reg export excluding specific by name

Question

i must export a set of registry keys only if the keyname not include a specific word

ex:

reg export "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports"

if the name of tcp/ip port contain "Session 2 " ignore and jump to the next

tnx for help

Answer 1

I have worked on a PHP script for this. It reads a registry export file, as produced by Regedit, and produces a similar file, but with the keys of your choice filtered out.

The callback receives the walked registry key as a parameter, and should return true if this key has to be filtered out.

function filter_reg_file($inputFile, $outputFile, $callback) {

    $content = file_get_contents($inputFile);

    $content = mb_convert_encoding($content, 'UTF-8', 'UCS-2LE');
    $content = preg_replace('@^(\xEF\xBB\xBF)?Windows Registry Editor Version 5\.00\r\n\r\n@', '', $content);

    $lines = explode("\r\n", $content);
    $skipping = false;
    $result = [];

    foreach ($lines as $line) {

        if (substr($line, 0, 1) === '[') {
            $keyName = substr($line, 1, -1);
            $skipping = $callback($keyName);
        }

        if (!$skipping) {
            $result[] = $line;
        }
    }

    $result = "Windows Registry Editor Version 5.00\r\n\r\n" . implode("\r\n", $result);
    $result = "\xFF\xFE" . mb_convert_encoding($result, 'UCS-2LE', 'UTF-8');

    file_put_contents($outputFile, $result);
}

Here is a sample usage. Take extra caution filtering out the root key (e.g. BagMRU) and the sub keys (e.g. BagMRU\foo\bar).

filter_reg_file('HKCU_Software.reg', 'HKCU_Software__filtered.reg', function ($key) {

    $keysToSkip = [
        'HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU',
        'HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags',
    ];

    foreach ($keysToSkip as $keyToSkip) {
        if ($key === $keyToSkip || strpos($key, $keyToSkip.'\\') === 0) {
            return true;
        }
    }

    return false;
});