The Offline NT Password Editor (c) 1997-2011 Petter Nordahl-Hagen Registry Editor Usermanual/docs See COPYING for copyright & credits. See INSTALL for compile/installation instructions. See README for docs on the passwordpart (or website for bootdisk) Some known limitations as of first half 2011: This release features full basic registry edit with add/del keys and values and resizing values, and also expanding the file. Renaming keys and values is not implemented yet. Import is slow. Export is fast. Program "reged" is used for interactive registry edit (rudimentary command prompt type interface) or to export or import .reg files. Import and export can also be scripted (non-interactive) The "chntpw" program which is for password edits, also contains the editor, but not the import / export. Usage of "reged": reged version 0.1 110504, (c) Petter N Hagen Modes: -x Xport. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE is key to dump (recursively), . or \ or \\ means all keys in hive Only one .reg and one hive file supported at the same time -I Import from .reg file. Where for example is HKEY_LOCAL_MACHINE\SOFTWARE Only one .reg and one hive file supported at the same time -e ... Interactive edit one or more of registry files Options: -L : Log changed filenames to /tmp/changed, also auto-saves -C : Auto-save (commit) changed hives without asking -N : No allocate mode, only allow edit of existing values with same size -E : No expand mode, do not expand hive file (safe mode) -t : Debug trace of allocated blocks -v : Some more verbose messages -x will do export to .reg file. It will create files that seems to be compatible with regedit.exe in Windows. The prefix is the first part of the key names that windows shows/uses, it is not stored in the hive files, so you can actually put in anything unless you have to import in Windows. Current version only handles one set of files at a time (and also only one point to start export from in it) -I does import of .reg files into the specified hive file. It supports .reg files from Windows regedit.exe, they are usually UTF-16 (16 bit characters) and in the few cases I tested it will import with correct characters. Please note that the key and value names always are 8 bit in the registry, but strings the values store are 16 bit characters. Will also work with latin-1 (8 bit) character files, like the export functions creates, but again some character conversions may be wrong. Note that the current versions are pretty slow, since they are not optimized or well written in any way. Around 90000 keys with 120000 values just took around 10 minutes on my pretty fast machine. (I am lazy! You don't write hex reads with one byte at a time do you? :) -e goes into interactive editor (see below for old example) -e can be combined with -I so that the editor is entered before saving -after an import. -N and -E are safe modes, can be used with any mode. -C must be used when importing to auto-save, else it will ask first if import succeeds. The -L option will write changed hive file names to /tmp/changed, I use it for scripts that need to know. ------------------------ Here is an old demo of registry edit, via the chntpw program, but regedit is the same (except some new stuff is in there) You can navigate the registry almost like a filesystem (only difference being that the "files" actually are of a special datatype, instead of just a bytestream) Note that this demo is just some random editing, will likely cause windows to not boot if written back to it. >chntpw -h chntpw version 0.99.0 030111, (c) Petter N Hagen chntpw: change password of a user in a NT SAM file, or invoke registry editor. chntpw [OPTIONS] [systemfile] [securityfile] [otherreghive] [...] -h This message -u Username to change, Administrator is default -l list all users in SAM file -i Interactive. List users (as -l) then ask for username to change -e Registry editor. Now with full write support! -d Enter buffer debugger instead (hex editor), -t Trace. Show hexdump of structs/segments. (deprecated debug function) -L Write names of changed files to /tmp/changed -N No allocation mode. Only (old style) same length overwrites possible (example edit of a SYSTEM-hive) >chntpw -e system chntpw version 0.99.0 030111, (c) Petter N Hagen Hive's name (from header): ROOT KEY at offset: 0x001020 This is probably not a sam HIVE Simple registry editor. ? for help. [1020] > ? Simple registry editor: hive [] - list loaded hives or switch to hive numer n' cd - change key ls | dir [] - show subkeys & values, cat | type - show key value st [] - show struct info nk - add key dk - delete key (must be empty. recursion not supported yet) ed - Edit value nv - Add value dv - Delete value delallv - Delete all values in current key debug - enter buffer hexeditor q - quit (list the contents of the current key) [1020] > l ls of node at offset 0x1024 Node has 6 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2040] [ de448] [ de998] [ deab8] (now let's make a subkey here) [1020] > nk DemoKey [1020] > l ls of node at offset 0x1024 Node has 7 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2ef8] [1c2040] [ de448] [ de998] [ deab8] (and delete the key) [1020] > dk DemoKey [1020] > l ls of node at offset 0x1024 Node has 6 subkeys and 0 values offs key name [ 11b8] [ dff88] [1c2040] [ de448] [ de998]