regmon used to have a neat feature where it could open regedit and navigate the treeview to the registry key it was displaying.
turns out Mark spun it off into its own command line utility as well called regjump: https://learn.microsoft.com/en-us/sy...nloads/regjump
here is a quick vb version for newer versions of regedit that have the path textbox at the top.
the old xp compatible regmon version used to send keys to the treeview
turns out Mark spun it off into its own command line utility as well called regjump: https://learn.microsoft.com/en-us/sy...nloads/regjump
here is a quick vb version for newer versions of regedit that have the path textbox at the top.
the old xp compatible regmon version used to send keys to the treeview
Code:
Option Explicit
'demo form needs a button, listbox, and textbox all with default names..
Private Declare Function IsWindow Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWndParent As Long, ByVal hWndChildAfter As Long, ByVal lpszClassName As String, ByVal lpszWindowName As String) As Long
Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Private Declare Function SetForegroundWindow Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function SetFocus2 Lib "user32" Alias "SetFocus" (ByVal hwnd As Long) As Long
Private Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Private Declare Function ShowWindow Lib "user32" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
Private Declare Function IsIconic Lib "user32" (ByVal hwnd As Long) As Long
Private Const SW_RESTORE = 9
Private Const WM_KEYDOWN = &H100
Private Const WM_SETFOCUS = &H7
Private Const WM_CHAR = &H102
Private Const WM_PASTE = &H302
Private Const EM_SETSEL = &HB1
Private Const VK_RETURN = &HD
Private Sub Form_Load()
Text1 = "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
End Sub
Private Sub Command1_Click()
Dim regedit As Long, edit As Long, pid As Long
Dim path As String
List1.Clear
List1.AddItem "Started " & Now
path = ExpandPath(Text1)
regedit = FindChild("RegEdit_RegEdit")
List1.AddItem "expanded path = " & path
List1.AddItem "regedit = " & Hex(regedit)
If Not isValid(regedit) Then
List1.AddItem "regedit not found opening..."
pid = Shell("regedit.exe", vbNormalFocus)
If pid = 0 Then
List1.AddItem "Failed to start regedit?"
Exit Sub
End If
Sleep 800
regedit = FindChild("RegEdit_RegEdit")
List1.AddItem "regedit = " & Hex(regedit)
If Not isValid(regedit) Then
List1.AddItem "started but still cant find permission?"
Exit Sub
End If
End If
If IsIconic(regedit) Then
List1.AddItem "Regedit was minimized restoring..."
ShowWindow regedit, SW_RESTORE
End If
SetForegroundWindow regedit
SetFocus2 regedit
edit = FindChild("Edit", regedit)
List1.AddItem "edit = " & Hex(edit)
If Not isValid(edit) Then
List1.AddItem "Cant find edit window?"
Exit Sub
End If
Clipboard.Clear
Clipboard.SetText path
SendMessage edit, EM_SETSEL, 0, 1000
SendMessage edit, WM_PASTE, 0, 0
SendMessage edit, WM_KEYDOWN, VK_RETURN, 0
List1.AddItem "done.."
End Sub
Function ExpandPath(path As String) As String
Dim prefix As String
ExpandPath = path
prefix = UCase(Left(path, 4))
If prefix = "HKLM" Then
ExpandPath = Replace(path, "HKLM\", "HKEY_LOCAL_MACHINE\", 1, 1, vbTextCompare)
ElseIf prefix = "HKCU" Then
ExpandPath = Replace(path, "HKCU\", "HKEY_CURRENT_USER\", 1, 1, vbTextCompare)
ElseIf prefix = "HKCC" Then
ExpandPath = Replace(path, "HKCC\", "HKEY_CURRENT_CONFIG\", 1, 1, vbTextCompare)
ElseIf prefix = "HKCR" Then
ExpandPath = Replace(path, "HKCR\", "HKEY_CLASSES_ROOT\", 1, 1, vbTextCompare)
ElseIf prefix = "HKU\" Then
ExpandPath = Replace(path, "HKU\", "HKEY_USERS\", 1, 1, vbTextCompare)
End If
End Function
Function FindChild(ByVal className As String, Optional parentHwnd As Long = 0) As Long
FindChild = FindWindowEx(parentHwnd, 0&, className, vbNullString)
End Function
Function isValid(hwnd As Long) As Boolean
isValid = Not (IsWindow(hwnd) = 0)
End Function