Python _winreg.HKEY_LOCAL_MACHINE Examples

def CheckRegistryKey(javaKey):
		""" Method checks for the java in the registry entries. """
		from _winreg import ConnectRegistry, HKEY_LOCAL_MACHINE, OpenKey, QueryValueEx

		path = None
		try:
			aReg = ConnectRegistry(None, HKEY_LOCAL_MACHINE)
			rk = OpenKey(aReg, javaKey)
			for i in range(1024):
				currentVersion = QueryValueEx(rk, "CurrentVersion")
				if currentVersion != None:
					key = OpenKey(rk, currentVersion[0])
					if key != None:
						path = QueryValueEx(key, "JavaHome")
						return path[0]
		except Exception, err:
			# TODO: Add Warning/Error messages in Logger.
			WriteUcsWarning("Not able to access registry.")
			return None 

def get_win32_executable():
    if PY3:
        import winreg
    else:
        import _winreg as winreg
    reg = winreg.ConnectRegistry(None, winreg.HKEY_LOCAL_MACHINE)
    try:
        key = winreg.OpenKey(reg, 'SOFTWARE\\VMware, Inc.\\VMware Workstation')
        try:
            return os.path.join(winreg.QueryValueEx(key, 'InstallPath')[0], 'vmrun.exe')
        finally:
            winreg.CloseKey(key)
    except WindowsError:
        key = winreg.OpenKey(reg, 'SOFTWARE\\WOW6432Node\\VMware, Inc.\\VMware Workstation')
        try:
            return os.path.join(winreg.QueryValueEx(key, 'InstallPath')[0], 'vmrun.exe')
        finally:
            winreg.CloseKey(key)
    finally:
        reg.Close()
    return get_fallback_executable() 

def get_reboot_required():
  """Returns True if the system should be rebooted to apply updates.

  This is not guaranteed to notice all conditions that could require reboot.
  """
  # Based on https://stackoverflow.com/a/45717438
  k = None
  import _winreg
  try:
    k = _winreg.OpenKey(
        _winreg.HKEY_LOCAL_MACHINE,
        'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\'
        'Auto Update\\RebootRequired')
    _, num_values, _ = _winreg.QueryInfoKey(k)
    return num_values > 0
  except WindowsError:  # pylint: disable=undefined-variable
    # This error very likely means the RebootRequired key does not exist,
    # meaning reboot is not required.
    return False
  finally:
    if k:
      k.Close() 

def _find_msvc_in_registry(env,version):
    if _is_py2:
        import _winreg as winreg
    else:
        import winreg

    vs_ver = str(version) + '.0'
    vs_key = 'SOFTWARE\\Microsoft\\VisualStudio\\' + vs_ver + '\\Setup\\VS'
    vc_key = 'SOFTWARE\\Microsoft\\VisualStudio\\' + vs_ver + '\\Setup\\VC'
    vs_dir = _read_registry(winreg.HKEY_LOCAL_MACHINE, vs_key, 'ProductDir')
    vc_dir = _read_registry(winreg.HKEY_LOCAL_MACHINE, vc_key, 'ProductDir')
    
    # On a 64-bit host, look for a 32-bit installation 

    if (not vs_dir or not vc_dir):
        vs_key = 'SOFTWARE\\Wow6432Node\\Microsoft\\VisualStudio\\' + \
            vs_ver + '\\Setup\\VS'
        vc_key = 'SOFTWARE\\Wow6432Node\\Microsoft\\VisualStudio\\' + \
            vs_ver + '\\Setup\\VC'
        vs_dir = _read_registry(winreg.HKEY_LOCAL_MACHINE, 
                                vs_key, 'ProductDir')
        vc_dir = _read_registry(winreg.HKEY_LOCAL_MACHINE, 
                                vc_key, 'ProductDir')
    return (vs_dir,vc_dir) 

def QueryAutoCdRom():
	keypath=r'SYSTEM\CurrentControlSet\Services\cdrom'
	try:
		key=_winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE,keypath)
		return  _winreg.QueryValueEx(key,'AutoRun')[0]
	except:
		return None

# def QueryHKCUNoDriveAutoRun():# 0-0x3FFFFFF 
# 	keypath=r'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
# 	try:
# 		key=_winreg.OpenKey(_winreg.HKEY_CURRENT_USER,keypath)
# 		return  _winreg.QueryValueEx(key,'NoDriveAutoRun ')[0]
# 	except:
# 		return None

# def QueryHKCUNoDriveTypeAutoRun():
# 	keypath=r'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
# 	try:
# 		key=_winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE,keypath)
# 		return  _winreg.QueryValueEx(key,'NoDriveTypeAutoRun ')[0]
# 	except:
# 		return None 

def win32InstalledFonts( fontDirectory = None ):
    """Get list of explicitly *installed* font names"""
    import _winreg
    if fontDirectory is None:
        fontDirectory = win32FontDirectory()
    k = None
    items = {}
    for keyName in (
        r"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts",
        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Fonts",
    ):
        try:
            k = _winreg.OpenKey(
                _winreg.HKEY_LOCAL_MACHINE,
                keyName
            )
        except OSError, err:
            pass 

def register(classobj):
    import _winreg
    subKeyCLSID = "SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\%38s" % classobj._reg_clsid_
    try:
        hKey = _winreg.CreateKey( _winreg.HKEY_LOCAL_MACHINE, subKeyCLSID )
        subKey = _winreg.SetValueEx( hKey, "ButtonText", 0, _winreg.REG_SZ, classobj._button_text_ )
        _winreg.SetValueEx( hKey, "ClsidExtension", 0, _winreg.REG_SZ, classobj._reg_clsid_ ) # reg value for calling COM object
        _winreg.SetValueEx( hKey, "CLSID", 0, _winreg.REG_SZ, "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" ) # CLSID for button that sends command to COM object
        _winreg.SetValueEx( hKey, "Default Visible", 0, _winreg.REG_SZ, "Yes" )
        _winreg.SetValueEx( hKey, "ToolTip", 0, _winreg.REG_SZ, classobj._tool_tip_ )
        _winreg.SetValueEx( hKey, "Icon", 0, _winreg.REG_SZ, classobj._icon_)
        _winreg.SetValueEx( hKey, "HotIcon", 0, _winreg.REG_SZ, classobj._hot_icon_)
    except WindowsError:
        print "Couldn't set standard toolbar reg keys."
    else:
        print "Set standard toolbar reg keys." 

def get_arcgis_paths():
    """
    Use the windows registry to figure out the paths to the following folders:

    - bin
    - arcpy
    - scripts

    as subfolders of the installation directory.
    """
    import _winreg
    registry = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
    arcgis_version = get_arcgis_version()
    try:
        key = _winreg.OpenKey(registry, r"SOFTWARE\wow6432Node\ESRI\Desktop%s" % arcgis_version)
    except WindowsError:
        key = _winreg.OpenKey(registry, r"SOFTWARE\ESRI\Desktop%s" % arcgis_version)
    install_dir, _ = _winreg.QueryValueEx(key, 'InstallDir')
    paths = [os.path.join(install_dir, 'bin64'),
            os.path.join(install_dir, 'arcpy'),
            os.path.join(install_dir, 'scripts')]
    return paths 

def get_arcgis_version():
    """Check the registry for ArcGIS and return the version. Checks the following two locations:

    - HKLM\software\wow6432Node\esri\Arcgis\RealVersion
    - HKLM\SOFTWARE\ESRI\ArcGIS\RealVersion

    returns the version string as ``"major.minor"``, so ``"10.4"`` or ``"10.5"``
    """
    import _winreg
    registry = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
    try:
        key = _winreg.OpenKey(registry, r"software\wow6432Node\esri\Arcgis")
    except WindowsError:
        key = _winreg.OpenKey(registry, r"SOFTWARE\ESRI\ArcGIS")
    value, _ = _winreg.QueryValueEx(key, 'RealVersion')
    return '.'.join(value.split('.')[:2]) 

def set_envvar_in_registry(envvar, value):
    try:
        import winreg
    except ImportError:
        import _winreg as winreg

    reg = winreg.ConnectRegistry(None, winreg.HKEY_LOCAL_MACHINE)
    with winreg.OpenKey(reg, KEY, 0, winreg.KEY_ALL_ACCESS) as regkey:
        winreg.SetValueEx(regkey, envvar, 0, winreg.REG_EXPAND_SZ, value) 

def set_envvar_in_registry(envvar, value):
    try:
        import winreg
    except ImportError:
        import _winreg as winreg

    reg = winreg.ConnectRegistry(None, winreg.HKEY_LOCAL_MACHINE)
    with winreg.OpenKey(reg, KEY, 0, winreg.KEY_ALL_ACCESS) as regkey:
        winreg.SetValueEx(regkey, envvar, 0, winreg.REG_EXPAND_SZ, value) 

def list():
        """Return a list of all time zones known to the system."""
        handle = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
        tzkey = _winreg.OpenKey(handle, TZKEYNAME)
        result = [_winreg.EnumKey(tzkey, i)
                  for i in range(_winreg.QueryInfoKey(tzkey)[0])]
        tzkey.Close()
        handle.Close()
        return result 

def scan_installed_apps():
    """
    scan installed apps in windows system
    :return:
    """
    apps_list = []
    for key_root in [_winreg.HKEY_CURRENT_USER, _winreg.HKEY_LOCAL_MACHINE]:
        for key_path in ["SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
                         "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall"]:
            try:
                key = _winreg.OpenKey(key_root, key_path)
                # list all installed Apps
                i = 0
                while True:
                    app = {}
                    sub_key_name = _winreg.EnumKey(key, i)
                    sub_key = _winreg.OpenKey(key, sub_key_name)
                    try:
                        app["display_name"] = _winreg.QueryValueEx(sub_key, "DisplayName")[0]
                        app["path"] = _winreg.QueryValueEx(sub_key, "InstallLocation")[0]
                        apps_list.append(app)
                    except WindowsError:
                        pass
                    i += 1
            except WindowsError:
                pass
    return apps_list 

def __init__(self, name):
        self._name = name

        handle = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
        tzkey = _winreg.OpenKey(handle, "%s\%s" % (TZKEYNAME, name))
        keydict = valuestodict(tzkey)
        tzkey.Close()
        handle.Close()

        self._stdname = keydict["Std"].encode("iso-8859-1")
        self._dstname = keydict["Dlt"].encode("iso-8859-1")

        self._display = keydict["Display"]
        
        # See http://ww_winreg.jsiinc.com/SUBA/tip0300/rh0398.htm
        tup = struct.unpack("=3l16h", keydict["TZI"])
        self._stdoffset = -tup[0]-tup[1]         # Bias + StandardBias * -1
        self._dstoffset = self._stdoffset-tup[2] # + DaylightBias * -1
        
        (self._stdmonth,
         self._stddayofweek,  # Sunday = 0
         self._stdweeknumber, # Last = 5
         self._stdhour,
         self._stdminute) = tup[4:9]

        (self._dstmonth,
         self._dstdayofweek,  # Sunday = 0
         self._dstweeknumber, # Last = 5
         self._dsthour,
         self._dstminute) = tup[12:17] 

def __init__(self):

        handle = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)

        tzlocalkey = _winreg.OpenKey(handle, TZLOCALKEYNAME)
        keydict = valuestodict(tzlocalkey)
        tzlocalkey.Close()

        self._stdname = keydict["StandardName"].encode("iso-8859-1")
        self._dstname = keydict["DaylightName"].encode("iso-8859-1")

        try:
            tzkey = _winreg.OpenKey(handle, "%s\%s"%(TZKEYNAME, self._stdname))
            _keydict = valuestodict(tzkey)
            self._display = _keydict["Display"]
            tzkey.Close()
        except OSError:
            self._display = None

        handle.Close()
        
        self._stdoffset = -keydict["Bias"]-keydict["StandardBias"]
        self._dstoffset = self._stdoffset-keydict["DaylightBias"]


        # See http://ww_winreg.jsiinc.com/SUBA/tip0300/rh0398.htm
        tup = struct.unpack("=8h", keydict["StandardStart"])

        (self._stdmonth,
         self._stddayofweek,  # Sunday = 0
         self._stdweeknumber, # Last = 5
         self._stdhour,
         self._stdminute) = tup[1:6]

        tup = struct.unpack("=8h", keydict["DaylightStart"])

        (self._dstmonth,
         self._dstdayofweek,  # Sunday = 0
         self._dstweeknumber, # Last = 5
         self._dsthour,
         self._dstminute) = tup[1:6] 

def _get_sid_from_registry():
    try:
        import winreg
    except ImportError:
        import _winreg as winreg
    var_names = ("%USERPROFILE%", "%HOME%")
    current_user_home = next(iter(os.path.expandvars(v) for v in var_names if v), None)
    root, subkey = (
        winreg.HKEY_LOCAL_MACHINE,
        r"Software\Microsoft\Windows NT\CurrentVersion\ProfileList",
    )
    subkey_names = []
    value = None
    matching_key = None
    try:
        with winreg.OpenKeyEx(root, subkey, 0, winreg.KEY_READ) as key:
            for i in count():
                key_name = winreg.EnumKey(key, i)
                subkey_names.append(key_name)
                value = query_registry_value(
                    root, r"{0}\{1}".format(subkey, key_name), "ProfileImagePath"
                )
                if value and value.lower() == current_user_home.lower():
                    matching_key = key_name
                    break
    except OSError:
        pass
    if matching_key is not None:
        return matching_key 

def _create_win(self):
        try:
            key = _winreg.OpenKey(
                _winreg.HKEY_LOCAL_MACHINE,
                r'Software\Microsoft\Windows NT\CurrentVersion\Fonts')
        except EnvironmentError:
            try:
                key = _winreg.OpenKey(
                    _winreg.HKEY_LOCAL_MACHINE,
                    r'Software\Microsoft\Windows\CurrentVersion\Fonts')
            except EnvironmentError:
                raise FontNotFound('Can\'t open Windows font registry key')
        try:
            path = self._lookup_win(key, self.font_name, STYLES['NORMAL'], True)
            self.fonts['NORMAL'] = ImageFont.truetype(path, self.font_size)
            for style in ('ITALIC', 'BOLD', 'BOLDITALIC'):
                path = self._lookup_win(key, self.font_name, STYLES[style])
                if path:
                    self.fonts[style] = ImageFont.truetype(path, self.font_size)
                else:
                    if style == 'BOLDITALIC':
                        self.fonts[style] = self.fonts['BOLD']
                    else:
                        self.fonts[style] = self.fonts['NORMAL']
        finally:
            _winreg.CloseKey(key) 

def _settzkeyname():
    global TZKEYNAME
    handle = _winreg.ConnectRegistry(None, _winreg.HKEY_LOCAL_MACHINE)
    try:
        _winreg.OpenKey(handle, TZKEYNAMENT).Close()
        TZKEYNAME = TZKEYNAMENT
    except WindowsError:
        TZKEYNAME = TZKEYNAME9X
    handle.Close() 

def change_productid(self):
        """Randomizes Windows ProductId.
        The Windows ProductId is occasionally used by malware
        to detect public setups of Cuckoo, e.g., Malwr.com.
        """
        key = OpenKey(HKEY_LOCAL_MACHINE,
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
                      0, KEY_SET_VALUE)

        value = "{0}-{1}-{2}-{3}".format(random_integer(5), random_integer(3),
                                         random_integer(7), random_integer(5))

        SetValueEx(key, "ProductId", 0, REG_SZ, value) 

def get_cpuinfo():
  # Ironically, the data returned by WMI is mostly worthless.
  # Another option is IsProcessorFeaturePresent().
  # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724482.aspx
  import _winreg
  k = _winreg.OpenKey(
      _winreg.HKEY_LOCAL_MACHINE,
      'HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0')
  try:
    identifier, _ = _winreg.QueryValueEx(k, 'Identifier')
    match = re.match(r'^.+ Family (\d+) Model (\d+) Stepping (\d+)$',
                     identifier)
    name, _ = _winreg.QueryValueEx(k, 'ProcessorNameString')
    vendor, _ = _winreg.QueryValueEx(k, 'VendorIdentifier')
    return {
        u'model': [
            int(match.group(1)),
            int(match.group(2)),
            int(match.group(3))
        ],
        u'name':
            name,
        u'vendor':
            vendor,
    }
  finally:
    k.Close() 

def get_visual_studio_versions():
  """Retrieves all installed Visual Studio versions.

  The returned version list is sorted such that the first element is the highest
  version number.

  Returns:
    A list of Visual Studio version strings.
  """
  import _winreg

  try:
    k = _winreg.OpenKey(
        _winreg.HKEY_LOCAL_MACHINE,
        'SOFTWARE\\Wow6432Node\\Microsoft\\VSCommon')
  # pylint: disable=undefined-variable
  except WindowsError:
    return None

  try:
    versions = []
    for i in range(_winreg.QueryInfoKey(k)[0]):
      sub_key = _winreg.EnumKey(k, i)
      if re.match(r'\d+\.\d+', sub_key):
        versions.append(sub_key)
    return sorted(versions, key=float, reverse=True)
  finally:
    k.Close() 

def install_scripts():
    """installs javascripts for python
    """
    # find photoshop install dir
    reg_key_path = r"SOFTWARE\Adobe\Photoshop"
    with OpenKey(HKEY_LOCAL_MACHINE, reg_key_path) as k:
        version_sub_key_name = EnumKey(k, 0)
        version_sub_key = OpenKey(k, version_sub_key_name)
        install_path = QueryValue(version_sub_key, "ApplicationPath")

    # now copy all the files under scripts folder to
    # photoshop/Presets/Scripts path
    photoshop_scripts_path = os.path.normpath(
        os.path.join(
            install_path, 'Presets', 'Scripts'
        )
    )
    print(photoshop_scripts_path)

    here = os.path.dirname(__file__)
    scripts_folder = os.path.join(here, 'scripts')

    for root, dirs, files in os.walk(scripts_folder):
        for file_ in files:
            file_path = os.path.join(root, file_)
            shutil.copy(
                os.path.normpath(file_path),
                photoshop_scripts_path + '\\'
            ) 

def win32_detect_win10 (self):
		try:
			import _winreg
			path = r'SOFTWARE\Microsoft\Windows NT\CurrentVersion'
			data = self.win32_reg_read(_winreg.HKEY_LOCAL_MACHINE, path)
		except:
			return False
		version = data.get('CurrentMajorVersionNumber', (0, 0))
		if version[1] >= 10:
			return True
		return False 

def arcmap_exists(version=None):
    """Check for the existence of the specified version of ArcMap.

    Returns: True or False"""
    root_key = winreg.HKEY_LOCAL_MACHINE
    if not version:
        version = "10.3"
    package_key = "Desktop{}".format(version)

    arc_reg_paths = [
        "SOFTWARE\\ESRI\\{}".format(package_key),
        "SOFTWARE\\Wow6432Node\\ESRI\\{}".format(package_key)
    ]

    installed = False
    for reg_path in arc_reg_paths:
        arcmap_reg = None
        try:
            # find the key, 64- or 32-bit we want it all
            arcmap_reg = winreg.OpenKey(root_key, reg_path, 0, READ_ACCESS)
        except fnf_exception as error:
            handle_fnf(error)

        if arcmap_reg:
            installed = True

    return installed 

def _user_sids():
    """Map between usernames and the related SID."""
    user_sids = {}

    root_key = winreg.HKEY_LOCAL_MACHINE
    reg_path = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList"

    try:
        log.info("OpenKey on {}, with READ + WOW64".format(reg_path))
        sid_reg = winreg.OpenKey(root_key, reg_path,
                                 0, READ_ACCESS)

    except fnf_exception as error:
        handle_fnf(error)

    if sid_reg:
        subkey_count = winreg.QueryInfoKey(sid_reg)[0]
        for pos in range(subkey_count):
            try:
                sid = winreg.EnumKey(sid_reg, pos)
            except:
                pass
            if sid:
                profile_path_key = "{}\\{}".format(reg_path, sid)
                try:
                    profile_path_reg = winreg.OpenKey(
                        root_key, profile_path_key, 0, READ_ACCESS)

                    profile_path = winreg.QueryValueEx(
                        profile_path_reg, "ProfileImagePath")[0]

                    username = profile_path.split("\\")[-1]
                    user_sids[username] = sid
                except:
                    pass

    return user_sids 

def del_debugger(self, registry, binlist):
        """ Deletes debugger registry key for 
        each of the processes in the list """
        for binary in binlist:
            path = self.DEBUG_KEY + binary
            k = registry.open_key(HKLM, path)
            if not(k):
                return
            registry.del_value(k, "debugger") 

def add_debugger(self, registry, binlist):
        """ Adds debugger registry key for 
        each of the processes in the list """
        for binary in binlist:
            path = self.DEBUG_KEY + binary
            k = registry.open_key(HKLM, path)
            if not(k):
                k = registry.create_key(HKLM, path)
            payload = self.build_payload(binary[:-3] + "pyw")
            registry.create_value(k,
                                  "debugger",
                                  payload) 

def _listen(self):
        """ Listen for information from a client and performs
        actions related to the windows registry """
        registry = Registry()
        listener = Listener(('localhost', self.port), authkey=self.password)
        conn = listener.accept()
        msg = conn.recv()
        if type(msg) is list and len(msg) == 2:
            # Deleting debugger key
            debug_path = self.DEBUG_KEY + msg[0]
            k = registry.open_key(HKLM, debug_path)
            registry.del_value(k, "debugger")
            # Deleting the bad path
            k = registry.open_key(HKCU, msg[1])
            if k:
                self.brush.color("[!!] POSSIBLE UAC BYPASS IN YOUR SYSTEM\n", 'RED')
                registry.delete_key(HKCU, msg[1])
                ctypes.windll.user32.MessageBoxA(
                    None, "UAC BYPASS DETECTADO Y MITIGADO. EJECUCION SEGURA DEL BINARIO", "PELIGRO!", 0)
            os.system(msg[0])
            # Setting the debugger key before breaking connection
            k = registry.open_key(HKLM, debug_path)
            payload = self.build_payload(msg[0][:-3] + "pyw")            
            registry.create_value(k,
                                  "debugger",
                                  payload)
            print "[+] Closing the listener"
            conn.close()
            listener.close() 

def __init__(self, scope):
        assert scope in ('user', 'system')
        self.scope = scope
        if scope == 'user':
            self.root = winreg.HKEY_CURRENT_USER
            self.subkey = 'Environment'
        else:
            self.root = winreg.HKEY_LOCAL_MACHINE
            self.subkey = r'SYSTEM\CurrentControlSet\Control\Session Manager\Environment' 

def get_pro_key():
    """
    Returns ArcGIS Pro's registry key.
    """
    pro_key = _winreg.OpenKey(_winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\ESRI\ArcGISPro")
    return pro_key