regipy
Regipy is a python library for parsing offline registry hives!
Features:
Use as a library
Recurse over the registry hive, from root or a given path and get all subkeys and values
Read specific subkeys and values
Apply transaction logs on a registry hive
- Command Line Tools:
Dump an entire registry hive to json
Apply transaction logs on a registry hive
Compare registry hives
Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name…)
- Project page:
Using as a library:
from regipy.registry import RegistryHive
reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/Vibranium-NTUSER.DAT')
# Iterate over a registry hive recursively:
for entry in reg.rec_subkeys(as_json=True):
print(entry)
# Iterate over a key and get all subkeys and their modification time:
for sk in reg.get_key('Software').get_subkeys():
print(sk.name, convert_wintime(sk.header.last_modified).isoformat())
# Get values from a specific registry key:
reg.get_key('Software\Microsoft\Internet Explorer\BrowserEmulation').get_values(as_json=True)
# Use plugins:
from regipy.plugins.ntuser.ntuser_persistence import NTUserPersistencePlugin
NTUserPersistencePlugin(reg, as_json=True).run()
# Run all supported plugins on a registry hive:
run_relevant_plugins(reg, as_json=True)Install
Install regipy and the command line tools dependencies:
pip install regipy[cli]
NOTE: using pip with regipy[cli] instead of the plain regipy is a significant change from version 1.9.x
For using regipy as a library, install only regipy which comes with fewer dependencies:
pip install regipy
1 maintainer
Metadata
1 maintainer
Release files for regipy2 2.2.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| regipy2-2.2.1.tar.gz | 37.8 kB | Without provenance | Details for regipy2-2.2.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| regipy2-2.2.1-py3-none-any.whl | Python 3 | none | any | Details for regipy2-2.2.1-py3-none-any.whl |
Total release size: 94.6 kB
Release files / regipy2-2.2.1.tar.gz
| Download URL | regipy2-2.2.1.tar.gz |
|---|---|
| Size | 37.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f2ba248cfc6ad49617b15cb0d84b59c35c4e2a21e521fdc055561a5d59a40f96
|
|
BLAKE2b-256 checksum How to use checksums |
b605982ed1dca9e410c32ce9291acdfa0a6dd2b1a66c78fac15af1f872bac60e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.4.2 importlib_metadata/4.8.1 pkginfo/1.7.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.6.10
|
Release files / regipy2-2.2.1-py3-none-any.whl
| Download URL | regipy2-2.2.1-py3-none-any.whl |
|---|---|
| Size | 56.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
33ea7ad04b08445abc91ab491ee5373bad9cffe5ff935058c8bf6c71aab65467
|
|
BLAKE2b-256 checksum How to use checksums |
1d655fe668572748376c9518cd55d871b0f4999d830e5dfd2768dc872f0fb5c8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.4.2 importlib_metadata/4.8.1 pkginfo/1.7.1 requests/2.26.0 requests-toolbelt/0.9.1 tqdm/4.62.3 CPython/3.6.10
|
Security for regipy2 2.2.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
