WinEnum.py 文件源码

def walk_registry(hkey, path, access_flags, keywords, onerror=None):
    """ Walks all keys of the registry searching for values that match any of the provided 'keywords'. """
    try:
        key = winreg.OpenKey(hkey, path, access_flags)
    except OSError as e:
        if onerror is not None:
            onerror(e)
        return

    i = 0
    sub_keys = []
    with key:
        while True:
            try:
                sub_keys.append(winreg.EnumKey(key, i))
            except OSError:
                break
            i += 1

        i = 0
        while True:
            try:
                data = winreg.EnumValue(key, i)
                i += 1
                for keyword in keywords:
                    if keyword.lower() in str(data[0]).lower():
                        if hkey == winreg.HKEY_LOCAL_MACHINE:
                            hive = 'HKLM\\'
                        else:
                            hive = 'HKCU\\'

                        print('{0}\\{1}\\{2} = {3}'.format(hive, path, data[0], data[1]))
            except OSError:
                break

        for key in sub_keys:
            next_path = os.path.join(path, key)
            for item in walk_registry(hkey, next_path, access_flags, keywords, onerror):
                yield item