Jump to content











Photo
- - - - -

offlinereg


  • Please log in to reply
276 replies to this topic

#226 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 19 December 2018 - 05:38 PM

@ default keys support in reg keys still broken in the latest version. Hope you find time to fix it one day.

 

Thanks for such an amazing app!

 

can you post your full command line?



#227 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 3 weeks ago

Hi!

 

How can I activate the administrator account with this tool?

This doesn't work unfortunately, is there a better/easier way?

 

offlinereg-win64.exe "H:\Windows\System32\config\SAM" " " import sam.reg

 

Windows Registry Editor Version 5.00
 
[SAM\Domains\Account\Users\000001F4]
"F"=hex:03,00,01,00,00,00,00,00,e0,fb,3d,0d,c4,ca,d3,01,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
f4,01,00,00,01,02,00,00,10,00,00,00,00,00,00,00,00,00,04,00,01,00,00,00,00,\
00,00,00,00,00,00,00
 
Also it would be great if we could import 1 registry file for all hives!
Just a suggestion.
 
osfixer

Edited by osfixer, 3 weeks ago.


#228 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 3 weeks ago

I also found a bug.. offlinereg ignores comments in .reg files!

It adds commented entries as well. 

 

offlinereg-win64.exe "SOFTWARE" " " import software.reg


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"DelaySendToMenuBuild"=dword:00000001
"HubMode"=dword:00000001
; [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard]
; "HideWizard"=dword:00000001
; 
; [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
; "SvcHostSplitThresholdInKB"=dword:00000000
; "WaitToKillServiceTimeout"="0"

Edited by osfixer, 3 weeks ago.


#229 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Oops I meant to say it should ignore comments but it does not.` 



#230 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

 

I also found a bug.. offlinereg ignores comments in .reg files!

It adds commented entries as well. 

 

offlinereg-win64.exe "SOFTWARE" " " import software.reg


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"DelaySendToMenuBuild"=dword:00000001
"HubMode"=dword:00000001
; [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\NetworkLocationWizard]
; "HideWizard"=dword:00000001
; 
; [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
; "SvcHostSplitThresholdInKB"=dword:00000000
; "WaitToKillServiceTimeout"="0"

 

Good spot.

Fixed in latest version.

Redownload.



#231 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

Oops I meant to say it should ignore comments but it does not.` 

 

see previous post : issue now fixed :)



#232 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Yay! Thanks!! I will report if I spot any new ones.. (unlikely)



#233 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Did you forget to upload the new version? :D

Maybe this can help (https://github.com/s...aster/reginject) they claim to be

compatible.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Embedded\EmbeddedLogon]
"BrandingNeutral"=dword:00000008
; some comment
"SomeValue"=dword:00000008
C:\Users\Administrator\Desktop\>offlinereg-win64.exe "SOFTWARE" " " import software.reg
[Microsoft\Windows Embedded\EmbeddedLogon]
added -> BrandingNeutral=dword:8
added -> ; some comment=string:
added -> SomeValue=dword:8
saved to SOFTWARE ok

Found some more bugs.

Windows Registry Editor Version 5.00

; some comment
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Embedded\EmbeddedLogon]
"BrandingNeutral"=dword:00000008 ; change branding to 8
; some comment
"SomeValue"=dword:00000008
C:\Users\Administrator\Desktop\>offlinereg-win64.exe "SOFTWARE" " " import software.reg
[Microsoft\Windows Embedded\EmbeddedLogon]
main error:not a valid integer value
Windows Registry Editor Version 5.00

; this doesnt seem to work either (remove and insert)
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\Shell\3D Edit\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,73,00,\
70,00,61,00,69,00,6e,00,74,00,2e,00,65,00,78,00,65,00,20,00,22,00,25,00,31,\
00,22,00,20,00,2f,00,46,00,6f,00,72,00,63,00,65,00,42,00,6f,00,6f,00,74,00,\
73,00,74,00,72,00,61,00,70,00,50,00,61,00,69,00,6e,00,74,00,33,00,44,00,00,\
00

; some comment
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRects3] ; some comment
@=dword:00000001 ; some comment
"Settings"=hex:30,00,00,00,fe,ff,ff,ff,02,34,00,00,03,00,00,00,3e,00,00,00,28,\ ; some comment
00,00,00,00,00,00,00,d8,02,00,00,00,04,00,00,00,03,00,00,60,00,00,00,01,00,\ ; some comment
00,00 ; some comment

; some cmoment
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Embedded\EmbeddedLogon] ; some comment
"BrandingNeutral"=dword:00000008 ; change branding to 8
; some comment
"SomeValue"=dword:00000008

Edited by osfixer, 2 weeks ago.


#234 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

If you download from my website (here) you will get latest zip/binaries from today.

I will check reboot.pro links shortly.

Edit: download link is ok. I need to refresh the version number and history on reboot.pro.



#235 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

New bug? It won't delete the entry at all. It creates it instead?

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount]

[HKEY_CURRENT_USER\Control Panel\Desktop]
"ForegroundLockTimeout"=dword:00000000
"ActiveWndTrackTimeout"=dword:00000000
Windows Registry Editor Version 5.00

;  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
; "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000000 ; this comment will cause error

Edited by osfixer, 2 weeks ago.


#236 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

 

New bug? It won't delete the entry at all. It creates it instead?

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount]

[HKEY_CURRENT_USER\Control Panel\Desktop]
"ForegroundLockTimeout"=dword:00000000
"ActiveWndTrackTimeout"=dword:00000000
Windows Registry Editor Version 5.00

;  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
; "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000000 ; this comment will cause error

 

 

did not notice the '-' at first.

offlinereg does not manage this for now.

 

the idea for now it to import in a "raw" mode (said differently : in a "dumb" mode :) ).



#237 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Ohhh. :(((

So we cannot delete keys with import? :(((


Edited by osfixer, 2 weeks ago.


#238 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

Ohhh. :(((

So we cannot delete keys with import? :(((

 

not using the "import" command for now.

import is there to import data in a batch mode but does have the same logic you would fine in reg.exe



#239 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Is it planned? Thanks. For me back to reg.exe! 

This tool was too good to be true :D

 

But there is an alternative! 

https://github.com/steve4444/RegInject


Edited by osfixer, 2 weeks ago.


#240 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

latest version supports importing keys like [-HKEY_LOCAL_MACHINE\SOFTWARE\toto] .

 

it will actually delete the key.

 

did not yet implement the delete value syntax.



#241 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Yay! Much thanks! I will test right now.

 

Edit: What you can also do is, to further improve (when you have time)..

 

- Maybe non-verbose output..

- Output new hive as HIVE.new, instead of replace (good for quick testing)

 

Ou, it does this yes.

C:\Users\Administrator\Desktop\Hive>offlinereg-win64 "NTUSER.DAT" " " import test.reg
[Control Panel\Desktop]
added -> Wallpaper=string:-
saved to NTUSER.DAT ok

Edited by osfixer, 2 weeks ago.


#242 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago


latest version will now support deleting both keys and values using the '-' character.

 

example below.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\titi]

[HKEY_LOCAL_MACHINE\SOFTWARE\toto]
"Testval"=-


#243 dodenko

dodenko

    Newbie

  • Validating
  • 22 posts
  •  
    Russian Federation

Posted 2 weeks ago

Will test now.. 



#244 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted 2 weeks ago

Will test now.. 

 

pfiew... how did you do that? :)

you replied back in less than a minute !!

 

and so did i !! how did i do that !? :)


  • osfixer likes this

#245 dodenko

dodenko

    Newbie

  • Validating
  • 22 posts
  •  
    Russian Federation

Posted 2 weeks ago

Gmail notifications! :D :D



#246 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Uh la la! Very good!

But you should make it quiet if it doesn't find the key.. 

could not open SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount
createkey failed:2: ... 

Edited by osfixer, 2 weeks ago.


#247 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

Found another bug (?)

 

It seems that the tool doesn't delete if key is not empty?

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]

C:\Users\Administrator\Desktop\Hive>offlinereg-win64.exe "SOFTWARE" " " import test.reg
[-Microsoft]
deletekey:Microsoft
ORDeleteKey failed:1020: ...
saved to SOFTWARE ok


#248 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted 2 weeks ago

You forgot to enumerate the sub keys.. 



#249 osfixer

osfixer

    Member

  • Members
  • 31 posts
  •  
    United Kingdom

Posted A week ago

 

Found another bug (?)

 

It seems that the tool doesn't delete if key is not empty?

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft]

C:\Users\Administrator\Desktop\Hive>offlinereg-win64.exe "SOFTWARE" " " import test.reg
[-Microsoft]
deletekey:Microsoft
ORDeleteKey failed:1020: ...
saved to SOFTWARE ok

 

 

Has this been fixed yet?



#250 erwan.l

erwan.l

    Gold Member

  • Developer
  • 2452 posts
  • Location:Nantes - France
  •  
    France

Posted A week ago

Has this been fixed yet?

 

Nop.

 

I do this on my spare time and I am very picky when it comes to "what to do with my spare time" :)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users