# Iterating through the registry

**URL:** <https://www.ruby-forum.com/t/iterating-through-the-registry/126299>\
**Category:** Ruby\
**Created:** [January 17, 2008, 6:23am UTC](https://www.ruby-forum.com/t/iterating-through-the-registry/126299 "2008-01-17T06:23:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thufir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@Thufir](https://www.ruby-forum.com/u/Thufir)\
**Post date:** [January 17, 2008, 6:23am UTC](https://www.ruby-forum.com/t/iterating-through-the-registry/126299/1 "2008-01-17T06:23:53Z")

</div>

I want to iterate through the registry, getting results similar to  
“reg query”; what can I do with the “do |reg|”, it seems that I need  
to pass something through the “chute”:

C:\code\reg\>  
C:\code\reg\>type reg.rb  
require ‘rubygems’  
require ‘win32/registry’  
include Win32

#desired output to match the output of:  
#reg query HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft

Win32::Registry.open(Win32::Registry::HKEY\_LOCAL\_MACHINE,‘Software  
\Policies\Micr  
osoft’)

#do |reg|

# type, data = reg.read(‘DataBasePath’)

C:\code\reg\>  
C:\code\reg\>ruby reg.rb

C:\code\reg\>  
C:\code\reg\>

thanks,

Thufir

---

<div class="post-metadata">

**Author:** ![Thufir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@Thufir](https://www.ruby-forum.com/u/Thufir)\
**Post date:** [January 17, 2008, 9:08am UTC](https://www.ruby-forum.com/t/iterating-through-the-registry/126299/2 "2008-01-17T09:08:45Z")

</div>

On Jan 16, 11:22 pm, Thufir [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> #desired output to match the output of:  
> C:\code\reg\>ruby reg.rb
> 
> C:\code\reg\>  
> C:\code\reg\>
> 
> thanks,
> 
> Thufir

I just threw this together. It seems to work though doesn’t do quite  
as well with the number of tabs separating value columns.

require ‘win32/registry’

include Win32

require ‘win32/registry’

include Win32

class Registry  
def query  
res = [self.name]

```
self.each_key do |subkey, wtime|
  res << "#{self.name}\\#{subkey}"
end
self.each_value do |value, type, data|
  data = self.read(value, type)
  case type
    when REG_BINARY
      data[1] = data[1].unpack('H*') if type ==

```

Registry::REG\_BINARY  
when REG\_DWORD  
data[1] = “0x#{data[1].to\_s(16)}”  
end  
res \<\< “#{value}\t#{Registry.type2name(type)}\t#{data[1]}”  
end

```
res

```

end  
end

puts Registry.open(Registry::HKEY\_LOCAL\_MACHINE, ‘Software\Policies  
\Microsoft’).query.join(“\n\n”)

---

<div class="post-metadata">

**Author:** ![Thufir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@Thufir](https://www.ruby-forum.com/u/Thufir)\
**Post date:** [January 17, 2008, 9:15am UTC](https://www.ruby-forum.com/t/iterating-through-the-registry/126299/3 "2008-01-17T09:15:52Z")

</div>

On Jan 17, 2008 1:22 PM, Thufir [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> #desired output to match the output of:  
> #reg query HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft

Hi Thufir,  
i just continued what you wrote and it seems to work fine, eg,

C:\family\ruby\>reg query HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft  
! REG.EXE VERSION 3.0  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Conferencing  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Netlogon  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\SystemCertificates  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows  
HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows NT

C:\family\ruby\>irb  
require ‘rubygems’  
#=\> true  
require ‘win32/registry’  
#=\> true  
include Win32  
#=\> Object  
Win32::Registry.open(Win32::Registry::HKEY\_LOCAL\_MACHINE,‘Software\Policies\Micr  
osoft’).each\_key{|k,id| p k}  
“Conferencing”  
“Netlogon”  
“SystemCertificates”  
“Windows”  
“Windows NT”  
#=\> 5  
Win32::Registry.open(Win32::Registry::HKEY\_LOCAL\_MACHINE,‘Software\Policies\Micr  
osoft’).each\_key{|k,id| p “#{k} : #{id}”}  
“Conferencing : 126539101535303750”  
“Netlogon : 126539098962178750”  
“SystemCertificates : 128406971361495897”  
“Windows : 127990413567906710”  
“Windows NT : 126539110549215000”

kind regards -botp

---

<div class="post-metadata">

**Author:** ![Thufir](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ee7513/32.png) [@Thufir](https://www.ruby-forum.com/u/Thufir)\
**Post date:** [January 17, 2008, 10:17am UTC](https://www.ruby-forum.com/t/iterating-through-the-registry/126299/4 "2008-01-17T10:17:30Z")

</div>

yermej wrote:

> On Jan 16, 11:22 pm, Thufir [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > I want to iterate through the registry, getting results similar to  
> > “reg query”; what can I do with the “do |reg|”, it seems that I need  
> > to pass something through the “chute”:

Alternatively, you could use rubylogparser which is a wrapper around  
Microsoft’s Log Parser 2.2 (free download from MS web site) to  
accomplish the same thing. For instance, to query the registry, you  
would do something similar to:

require ‘rubylogparser.rb’  
lp = RubyLogParser.new

sql = “Select Path, ValueName  
INTO STDOUT  
FROM HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft”

lp.open\_query(‘REG’, sql, ‘CSV’, {‘e’ =\> 100})

while hash = lp.read\_hash do  
p “#{hash[‘Path’].ljust(80)} #{hash[‘ValueName’].rjust(40)}\n”  
end

p “Parse errors:\n” + lp.parse\_errors.to\_s + “\n\n”  
p “Statistics:\n”  
p "Processed: " + (lp.elements\_processed.nil? ? “0” :  
“#{lp.elements\_processed}”) + “\n”  
p "Output: " + (lp.elements\_output.nil? ? “0” : “#{lp.elements\_output}”)

- “\n”  
p “Time: " + (lp.execution\_time.nil? ? “0” : “#{lp.execution\_time}”) + "  
seconds\n”

See the example file in rubylogparser docs  
([http://rubylogparser.rubyforge.org/doc/](http://rubylogparser.rubyforge.org/doc/)) for more info. One thing not  
in the docs is the {‘e’ =\> 100} hash passed to lp.open\_query allows Log  
Parser up to 100 errors before quitting (same as -e:100 command line  
switch if Log Parser invoked directly). This comes in handy if a  
registry key cannot be read for whatever reason. Any problems/errors are  
printed by lp.parse\_errors.

Hope this is useful.

Regards,  
Jim