regedith

#!/usr/bin/awk -f

function pathclose(s, v) {
    if (length(s)) {
    script=script "setval " v "\n" s;
    }
}

BEGIN {
    err=0;
    if (ARGC!=3) {
    print("regedith regfile(text) hivefile(bin)") >"/dev/stderr";
    err=1;
    exit 1;
    }
    hivefile=ARGV[2];
    ARGC=2;
    FS="";
    inkey=0;
    script="";
}

FNR==1 && $0 != "Windows Registry Editor Version 5.00" {
    err=1;
    exit 1;
}

!inkey && /^\[HKEY_LOCAL_MACHINE\\SYSTEM\\.*\]$/ {
    inkey=1;
    testcommand="cd \\";
    pth=substr($0, 2, length($0)-2);
    cnt=split(pth, dirs, "\\");
    for (i=3; i<cnt; i++) {
    if (i!=3) {
        testcommand=testcommand "\\"
    }
    testcommand=testcommand dirs[i];
    }
    testcommand=testcommand " \n"
    script=script testcommand;
    testcommand=testcommand "cd " dirs[cnt] "\nclose\nexit\n";
    if (system("echo '" testcommand "' | /usr/bin/hivexsh " hivefile " &>/dev/null")) {
    script=script "add " dirs[cnt] "\n";
    }
    script=script "cd " dirs[cnt] "\n";
    valnum=0;
    escape=0;
    s="";
}

inkey {
    if(!escape) {
    if (!length($0)) {
        inkey=0;
        pathclose(s, valnum);
        s="";
        next;
    }
    quote=0;
    key=1;
    value=0;
    }
    escape=0;
    for (i=1; i<=NF; i++) {
    if (!escape && $i=="\\") {
        escape=1;
        continue;
    }
    if (!quote && !escape && $i=="\"") {
        quote=1;
        if (!key) {
        value=1;
        type="string";
        s=s "string:"
        valnum++;
        }
        continue;
    }
    if (quote) {
        if (!escape && $i=="\"") {
        if (key) {
            s=s "\n";
        }
        quote=0;
        continue;
        }
        s=s $i;
        escape=0;
        continue;
    }
    if (!quote && !value) {
        switch($i) {
        case "=": {
            key=0;
            type="";
            break;
        }
        case ":": {
            value=1;
            valnum++;
            switch (type) {
            case "none": {
                s=s "none";
                break;
            }
            case "dword": {
                s=s "dword:0x";
                break;
            }
            case "qword": {
                s=s "qword:0x";
                break;
            }
            case "hex(1)": {
                s=s "hex:1:";
                break;
            }
            case "hex(2)": {
                s=s "hex:2:";
                break;
            }
            }
            break;
        }
        default: {
            type=type $i;
        }
        }
        escape=0;
        continue;
    }
    if (!quote && value) {
        s=s $i;
        escape=0;
    }
    }
    if (!escape && value) {
    s=s "\n";
    }
}

END {
    if (err) {
    exit 1;
    }
    pathclose(s, valnum);
    script=script "commit\nclose\nexit\n";
    system("echo '" script "' | /usr/bin/hivexsh -w " hivefile " &>/dev/null");
#    print("echo '" script "' | /usr/bin/hivexsh -w " hivefile " &>/dev/null");
}