A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #5652  by 0ffby1
 Fri Mar 25, 2011 10:16 pm
I've been trying to create this batch file to query the services keys.
First I collected all services into a text file.
Code: Select all
C:\>reg query HKLM\SYSTEM\CurrentControlSet\Services\ >c:\Users\thissystem\Deskto
p\services.txt
Then I append to the front "reg query" and to the end " /t REG_MULTI_SZ > C:\Users\thissystem\Desktop\dependson.txt, save as .bat.
The first output "match not found" so the other entries do not print to text file.

I found this:
Code: Select all
@echo OFF

setlocal ENABLEEXTENSIONS
set KEY_NAME="HKEY_CURRENT_USER\Software\Microsoft\Command Processor"
set VALUE_NAME=DefaultColor

FOR /F "usebackq skip=4 tokens=1-3" %%A IN (`REG QUERY %KEY_NAME% /v %VALUE_NAME% 2^>nul`) DO (
    set ValueName=%%A
    set ValueType=%%B
    set ValueValue=%%C
)

if defined ValueName (
    @echo Value Name = %ValueName%
    @echo Value Type = %ValueType%
    @echo Value Value = %ValueValue%
) else (
    @echo %KEY_NAME%\%VALUE_NAME% not found.
)
http://stackoverflow.com/questions/4451 ... tch-script

Is it possible to use %KEY_NAME% like CSS for html, using a list of keys to check?
 #5653  by 0ffby1
 Fri Mar 25, 2011 10:39 pm
I found the solution. :oops:
Instead of > I should have used >> which appends where > overwrites.
Now I'll try to find out how to clean up the output by removing the match not found.

Thanks
:)
 #5654  by Eric_71
 Fri Mar 25, 2011 11:06 pm
Hi,
Now I'll try to find out how to clean up the output by removing the match not found
just add 2>nul at the end of the reg query ( reg query HK..\ ....... 2> nul )

you have everything you need as Batch code in this archive (the executable is a SFX archive)
it is an old tool that I have not updated for 3 years but is still used on tens of forums
Attachments
(722.52 KiB) Downloaded 28 times