:356
pyregfi.HiveIterator
A special purpose iterator for registry hives.
Definition: __init__.py:873
pyregfi.winsec.SecurityDescriptor.sacl
list sacl
The system access control list represented as a list of ACE objects.
Definition: winsec.py:170
pyregfi.structures.REGFI_CLASSNAME
Definition: structures.py:59
pyregfi.openHive
def openHive(path)
Opens a file as a registry hive.
Definition: __init__.py:251
pyregfi.Hive.file
file
Definition: __init__.py:751
pyregfi.HiveIterator.first_value
def first_value(self)
Selects first value of current Key.
Definition: __init__.py:1000
pyregfi._GenericList
Abstract class for ValueList and SubkeyList.
Definition: __init__.py:354
pyregfi._GenericList._current
_current
Definition: __init__.py:359
pyregfi.Key.subkeys
subkeys
A SubkeyList object representing the list of subkeys stored on this Key.
Definition: __init__.py:508
pyregfi.Key.name_raw
tuple name_raw
The raw Key name as an uninterpreted bytearray.
Definition: __init__.py:511
pyregfi.winsec.WINSEC_UUID
Definition: winsec.py:40
pyregfi._GenericList.__getitem__
def __getitem__(self, name)
Retrieves a list element by name.
Definition: __init__.py:407
pyregfi.structures.REGFI_SUBKEY_LIST
Definition: structures.py:53
pyregfi.HiveIterator._iter
_iter
Definition: __init__.py:875
pyregfi.winsec.SecurityDescriptor.group
string group
The security descriptor's group SID, as a string.
Definition: winsec.py:165
pyregfi._StructureWrapper._hive
_hive
Definition: __init__.py:258
pyregfi.winsec.SecurityDescriptor.dacl
list dacl
The discretionary access control list represented as a list of ACE objects.
Definition: winsec.py:175
pyregfi.winsec.SecurityDescriptor.owner
string owner
The security descriptor's owner SID, as a string.
Definition: winsec.py:162
pyregfi.getVersion
def getVersion()
Returns the (py)regfi library version.
Definition: __init__.py:204
pyregfi.Value
Registry value (metadata)
Definition: __init__.py:310
pyregfi.LOG_TYPES
An enumeration of log message types.
Definition: __init__.py:156
pyregfi.winsec.WINSEC_DESC
Definition: winsec.py:52
pyregfi.winsec.WINSEC_ACE
Definition: winsec.py:46
pyregfi.Key.fetch_security
def fetch_security(self)
Retrieves the Security properties for this key.
Definition: __init__.py:566
pyregfi._StructureWrapper.__eq__
def __eq__(self, other)
Test for equality.
Definition: __init__.py:298
pyregfi.Hive
Represents a single registry hive (file)
Definition: __init__.py:750
pyregfi.HiveIterator.current_subkey
def current_subkey(self)
Retrieves the currently selected subkey.
Definition: __init__.py:1067
pyregfi._GenericList._get_element
_get_element
Definition: __init__.py:364
pyregfi._GenericList.__len__
def __len__(self)
Length of list.
Definition: __init__.py:386
pyregfi.HiveIterator.descend
def descend(self, path)
Traverse downward multiple levels.
Definition: __init__.py:1098
pyregfi.DATA_TYPES
An enumeration of registry Value data types.
Definition: __init__.py:120
pyregfi.Security
Represents a registry SK record which contains a security descriptor.
Definition: __init__.py:317
pyregfi.ValueList
The list of values associated with a Key.
Definition: __init__.py:487
pyregfi.HiveIterator._iteration_root
_iteration_root
Definition: __init__.py:876
pyregfi.SubkeyList
The list of subkeys associated with a Key.
Definition: __init__.py:466
pyregfi.HiveIterator._hive
_hive
Definition: __init__.py:874