0

On Linux, with winexe i need to get the value of a registry key.

The path to the reg key contains spaces.

I use this command :

/usr/bin/winexe -U domain/user%"password" //host 'REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates" /v ScheduleDay'

i tried with simple quotes, doubles quotes, mix of both of them but i keep getting the message that the key is not valid.

on windows i tried this and it works :

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates" /v ScheduleDay

How can i handle correctly spaces in bash with winexe ?

Raidri
  • 17,258
  • 9
  • 62
  • 65
gbxxx
  • 11
  • 5

2 Answers2

0

Try double-quoting folders with spaces like this :

/usr/bin/winexe -U domain/user%"password" //host 'REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\"Microsoft Antimalware"\"Signature Updates"" /v ScheduleDay'

It may work, I am not sure. Can you please post exactly the error output?

EDIT: Try this :

/usr/bin/winexe -U domain/user%"password" //host '"REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates" /v ScheduleDay"'

Note that spaces are the problem, try double-quoting commands until something succeeds. Again tell us the error output if it fails.

Leajian
  • 129
  • 9
  • thank you for your reply but with your command i have : "ERREUR▒: syntaxe incorrecte" (syntax error). In my other tests i have : "ERREUR▒: non de clé non valide" (invalid key) and "Error: error Creating process" – gbxxx May 30 '13 at 07:14
  • tested your EDIT : Error: error Creating process("REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates" /v ScheduleDay") 2 – gbxxx May 31 '13 at 12:50
0

I was misled by another problem.

My winexe is a 32 bits application which is running the 32 bits reg.exe on a 64 bits remote system (windows server 2003).

In this context, the key "HKEY_LOCAL_MACHINE\SOFTWARE" is silently pointing on the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node Key of my remote system.

This is caused by the registry redirector of windows

http://msdn.microsoft.com/en-us/library/windows/desktop/aa384232%28v=vs.85%29.aspx

To avoid this redirection i had to force the use of the 64 bits reg.exe like this :

/usr/bin/winexe -U domain/login%"password" //host '**cmd /C %WINDIR%\sysnative\reg.exe** "QUERY" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Signature Updates"'
gbxxx
  • 11
  • 5