regshell 1 regshell Windows registry file browser using readline regshell --help --backend=BACKEND --credentials=CREDENTIALS location regshell is a utility that lets you browse thru a Windows registry file as if you were using a regular unix shell to browse thru a file system. --help Show list of available options. --backend BACKEND Name of backend to load. Possible values are: w95, nt4, gconf, dir and rpc. The default is dir. --credentials=CREDENTIALS Credentials to use, if any. Password should be separated from user name by a percent sign. ck|cd <keyname> Go to the specified subkey. ch|predef [predefined-key-name] Go to the specified predefined key. list|ls List subkeys and values of the current key. mkkey|mkdir <keyname> Create a key with the specified keyname as a subkey of the current key. rmval|rm <valname> Delete the specified value. rmkey|rmdir <keyname> Delete the specified subkey recursively. pwd|pwk Print the full name of the current key. set|update Update the value of a key value. Not implemented at the moment. help|? Print a list of available commands. exit|quit Leave regshell. &man.registry.backends; Browsing thru a nt4 registry file regshell -b nt4 NTUSER.DAT $$$PROTO.HIV> ls K AppEvents K Console K Control Panel K Environment K Identities K Keyboard Layout K Network K Printers K Software K UNICODE Program Groups K Windows 3.1 Migration Status $$$PROTO.HIV> exit Listing the subkeys of HKEY_CURRENT_USER\AppEvents on a remote computer: regshell --remote=ncacn_np:aurelia -c "jelmer%secret" HKEY_CURRENT_MACHINE> predef HKEY_CURRENT_USER HKEY_CURRENT_USER> cd AppEvents Current path is: HKEY_CURRENT_USER\AppEvents HKEY_CURRENT_USER\AppEvents> ls K EventLabels K Schemes HKEY_CURRENT_USER\AppEvents> exit This man page is correct for version 4.0 of the Samba suite. regtree, regdiff, regpatch, gregedit, samba &man.credits.samba; This manpage and regshell were written by Jelmer Vernooij.