How do I use Python to retrieve Registry values?

问题

I have written this code so far;

from _winreg import *

def val2addr(val):
    addr = ''
    for ch in val:
        addr += '%02x '% ord(ch)
    addr = addr.strip(' ').replace(' ', ':')[0:17]
    return addr

def printNets():
    net = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"+\
          "\NetworkList\Signatures\Unmanaged"
    key = OpenKey(HKEY_LOCAL_MACHINE, net)
    print '\n[*] Networks You Have Joined.'
    for i in range(100):
        try:
            guid = EnumKey(key, i)
            netKey = OpenKey(key, str(guid))
            (n, addr, t) = EnumValue(netKey, 5)
            (n, name, t) = EnumValue(netKey, 4)
            macAddr = val2addr(addr)
            netName = str(name)
            print '[+] ' + netName + ' ' + macAddr
            CloseKey(netKey)
        except:
            break
def main():
    printNets()
if __name__ == "_main_":
    main()

This script returns the MAC addresses and network names of all the WiFi networks you have joined.

It returns values from

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows >NT\CurrentVersion\NetworkList\Signatures\Unmanaged\

I am on Windows 8.1 and I have checked through Regedit.exe to make sure this is the correct location for the info I am retrieving.

When I run this code it says "WindowsError: [Error 2] The system cannot find the file specified"

So what is it I am doing wrong?

P.S I am on Python 2.7.9

Full Traceback

Traceback (most recent call last):

File "<pyshell#11>", line 1, in <module>
    printNets()
  File "C:/Users/Nathaniel/Desktop/MacAddr Meta-Reader.py", line 13, in printNets
    key = OpenKey(HKEY_LOCAL_MACHINE, net)
WindowsError: [Error 2] The system cannot find the file specified

回答1:

You're probably using 32-bit Python on 64-bit Windows. In this case opening HKLM\SOFTWARE gets redirected to HKLM\SOFTWARE\Wow6432Node. You have to specify otherwise if you want the 64-bit key. For example:

key = OpenKey(HKEY_LOCAL_MACHINE, net, 0, 
              KEY_READ | KEY_WOW64_64KEY)

Note that for subkeys opened relative to this key object, it isn't strictly necessary to specify KEY_WOW64_64KEY.

I ported your code to run in both Python 2 and 3, added iterators, and eliminated the hard-coded range and index values. Maybe you'll find it helpful:

from __future__ import print_function
import itertools

try:
    from winreg import *
except ImportError: # Python 2
    from _winreg import *

KEY_READ_64 = KEY_READ | KEY_WOW64_64KEY
ERROR_NO_MORE_ITEMS = 259

def iterkeys(key):
    for i in itertools.count():
        try:
            yield EnumKey(key, i)
        except OSError as e:
            if e.winerror == ERROR_NO_MORE_ITEMS:
                break
            raise

def itervalues(key):
    for i in itertools.count():
        try:
            yield EnumValue(key, i)
        except OSError as e:
            if e.winerror == ERROR_NO_MORE_ITEMS:
                break
            raise

def val2addr(val):
    return ':'.join('%02x' % b for b in bytearray(val))

NET_UNMANAGED = (r"SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                 r"\NetworkList\Signatures\Unmanaged")

def printNets(keystr=NET_UNMANAGED):
    key = OpenKey(HKEY_LOCAL_MACHINE, keystr, 0, KEY_READ_64)
    print('\n[*] Networks You Have Joined.')
    for guid in iterkeys(key):
        netKey = OpenKey(key, guid)
        netName, macAddr = '', ''
        for name, data, rtype in itervalues(netKey):
            if name == 'FirstNetwork':
                netName = data
            elif name == 'DefaultGatewayMac':
                macAddr = val2addr(data)
        if netName:
            print('[+]', netName, macAddr)
        CloseKey(netKey)
    CloseKey(key)

The key's security descriptor only allows access to administrators and the netprofm service, as shown below. So you either need to run the script from an elevated command prompt or use a technique to have the script autoelevate.

C:\>set NT=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion    

C:\>accesschk -qldk "%NT%\NetworkList\Signatures\Unmanaged" 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
NetworkList\Signatures\Unmanaged
  DESCRIPTOR FLAGS:
      [SE_DACL_PRESENT]
      [SE_DACL_PROTECTED]
  OWNER: BUILTIN\Administrators
  [0] ACCESS_ALLOWED_ACE_TYPE: NT SERVICE\netprofm
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        KEY_QUERY_VALUE
        KEY_CREATE_LINK
        KEY_CREATE_SUB_KEY
        KEY_ENUMERATE_SUB_KEYS
        KEY_NOTIFY
        KEY_SET_VALUE
        READ_CONTROL
        DELETE
  [1] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\Administrators
          [CONTAINER_INHERIT_ACE]
          [INHERITED_ACE]
        KEY_ALL_ACCESS

C:\>sc qdescription netprofm     
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: netprofm
DESCRIPTION:  Identifies the networks to which the computer has
connected, collects and stores properties for these networks, 
and notifies applications when these properties change.

回答2:

Do you have administrator privileges? I tried walking down the tree with "reg query" to make sure that I didn't have a spelling problem and when I got to "NetworkList" I got an Access denied error. I changed to administrator privileges and everything was fine.

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList
ERROR: Access is denied.

来源：https://stackoverflow.com/questions/28128446/how-do-i-use-python-to-retrieve-registry-values

标签

python

windows

python-2.7

regedit