Windows Registry FUSE filesystem
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Update .gitignore, clean up lots of unnecessary whitespace Mar 2, 2015
INSTALL Made a note about chroot building May 20, 2014
Makefile Fix a Makefile typo that caused compile problems Jan 22, 2017
TODO Move TODO items into a separate file; expand TODO list Feb 10, 2015 Update script Jan 21, 2017
fsck_winregfs.c Version 0.7 Mar 10, 2017
jody_hash.h Update jody_hash, use jodyhash_t type Jan 10, 2018
mount.winregfs.8 Improve manual page Mar 10, 2017
ntreg.c Preliminary code required for write support Sep 6, 2017
ntreg.h ntreg.h: add C++ guards Mar 10, 2017
winregfs.c Update jody_hash, use jodyhash_t type Jan 10, 2018



     If you have any questions, comments, or patches, send me an email:

One of the most difficult things to deal with in years of writing Linux
utilities to work with and repair Windows PCs is the Windows registry.
While many excellent tools exist to work with NTFS filesystems and to change
and remove passwords from user accounts, the ability to work with the
registry has always been severely lacking. Included in the excellent chntpw
package is a primitive registry editor "reged" which has largely been quite
helpful and I have been grateful for its existence, but it suffers from a
very limited interface and a complete lack of scriptability that presents a
major hurdle for anyone wanting to do more with the registry than wipe out a
password or change the "Start" flag of a system service.

Because of the serious limitations of "reged," the only practical way to do
anything registry-oriented with a shell script was to export an ENTIRE HIVE
to a .reg file, crudely parse the file for what you want, create a .reg file
from the script to import the changes, and import them. Needless to say, the
process is slow, complicated, and frustrating. I even wrote a tool called
"read_inf_section" to help my scripts parse INF/INI/REG files faster because
of this need (but also for an unrelated need to read .inf files from driver
packages.) This complexity became too excessive, so I came up with a much
better way to tweak the registry from shell scripts and programs.

Thus, the Windows Registry FUSE Filesystem "winregfs" was born. chntpw
( ) has an excellent library for
working with Windows NT registry hive files, distributed under the LGPL.
winregfs is essentially a glue layer between ntreg.c and FUSE, translating
Windows registry keys and values into ordinary directories and files.

Features include:
* Full write support (value size limited to 8192 bytes)
* Case-insensitivity in key/value name matching
* Automatic forward-slash escaping (gets around the Linux pathname limitation)
* "Wildcard" name matching on reads, i.e. "cat foo/bar" matches "foo/"
* Friendly DWORD editing in hexadecimal ASCII text rather than raw data

Also included is a tool called "fsck.winregfs" which will perform a basic check
of the integrity of a registry hive. It recursively follows all possible keys
and values, checking for errors in offsets, reading data, and value types. To
use it, type "fsck.winregfs [hivename]" and when the scan completes a detailed
list of statistics and error counts will be produced. The exit status can be
checked (i.e. in a script) for success or failure of the check.

A few keys and value names in the Windows registry such as MIME types contain
forward slash characters; winregfs substitutes "_SLASH_" where a forward
slash appears in names.

To use winregfs, make a directory to mount on and point it to the registry
hive of interest:

$ mkdir reg
$ mount.winregfs /mnt/sdc2/Windows/System32/config/software reg/

Now, you can see everything in that hive under "reg":

$ ls reg
7-Zip/                  Google/              Policies/
AVAST Software/         InstalledOptions/    Program Groups/
Adobe/                  Intel/               RegisteredApplications/
Analog Devices/         LibreOffice/         S3/
C07ft5Y/                Macromedia/          Schlumberger/
Classes/                Microsoft/           Secure/
Clients/                Mozilla/             Sigmatel/
Diskeeper Corporation/  MozillaPlugins/      The Document Foundation/
GNU/                    NVIDIA Corporation/  Windows 3.1 Migration Status/
Gabest/                 ODBC/      
Gemplus/                Piriform/

Let's say you want to see some things that automatically run during startup.

$ ls -l reg/Microsoft/Windows/CurrentVersion/Run
total 0
-r--r--r-- 1 root root 118 Dec 31  1969 Adobe
-r--r--r-- 1 root root 124 Dec 31  1969
-r--r--r-- 1 root root  60 Dec 31  1969
-r--r--r-- 1 root root  66 Dec 31  1969
-r--r--r-- 1 root root  70 Dec 31  1969 KernelFaultCheck.esz
-r--r--r-- 1 root root  66 Dec 31  1969
-r--r--r-- 1 root root 100 Dec 31  1969
-r--r--r-- 1 root root 118 Dec 31  1969

You want to see what these values contain.

$ for X in reg/Microsoft/Windows/CurrentVersion/Run/*
> do echo -en "$X\n   "; cat "$X"; echo; done
   "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

   "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"



   %systemroot%\system32\dumprep 0 -k


   C:\Program Files\Analog Devices\Core\smax4pnp.exe

   "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

Has anything hijacked the Windows "shell" value that runs explorer.exe?

$ cat reg/Microsoft/Windows\ NT/CurrentVersion/Winlogon/

How about the userinit.exe value?

$ cat reg/Microsoft/Windows\ NT/CurrentVersion/Winlogon/

Perhaps check if some system policies are set (note that REG_DWORD values now
work as friendly hexadecimal text files instead of raw data):

$ cat \
> reg/Policies/Microsoft/Windows/System/Allow-LogonScript-NetbiosDisabled.dw

You can probably figure out what to do with it from here. ;-)


ntreg.c and ntreg.h are distributed under the terms of the LGPL as described
in LGPL.txt while all other winregfs components are licensed under the terms
of the GNU GPL as described in LICENSE.