Is there a software that can index the contents of the registry for quick lookups?

16

5

Searching in the Windows registry can be ve------ry------ lo----ng.

Is there some tool available that can index the contents of the whole registry, or contents of a single hive, such that fast lookups are available? (for example generating some SQLite database with FTS3 or FTS4 enabled for full text search)

Thank you.

PS. I don't want RegScanner or tools that perform a new, linear search every time. I want an indexer, with which then a search can be instantaneous. See question comments.

Benoit

Posted 2011-02-26T11:40:01.190

Reputation: 6 563

Question was closed 2014-01-19T17:37:33.850

possible duplicate of Registry Search & Replace Tool

– Mehper C. Palavuzlar – 2011-02-26T11:45:38.910

have a look here: http://majorgeeks.com/downloads15.html

– bubu – 2011-02-26T12:43:14.073

@Mehper C. Palavuzlar: I would say this is not a duplicate. Search and replace tools are not indexation tools. Usually the first will scan the registry linearly every time a new search is performed. – Benoit – 2011-02-26T15:33:39.790

@bubu: seems there is no single indexation tool here! All search tools seem to search in a linear way for each new search! – Benoit – 2011-02-26T15:37:44.033

Not an indexer but makes it much easier to search the registry...http://www.nirsoft.net/utils/regscanner.html

– Moab – 2011-02-26T15:39:47.383

@Moab: I know Nirsoft utilities (and particularly HashMyFiles). Thank you for pointing to this one. It is interesting, but still not what I am looking for! – Benoit – 2011-02-26T16:18:27.680

A Registry Indexer is an interesting idea. – Moab – 2011-02-26T16:37:17.340

2@Benoit: This bothers me a lot, I'm going to try to write such application today. – Tamara Wijsman – 2011-03-17T08:24:55.577

1@TomWij: Will it be commercial? Open-source? Could I beta-test it please :-) ? This is a great project, and I back it. – Benoit – 2011-03-17T08:27:30.510

@Benoit: Free, I don't know if it really needs to be OS or Beta. I'm planning on solely writing an Indexer and perhaps an optional Monitor to update the Index on-the-fly, it will take you to the right path in the existing Registry Editor if you double click on a result. I've already found the resources I need, expect it to released by the weekend as I might not have enough time today. – Tamara Wijsman – 2011-03-17T08:55:01.963

@Benoit: Okay, got recursively enumerating the registry working, in reasonable time my registry is dumped to a ~160 MB file (just for testing purposes); the next step which I will do tomorrow is to get it in a Full-Text Search Index which I've already got a plan for. – Tamara Wijsman – 2011-03-17T20:13:59.957

@Benoit: Indexing part has been finished, shows progress bar and current path during indexing. Indexing takes ~2 minutes here, the searches should be instant. It has to be run every time you want to work with the newest data. I'm going to write the Search part soon, I might not finish this weekend but there is no hurry... – Tamara Wijsman – 2011-03-19T18:43:23.670

@TomWij: thank you for reporting your progress! – Benoit – 2011-03-19T18:54:06.017

@TomWij: perhaps awarding a bounty woud be useful when you're done or if someone find another tool before you've finished! – Benoit – 2011-03-21T10:02:46.630

Got it working, gonna eat, do some more testing and then create a post. :-) – Tamara Wijsman – 2011-03-21T16:53:44.230

Whatever you do, make sure to avoid searching duplicate keys. I suggest you use the native NT API to avoid re-searching keys that are huge duplicates (like HKLM\SOFTWARE\Classes and HKCR). – user541686 – 2011-03-21T19:31:18.093

@Mehrdad: That's already handled from the start, the NT API won't avoid that as you specify what you want to enumerate and that would be all the hives. So I specified to only use the three hives instead of all five hives. Further improvements could probably be made, feel free to suggest them but would only make a minor difference as far as I could see... – Tamara Wijsman – 2011-03-21T21:13:35.160

@TomWij: Well I meant that there's also symbolic links like CurrentControlSet that you can only open with the Native API (otherwise, it'll open the target not the link), but as you mention, those are really minor compared to HKCR, so it would only probably save a second or so. – user541686 – 2011-03-21T21:22:24.753

@MehrDad: I'm using .NET functions, it works fine. Maybe I try to figure out things that are useless to be indexed in the future...

– Tamara Wijsman – 2011-03-21T22:40:29.563

1

@TomWij: I'm not sure what you meant by the "it works fine", but notice that you've actually opened the key ControlSet001 (or maybe ControlSet002 or some other one), not CurrentControlSet. CurrentControlSet is actually a link to those keys, and it's not possible to view the link itself using the regular .NET functions; you need a function like NtOpenKey to open the actual symbolic link instead of the target. Take a look here and here.

– user541686 – 2011-03-21T22:51:26.117

I see, indeed, the .NET method I use doesn't pass information about whether it is symbolic or not. But this shouldn't be neecessary for indexing... Yes, it indexes the control set twice now which I could solve by not indexing the ControlSets (loss of the non-current control set data) or not indexing the CurrentControlSet (loss of knowing what's current), but well, as the difference is minor it's not really necessary now... :-) – Tamara Wijsman – 2011-03-22T00:11:13.350

Answers

11

Introduction

I've written an application that indexes the registry and another application that searches this index.

This results in near instant results while you type, this allows you to quickly search several things.

See this video demonstration, shows how quick results are, three different searches and two registry jumps.

The Index

enter image description here

For indexing purposes, I'm using Lucene.net, doesn't that sound familiar?

This allows me to index data straight out of the registry, without using a SQL database to store the data in. Furthermore, Lucene.net has a lot of indexing options and search related features which come in handy!

This index will be stored in %LOCALAPPDATA%\RegistryIndex, and has a size of around 160 MB.

Application 1: RegistryIndex.exe

This will dump the whole registry to the above mentioned index folder,
please note that HKEY_CLASSES_ROOT and HKEY_CURRENT_USER are shortcut hives and thus not indexed.

Although it does work without you might want to configure it to automatically run as administrator.

Once the application shows that it is done, you can close the window and thus the index has been made.

Application 2: RegistrySearch.exe

This one is simple, type something to search in the text box above and results will flow in.

Typing incorrect syntax will result in a yellow text box and the error in the status bar at the bottom.

Special search features like wildcard and boolean operations are supported, see Query Syntax for more information. Please note that specifying fields will not work in the current setting, the system searches in a concatenation of tokenized path and value. So A\B\C with value D E F becomes A B C D E F.

Example of searching an exact path: "HKEY_LOCAL_MACHINE SOFTWARE"

The search is limited to 1000 results.

Double click an entry to jump to it in the registry, this uses regjump.exe from SysInternals.
You need to run the search program as an administrator for the jump to work, accept EULA the first time.

Future features

See the current version as a Technical Preview, it does work but could use refactoring and make-up.

  • Application icon & version
  • Configuration
  • Highlighting results
  • Installer package
  • Monitor service (Tracks registry changes using a hook and update the index)

Changes

  • 21/03: Now stores in %LOCALAPPDATA%, asks for Administrators permission.

Download

Click here to download, unzip all files to a preferred location, create shortcuts to RegistryIndex/Search.exe.

Source

It's non-obfuscated, so to inspect the IL you can use Reflector if you want to.

I might release source when it is refactored with a bit more features, perhaps I can put it on CodePlex.

Tamara Wijsman

Posted 2011-02-26T11:40:01.190

Reputation: 54 163

1Hello, is the project still alive? I'm doing lots of reverse engineering last time and that might be very useful. Any new link? – Dmitry Gusarov – 2018-06-06T15:33:41.103

2Would be better if your app used %LOCALAPPDATA% not %APPDATA%. – edusysadmin – 2011-03-21T18:42:41.520

1@edusysadmin: Adjusted, now saves to %LOCALAPPDATA% and asks administrator permissions. – Tamara Wijsman – 2011-03-21T18:59:29.167

1Thank you. I have downloaded the package, using Win Vista in French language, and even running RegistryIndex.exe as administrator fails. (Keeps saying “please run as an administrator”). Do you have an idea why this could fail? – Benoit – 2011-03-21T19:12:54.270

@Benoit: I'm using code from the Microsoft site for the administrator part, but it seems to be non-international code. All other code looks things up international. The problem is that it looks up the "Administrators" group to look for the permissions, as this group is called different on your computer it thus fails. This has been resolved now using new System.Security.Principal.SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null).Translate(typeof(System.Security.Principal.NTAccount)).ToString().Split('\\').Last() to get the group name. – Tamara Wijsman – 2011-03-21T21:02:41.337

I might come back to this software in a month, got deadlines and exams now... – Tamara Wijsman – 2011-05-24T16:32:21.127

@Tom Wijsman: hum, month is over :) still using it and it is great. – Benoit – 2012-01-31T14:00:22.193

@Benoit: Indeed, exams are again done today. What missing features, see the list above, do you feel you need the most? I also still use it... :) – Tamara Wijsman – 2012-01-31T18:18:14.290

@Tom Wijsman: package it as a portable app (don't store in %LOCALAPPDATA% but besides the executable for example), and what you told about in your Future Features section... – Benoit – 2012-01-31T19:02:21.707

@Benoit: Any idea how storing next to the application is called? The application data is the normal way of doing this, with the application in the Program Files. Perhaps I can let an installer put everything inside AppData or so? Dunno if there is a more appropriate folder to do so, or do you want the application to just work out of the folder you put it in with no installation whatsoever? I'll try to look into the monitor service / highlighting... – Tamara Wijsman – 2012-01-31T19:34:55.223

@Tom Wijsman: The principle of a portable application is that it runs out of the box (without installer) and that the settings are stored along with the application. Thanks for your patience. – Benoit – 2012-01-31T22:13:54.677

I wonder why I even asked that, makes sense... :) – Tamara Wijsman – 2012-01-31T22:15:22.170

3

Look at NirSoft's RegScanner. Not an indexer, but it way out-searches RegEdit and it will open RegEdit for you to a selected hit, among other cool features. Definitely try it before you start a development project (unless you want to do the project for the sake of doing it) - you may find you don't really need more.

JRobert

Posted 2011-02-26T11:40:01.190

Reputation: 6 128

As already told in a comment: it is a good tool, but it won't index anything. – Benoit – 2011-03-21T13:15:30.697

And as I also said. But your question, in the very first sentence, addresses RegEdit's slow speed, not its technique, and as such, RegScanner addresses that rather well. I'll leave the suggestion up for whomever it might help in the future. – JRobert – 2011-03-21T14:45:19.867

Very nice tool! +1 – Piotr Dobrogost – 2011-09-01T06:20:07.120

1

You could export the registry to a .reg text file and use your favourite editor to search it.

Malvineous

Posted 2011-02-26T11:40:01.190

Reputation: 1 881

This is actually a nice idea but probably suboptimal because there is no indexation. – Benoit – 2011-03-20T06:09:35.223

Note that of course, then inserting all reg file in some way into SQLite with FTS3 or FTS4 enabled is probably a way of doing it. – Benoit – 2011-03-21T13:18:08.023

@Benoit: Actually, I started with just enumerating the whole registry to a plain-text file at first and searching with Notepad++ actually is fast by itself. I'm using Lucene.Net to do the indexing as it is specially written for that task and doesn't require me to create a SQL solution, it also supports highlighting features (it's meant for search engines, btw, SE uses Lucene.net for the search engine here) which I'll try to include, perhaps on a later version. I guess that indexing/FTS results in search results while you type, but haven't tried it yet... – Tamara Wijsman – 2011-03-21T14:31:29.243

Asked: 2011-02-26T11:40:01.190

Viewed: 745 times

Active: 2014-01-17T15:42:37.993