regtool — View or edit the Windows registry
regtool [OPTION] (add|check|get|list|remove|unset|load|unload|save) KEY
Actions: add KEY\SUBKEY add new SUBKEY check KEY exit 0 if KEY exists, 1 if not get KEY\VALUE prints VALUE to stdout list KEY list SUBKEYs and VALUEs remove KEY remove KEY set KEY\VALUE [data ...] set VALUE unset KEY\VALUE removes VALUE from KEY load KEY\SUBKEY PATH load hive from PATH into new SUBKEY unload KEY\SUBKEY unload hive and remove SUBKEY save KEY\SUBKEY PATH save SUBKEY into new file PATH restore KEY\SUBKEY PATH restore SUBKEY from file PATH Options for 'list' Action: -k, --keys print only KEYs -l, --list print only VALUEs -p, --postfix like ls -p, appends '\' postfix to KEY names Options for 'get' Action: -b, --binary print REG_BINARY data as hex bytes -n, --none print data as stream of bytes as stored in registry -x, --hex print numerical data as hex numbers Options for 'set' Action: -b, --binary set type to REG_BINARY (hex args or '-') -D, --dword-be set type to REG_DWORD_BIG_ENDIAN -e, --expand-string set type to REG_EXPAND_SZ -i, --integer set type to REG_DWORD -m, --multi-string set type to REG_MULTI_SZ -n, --none set type to REG_NONE -Q, --qword set type to REG_QWORD -s, --string set type to REG_SZ Options for 'set' and 'unset' Actions: -K<c>, --key-separator[=]<c> set key separator to <c> instead of '\' Options for 'restore' action: -f, --force restore even if open handles exist at or beneath the location in the registry hierarchy to which KEY\SUBKEY points Other Options: -h, --help output usage information and exit -q, --quiet no error output, just nonzero return if KEY/VALUE missing -v, --verbose verbose output, including VALUE contents when applicable -w, --wow64 access 64 bit registry view (ignored on 32 bit Windows) -W, --wow32 access 32 bit registry view (ignored on 32 bit Windows) -V, --version output version information and exit KEY is in the format [host]\prefix\KEY\KEY\VALUE, where host is optional remote host in either \\hostname or hostname: format and prefix is any of: root HKCR HKEY_CLASSES_ROOT (local only) config HKCC HKEY_CURRENT_CONFIG (local only) user HKCU HKEY_CURRENT_USER (local only) machine HKLM HKEY_LOCAL_MACHINE users HKU HKEY_USERS You can use forward slash ('/') as a separator instead of backslash, in that case backslash is treated as escape character Example: regtool get '\user\software\Microsoft\Clock\iFormat'
The regtool program allows shell scripts to access and modify the Windows registry. Note that modifying the Windows registry is dangerous, and carelessness here can result in an unusable system. Be careful.
-v option means "verbose". For most commands,
this causes additional or lengthier messages to be printed. Conversely,
-q option supresses error messages, so you can use
the exit status of the program to detect if a key exists or not (for
-w option allows you to access the 64 bit view
of the registry. Several subkeys exist in a 32 bit and a 64 bit version
when running on Windows 64. Since Cygwin is running in 32 bit mode, it
only has access to the 32 bit view of these registry keys. When using the
-w switch, the 64 bit view is used and
regtool can access the entire registry. This option is
simply ignored when running on 32 bit Windows versions.
-W option allows you to access the 32 bit view
on the registry. The purpose of this option is mainly for symmetry. It
permits creation of OS agnostic scripts which would also work in a
hypothetical 64 bit version of Cygwin.
You must provide regtool with an
action following options (if any). Currently, the
action must be
add action adds a new key. The
check action checks to see if a key exists (the exit
code of the program is zero if it does, nonzero if it does not). The
get action gets the value of a key, and prints it (and
nothing else) to stdout. Note: if the value doesn't exist, an error
message is printed and the program returns a non-zero exit code. If you
-q, it doesn't print the message but does return
the non-zero exit code.
list action lists the subkeys and values
belonging to the given key. With
-k option instructs regtool to
print only KEYs, and the
-l option to print only
-p option postfixes a
'/' to each KEY, but leave VALUEs with no postfix. The
remove action removes a key. Note that you may need to
remove everything in the key before you may remove it, but don't rely on
this stopping you from accidentally removing too much.
get action prints a value within a key. With
-b option, data is printed as hex bytes.
-n allows to print the data as a typeless stream of
bytes. Integer values (REG_DWORD, REG_QWORD) are usually printed as
decimal values. The
-x option allows to print the
numbers as hexadecimal values.
set action sets a value within a key.
-b means it's binary data (REG_BINARY). The binary
values are specified as hex bytes in the argument list. If the argument
'-', binary data is read from stdin instead.
-i means the value is a 32
bit integer value (REG_DWORD).
-D means the value is a
32 bit integer value in Big Endian representation (REG_DWORD_BIG_ENDIAN).
-Q means the value is a 64 bit integer value
-s means the value is a string (REG_SZ).
-e means it's an expanding string (REG_EXPAND_SZ) that
contains embedded environment variables.
-m means it's
a multi-string (REG_MULTI_SZ). If you don't specify one of these,
regtool tries to guess the type based on the value you
give. If it looks like a number, it's a DWORD, unless it's value doesn't
fit into 32 bit, in which case it's a QWORD. If it starts with a percent,
it's an expanding string. If you give multiple values, it's a
multi-string. Else, it's a regular string.
unset action removes a value from a
load action adds a new subkey and loads the
contents of a registry hive into it. The parent key must be
HKEY_LOCAL_MACHINE or HKEY_USERS. The
unloads the file and removes the subkey.
save action saves a subkey into a registry
file. Ideally you append the suffix
.reg to the file
so it gets automatically recognized as registry file by
restore action restores a registry subkey
from a file saved via the aforementioned
By default, the last "\" or "/" is assumed to be the separator
between the key and the value. You can use the
option to provide an alternate key/value separator character.