.. image:: https://travis-ci.com/mkorman90/regipy.svg?branch=master
:target: https://travis-ci.com/mkorman90/regipy
regipy
==========
Regipy is a python library for parsing offline registry hives!
Features:
* Use as a library
* Recurse over the registry hive, from root or a given path and get all subkeys and values
* Read specific subkeys and values
* Apply transaction logs on a registry hive
* Command Line Tools:
* Dump an entire registry hive to json
* Apply transaction logs on a registry hive
* Compare registry hives
* Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name...)
:Project page: https://github.com/mkorman90/regipy
Using as a library:
--------------------
.. code:: python
from regipy.registry import RegistryHive
reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/Vibranium-NTUSER.DAT')
# Iterate over a registry hive recursively:
for entry in reg.recurse_subkeys(as_json=True):
print(entry)
# Iterate over a key and get all subkeys and their modification time:
for sk in reg.get_key('Software').get_subkeys():
print(sk.name, convert_wintime(sk.header.last_modified).isoformat())
# Get values from a specific registry key:
reg.get_key('Software\Microsoft\Internet Explorer\BrowserEmulation').get_values(as_json=True)
# Use plugins:
from regipy.plugins.ntuser.ntuser_persistence import NTUserPersistencePlugin
NTUserPersistencePlugin(reg, as_json=True).run()
# Run all supported plugins on a registry hive:
run_relevant_plugins(reg, as_json=True)
Install
^^^^^^^
Install regipy and the command line tools dependencies:
``pip install regipy[cli]``
NOTE: using pip with ``regipy[cli]`` instead of the plain ``regipy`` is a
significant change from version 1.9.x
For using regipy as a library, install only ``regipy`` which comes with fewer
dependencies:
``pip install regipy``
Raw data
{
"_id": null,
"home_page": "https://github.com/mkorman90/regipy/",
"name": "regipy",
"maintainer": null,
"docs_url": null,
"requires_python": null,
"maintainer_email": null,
"keywords": "Python, Python3, registry, windows registry, registry parser",
"author": "Martin G. Korman",
"author_email": "martin@centauri.co.il",
"download_url": "https://files.pythonhosted.org/packages/ab/69/59864fb77359018a16170be2ace82de8d40b547029bdc2dda4e8421f3971/regipy-4.2.0.tar.gz",
"platform": null,
"description": "\n.. image:: https://travis-ci.com/mkorman90/regipy.svg?branch=master\n :target: https://travis-ci.com/mkorman90/regipy\n\nregipy\n==========\nRegipy is a python library for parsing offline registry hives!\n\nFeatures:\n\n* Use as a library\n* Recurse over the registry hive, from root or a given path and get all subkeys and values\n* Read specific subkeys and values\n* Apply transaction logs on a registry hive\n* Command Line Tools:\n * Dump an entire registry hive to json\n * Apply transaction logs on a registry hive\n * Compare registry hives\n * Execute plugins from a robust plugin system (i.e: amcache, shimcache, extract computer name...)\n\n:Project page: https://github.com/mkorman90/regipy\n\nUsing as a library:\n--------------------\n.. code:: python\n\n from regipy.registry import RegistryHive\n reg = RegistryHive('/Users/martinkorman/Documents/TestEvidence/Registry/Vibranium-NTUSER.DAT')\n\n # Iterate over a registry hive recursively:\n for entry in reg.recurse_subkeys(as_json=True):\n print(entry)\n\n # Iterate over a key and get all subkeys and their modification time:\n for sk in reg.get_key('Software').get_subkeys():\n print(sk.name, convert_wintime(sk.header.last_modified).isoformat())\n\n # Get values from a specific registry key:\n reg.get_key('Software\\Microsoft\\Internet Explorer\\BrowserEmulation').get_values(as_json=True)\n\n # Use plugins:\n from regipy.plugins.ntuser.ntuser_persistence import NTUserPersistencePlugin\n NTUserPersistencePlugin(reg, as_json=True).run()\n\n # Run all supported plugins on a registry hive:\n run_relevant_plugins(reg, as_json=True)\n\nInstall\n^^^^^^^\nInstall regipy and the command line tools dependencies:\n\n``pip install regipy[cli]``\n\n\nNOTE: using pip with ``regipy[cli]`` instead of the plain ``regipy`` is a\nsignificant change from version 1.9.x\n\nFor using regipy as a library, install only ``regipy`` which comes with fewer\ndependencies:\n\n``pip install regipy``\n",
"bugtrack_url": null,
"license": "MIT",
"summary": "Python Registry Parser",
"version": "4.2.0",
"project_urls": {
"Homepage": "https://github.com/mkorman90/regipy/"
},
"split_keywords": [
"python",
" python3",
" registry",
" windows registry",
" registry parser"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "a165764a812977664d9e39af8ce1f1903d69981e0bf9a308bce0ef86bb29571a",
"md5": "6e8a97faf521929e8e1f035113fbb04a",
"sha256": "63c160618270d08df29c7818fc03ae8e015abacb6b1e5fbb51a6b675c9131017"
},
"downloads": -1,
"filename": "regipy-4.2.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "6e8a97faf521929e8e1f035113fbb04a",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": null,
"size": 83841,
"upload_time": "2024-04-15T18:45:30",
"upload_time_iso_8601": "2024-04-15T18:45:30.252075Z",
"url": "https://files.pythonhosted.org/packages/a1/65/764a812977664d9e39af8ce1f1903d69981e0bf9a308bce0ef86bb29571a/regipy-4.2.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "ab6959864fb77359018a16170be2ace82de8d40b547029bdc2dda4e8421f3971",
"md5": "1791eac177c4371d46fe6c2012b35d85",
"sha256": "b60ab02132e3b6111c368945917cccea08988e5618e64d20e83af98fe3b5630b"
},
"downloads": -1,
"filename": "regipy-4.2.0.tar.gz",
"has_sig": false,
"md5_digest": "1791eac177c4371d46fe6c2012b35d85",
"packagetype": "sdist",
"python_version": "source",
"requires_python": null,
"size": 63549,
"upload_time": "2024-04-15T18:45:32",
"upload_time_iso_8601": "2024-04-15T18:45:32.173228Z",
"url": "https://files.pythonhosted.org/packages/ab/69/59864fb77359018a16170be2ace82de8d40b547029bdc2dda4e8421f3971/regipy-4.2.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-04-15 18:45:32",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "mkorman90",
"github_project": "regipy",
"travis_ci": true,
"coveralls": false,
"github_actions": true,
"circle": true,
"requirements": [],
"lcname": "regipy"
}
JSON
