Re^2: Finding Hidden Keys in Your Windows Registry

Well, I was able to find those keys with the second script, but the delete part needs some work to catch them. Good thing that isn't the issue I'm trying to solve. ;-)

Here's the fixed version:


use Win32::TieRegistry(Delimiter=>'/');
$| = 1;

sub process_hidden
{
  my ($root, $tgt) = @_;
  print "HIDDEN REGISTRY KEY FOUND:\n$root/$tgt\n\n";
  print "Delete or Keep? [D/k]  ";
  $_=<>;
  chomp;
  if ( ! /k/i )
  {
    delete $Registry->{$root}->{$tgt};
  }
}

sub check_content
{
   for ( keys %{$Registry->{$root}} )
   {
      &check_content("$root/$_")   if exists $Registry->{"$root/$_/"};
      &process_hidden($root,$_)  if (length($_) > 256
                                 ||  index($_,"\0") >= 0);
   }
}


&check_content("CUser/TEST/");
[download]

Also, my regedit had no problem deleting that key ... perhaps that is an old bug? The page you reference is from 1999 ...

The intelligent reader will judge for himself. Without examining the facts fully and fairly, there is no way of knowing whether vox populi is really vox dei, or merely vox asinorum. -- Cyrus H. Gordon

Comment on Re^2: Finding Hidden Keys in Your Windows Registry Download Code

Replies are listed 'Best First'.
Re^3: Finding Hidden Keys in Your Windows Registry by davidrw (Prior) on Aug 25, 2005 at 18:14 UTC
hmm.. my regedit32 on windowsXP threw an error trying to delete it.. That site tends to stay up to date; and if you haven't poked around there, has some really great windows utilities including RegMon and FileMon -- well worth the time to browse their utilities section.	[reply]
Re^3: Finding Hidden Keys in Your Windows Registry by QM (Parson) on Aug 26, 2005 at 15:12 UTC
One nit... `if ( ! /k/i )` [download] The "anything but /k/i deletes" mentality is not friendly to big fat fingers. Since this is the registry, I'd be extra cautious about BFFS (Big Fat Finger Syndrome). -QM -- Quantum Mechanics: The dreams stuff is made of	[reply] [d/l]


Syntactic Confectionery Delight
	PerlMonks