Script to get string from Windows registry value with hexadecimal values

Script to get string from Windows registry value with hexadecimal values

6,687586
Grand MasterGrand Master
6,687586

    Jan 14, 2016#1

    Do you have exported a Windows registry key or entire Windows registry to a *.reg file which contains for example

    Code: Select all

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
    "Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
      00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,3b,00,25,00,\
      53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,3b,00,25,\
      00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,\
      73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00,65,00,6d,\
      00,00,00
    
    or

    Code: Select all

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
    "PendingFileRenameOperations"=hex(7):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\
      50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\
      00,5c,00,49,00,44,00,4d,00,20,00,43,00,6f,00,6d,00,70,00,75,00,74,00,65,00,\
      72,00,20,00,53,00,6f,00,6c,00,75,00,74,00,69,00,6f,00,6e,00,73,00,5c,00,55,\
      00,6c,00,74,00,72,00,61,00,45,00,64,00,69,00,74,00,5c,00,75,00,65,00,33,00,\
      32,00,63,00,74,00,6d,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00,00,00,5c,00,3f,\
      00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
      20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,49,00,44,00,4d,00,20,00,43,00,6f,\
      00,6d,00,70,00,75,00,74,00,65,00,72,00,20,00,53,00,6f,00,6c,00,75,00,74,00,\
      69,00,6f,00,6e,00,73,00,5c,00,55,00,6c,00,74,00,72,00,61,00,45,00,64,00,69,\
      00,74,00,5c,00,75,00,65,00,36,00,34,00,63,00,74,00,6d,00,6e,00,2e,00,64,00,\
      6c,00,6c,00,00,00,00,00,00,00
    
    and you want to know what is Path and which pending file rename operations are configured for next Windows restart?

    Then UltraEdit / UEStudio script GetStringFromRegHex.js can help you.

    This script can be viewed and downloaded from Macros & Scripts page on clicking on Get string from registry value with hexadecimal values.

    This script converts a Windows registry value with hexadecimal values either selected in an active Windows registry file or just present in active clipboard to a readable string written by default to active output window.

    Supported are registry files / clipboard contents in the formats:
    • ANSI ... REGEDIT4 in first line of *.reg file
    • Unicode ... Windows Registry Editor Version 5.00 in first line of *.reg file
    Supported are registry values of following types:
    • hex(2) ... REG_EXPAND_SZ ... string containing references to values of environment variables which need to be expanded.
    • hex(6) ... REG_LINK ... a symbolic registry link, honestly never seen in a *.reg file and therefore not tested.
    • hex(7) ... REG_MULTI_SZ ... one or more null terminated strings.
    The output can be written to
    • output window – default, not for strings with non ASCII/ANSI characters,
    • a new file,
    • active clipboard.
    It is even possible to output the single string or the multiple strings to output window, new file and clipboard at once.

    The script works even for the first versions of UltraEdit for Windows and UEStudio with support for scripts although it was really hard and time expensive to find workarounds for various scripting issues in UE for Windows v13.00 to v14.10 and UES v6.20 to v6.60.

    Add this script after downloading and saving to any directory like %APPDATA%\IDMComp\scripts via Scripting - Scripts to the Script List for easy execution at any time via menu Scripting or the Script List view.

    The selection must begin at start of line with registry value name and must contain at least 1 hexadecimal value after the colon. This script is not written for having just the hexadecimal values selected or copied to clipboard. It is possible to have also lines above and below selected in active file or copied to clipboard as they are ignored by the script.

    Please read the entire introducing comment at top of the script before using it the first time.

    This script contains workarounds for various issues which could be of general interest also for other scripts.

    Problems solved in this script:
    • No support by UltraEdit for Windows < v24.00 and UEStudio < v17.00 to write a JavaScript string with Unicode characters with a code value greater U+00FF to a file or to clipboard.
    • No support by UltraEdit for Windows < v14.20 and UEStudio < v9.00 for direct access of clipboard content.
    • Selected text in a Unicode file copied wrong to a JavaScript string with each byte of UTF-16 LE byte stream being a separate character by UE for Windows < v14.10 and UES < v6.60.
    • UltraEdit for Windows v13.20 and UEStudio v6.40 delete in hex edit mode the bytes on execution of command hexDelete, but the deleted bytes are suddenly back after write being executed next.
    • UltraEdit for Windows < v13.20 and UEStudio < v6.40 append to a file in hex edit mode only bytes up to end of display line on write.
      The workaround for this bug must be extra enabled in script by initializing a boolean variable with value true.
    The line and block comments can be removed from script file by running a replace all (from top of file) searching with Perl regular expression for ^ *//.+[\r\n]+|^ */\*[\s\S]+?\*/[\r\n]+| +//.+$ and using an empty replace string. The first part in this OR expression with three arguments matches entire lines containing only a line comment, the second part matches block comments, and third part matches line comments right to code. Removal of the comments makes the usage of this script more efficient on using it often because of JavaScript interpreter has to interpret less characters and lines.

      Sep 10, 2018#2

      The script GetStringFromRegHex.js was updated on 2018-09-09 with following changes:
      1. UltraEdit for Windows ≥ v24.00 and UEStudio ≥ v17.00 support read/write of Unicode characters with a Unicode code value greater U+00FF directly from/to clipboard, document (text file) and output window. The script was extended to make automatically use of this enhancement on writing a registry value with Unicode characters to output window (added feature), clipboard or a new file without using any workaround.
        The variable bUnicodeAware was added with true as default value. Users of UltraEdit for Windows < v24.00 and UEStudio < v17.00 should change the value of this variable to false. But the script contains code to automatically detect if used version of UltraEdit / UEStudio is full Unicode aware in scripting environment and for that reason the default value can be also kept as is. The script sets automatically bUnicodeAware to false on detecting that used version of UE/UES does not support direct write of Unicode strings to clipboard, file and output window.
      2. Automatic conversion of a new file to ANSI or UTF-16 depending on decoded registry value string with DOS line endings had not worked in first version of the script on new file being created as UTF-8 encoded file and with UNIX or MAC instead of DOS line endings according to user's configuration. This issue is fixed by additional code to convert a new file from UTF-8 to ASCII if appropriate scripting command (function) is supported by used version of UE/UES and by converting line ending to DOS after changing the character encoding.
      3. Description at top and some comments were improved and new comments have been added regarding to full Unicode awareness in scripting environment.

        Nov 14, 2018#3

        Some small improvements have been made on code of script GetStringFromRegHex with no functional effect on execution on 2018-11-14.
        Best regards from an UC/UE/UES for Windows user from Austria