Is there a pure Python library for parsing a Windows Registry file?

Question

Is there a pure Python (ie. fully cross-platform) library for parsing Windows Registry files (NTUSER.DAT)? Read-only access is acceptable.

If there is not, what resourc

Answer 1

I found this document http://sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf which has a lot of document linked from

Answer 2

You might want to take a look at winreg. Here: http://docs.python.org/library/_winreg.html

Not quite sure if thats what youre looking for.

Answer 3

winreg is obviously Windows only, and does not read registry hive files (NTUSER.DAT, etc.), but rather accesses the registry directly.

What you're looking for is a library for parsing hive files, and it seems like this one might work:

http://rwmj.wordpress.com/2010/11/28/use-hivex-from-python-to-read-and-write-windows-registry-hive-files/

The example code seems promising:

# Use hivex to pull out a registry key.
h = hivex.Hivex ("/tmp/ntuser.dat")

key = h.root ()
key = h.node_get_child (key, "Software")
key = h.node_get_child (key, "Microsoft")
key = h.node_get_child (key, "Internet Explorer")
key = h.node_get_child (key, "Main")

val = h.node_get_value (key, "Start Page")
start_page = h.value_value (val)
#print start_page

# The registry key is encoded as UTF-16LE, so reencode it.
start_page = start_page[1].decode ('utf-16le').encode ('utf-8')

print "User %s's IE home page is %s" % (username, start_page)

The downside is that it's still not pure python, but rather a python wrapper for another cross-platform library.

Edit:

If you must have pure python code with no binary dependencies, you can take a look at this project: http://code.google.com/p/creddump/

It seems to be pure python, and able to read registry hives in a cross platform manner, but a special-purpose tool and not a library - the code there will probably need some adaptation.

Answer 4

http://docs.python.org/library/_winreg.html

Answer 5

A search on google for "python windows registry" returns the _winreg module. It doesn't appear to be cross-platform, though.

From googling "windows registry file format", this comes up: http://pogostick.net/~pnh/ntpasswd/WinReg.txt