Windows Registry Reader

Hi, I came across your post on hivex:

We’re using Winclone to deploy Windows to many labs and I’d like a way to determine the current version of Windows that is installed (e.g. we have 1803 right now and are migrating to 1903). Is this tool you’ve made, “registry_lookup”, available anywhere?

Sure! Winclone Pro installs the tool in each image:

Winclone.winclone/tools/bin/registry_lookup

If you run it, it gives usage:

registry_lookup Usage:

registry_lookup

Example:

registry_lookup “/Volumes/Bootcamp/Windows/System32/config/SOFTWARE” “Microsoft/Windows NT/CurrentVersion” “ProductName”

we use it like this:

registry_lookup “/Volumes/Bootcamp/Windows/System32/config/SOFTWARE” “Microsoft/Windows NT/CurrentVersion” “EditionID”

registry_lookup “/Volumes/Bootcamp/Windows/System32/config/SOFTWARE” “Microsoft/Windows NT/CurrentVersion” “BuildLabEx”

registry_lookup “/Volumes/Bootcamp/Windows/System32/config/SOFTWARE” “Microsoft/Windows NT/CurrentVersion” “CurrentBuildNumber”

Hope that helps!

tim

Ah, that’s great - thanks so much!

1 Like