China DOS Union

Determine whether there is an item with the value "Sysin" under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\" in the registry, the key value is "Wins" (string), the type is "REG_SZ", and the value is "mondy".

1. If it exists, continue to execute (jump to the next instruction), if not, create a new one --- (exact match, including case)
For example, the item value is "Sysin" and cannot be "sysin" or other, the key value is "Wins" and cannot be "wins" or other, the value is "mondy" and cannot be "Mondy" or other

2. If it exists, continue to execute (jump to the next instruction), if not, create a new one --- (case-insensitive)

Urgently need to be solved, thank you!

[ Last edited by Mekinery on 2007-12-24 at 09:36 PM ]

```batch
@echo off
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Sysin" ||call :No
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins" ||call :StillNo
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "mondy" ||goto :NoMore

echo Continue here
pause

:No
reg add "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f /v "Wins" /t REG_SZ /d "mondy"
goto:eof

:StillNo
reg delete "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f /v "Wins" /t REG_SZ /d "mondy"
goto:eof

:NoMore
echo Go find Gates ◎＿◎
pause
```

fastslz is quite humorous. First of all, thank you again for fastslz, but it didn't achieve the result I wanted.
Maybe I didn't explain it clearly enough, then I'll simplify it a bit more:
Check if there is a string value named Wins with type REG_SZ and value mondy under the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin".
Once again, confirm that there is a string, the name is "Wins", not "wins, WIns, ..", and the type is definitely "REG_SZ", not "REG_DWORD, REG_MULTI_SZ, REG_BINARY, REG_EXPAND_SZ, ...", and the data value of the key "Wins" is "mondy", not "Mondy, moNdy, ..."
String Type REG_SZ
Binary value Type REG_BINARY
DWORD Type REG_DWORD
...
It should need to search and judge, right?
If any item doesn't match, it should exit. If all match, then jump to the command segment to be executed.
This should be easier to understand...

[ Last edited by Mekinery on 2007-12-24 at 07:08 PM ]

Complete Registry Operation Methods
This is a demonstration example of WMI operating the registry. After each dialog box pops up, you will find the operations of WMI on the registry by checking the corresponding location in the registry. After all operations are completed, the script will automatically restore all operations of this script on the registry.

① Create primary keys, create key values of various types.

② Read key values and analyze key value types.

③ Enumerate primary keys and key values.

④ Determine whether a key or key value exists.

⑤ Query the operation permissions of the registry key.

⑥ Monitor the registry root key, primary key, and key value, and prompt when changes are found.

'''Registry Query/Operation

On Error Resume Next

Const HKEY_CLASSES_ROOT  = &H80000000'''Set the 5 major root keys of the registry, HKCR-----------①

Const HKEY_CURRENT_USER  = &H80000001'''HKCU

Const HKEY_LOCAL_MACHINE = &H80000002'''HKLM

Const HKEY_Users   = &H80000003'''HKU

Const HKEY_Current_Config  = &H80000005'''HKCC

Const REG_SZ = 1'''Set the registry key value type, string type---------------------------②

Const REG_EXPAND_SZ = 2'''Expanded string type

Const REG_BINARY = 3'''Binary type

Const REG_DWORD = 4'''Double-byte type

Const REG_MULTI_SZ = 7'''Multi-string type

Const KEY_QUERY_VALUE = &H0001'''Registry permission query, query value-----------------③

Const KEY_SET_VALUE = &H0002'''Set value

Const KEY_CREATE_SUB_KEY = &H0004'''Create sub-item

Const DELETE = &H00010000'''Delete item value

'''-----------------Configure environment (path)----------------------------------------00

strComputer = "."

Set WshShell = WScript.CreateObject("WScript.Shell")

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

strKeyRoot = HKEY_LOCAL_MACHINE

Regpath = "HKEY_LOCAL_MACHINE"

strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Run"

WshSHell.popup "Setting path  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create primary key "REG_KEY_SZ"----------------------------------01

strKeyPathNew = "Software\Microsoft\Windows\CurrentVersion\Run\User_baomaboy\"'''Note that because it is a new primary key, add an extra "\"

oReg.CreateKey strKeyRoot, strKeyPathNew

WshSHell.popup "Creating primary key  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create string value "REG_SZ"----------------------------------02

strValueName="1 String name"

strValue="String value"

oReg.SetStringValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "Creating string  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create double-byte value "REG_DWORD"--------------------------------

strValueName="2 Double-byte name"

strValue=1

oReg.SetDWORDValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "Creating double-byte value  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create multi-string "REG_MULTI_SZ"-----------------------------

strValueName="3 Multi-string name"

arrStringValues = Array("QQ25926183", "userbaomaboy","LLKJ", "Linglong Technology")

oReg.SetMultiStringValue strKeyRoot, strKeyPath, strValueName, arrStringValues

WshSHell.popup "Creating multi-string  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create expanded string "REG_EXPAND_SZ"--------------------------

strValueName = "4 Expanded string name"

strValue = "%PATHEXT%"

oReg.SetExpandedStringValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "Creating expanded string  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Create binary value "REG_BINVRY_SZ"----------------------------

RegPathEr=Regpath&"\Software\Microsoft\Windows\CurrentVersion\Run\5 Binary value"

WshSHell.RegWrite RegPathEr,1,"REG_BINARY"

WshSHell.popup "Creating binary value  successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Read string value "REG_VALUE"-------------------------------

oReg.GetStringValue strKeyRoot, strKeyPath, "1 String name", strRunCommand

WshSHell.popup "Reading string value:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Read double-byte value "REG_DWORD"-------------------------------

oReg.GetDWORDValue strKeyRoot, strKeyPath, "2 Double-byte name", strRunCommand

WshSHell.popup "Reading double-byte value:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Read multi-string value "REG_MULTI_SZ"--------------------------

oReg.GetMultiStringValue strKeyRoot, strKeyPath, "3 Multi-string name", arrValues

For Each strValue In arrValues

DuoString=DuoString&vbcrlf&strValue

Next

WshSHell.popup "Reading multi-string value:"&vbcrlf&vbcrlf&DuoString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Read expanded string "REG_EXPAND_SZ"-------------------------

oReg.GetExpandedStringValue strKeyRoot, strKeyPath, "4 Expanded string name", strValue

WshSHell.popup "Reading expanded string value:"&vbcrlf&vbcrlf&strValue&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Read binary value "REG_BINVRY_SZ"----------------------------

oReg.GetBinaryValue strKeyRoot, strKeyPath, "5 Binary value", strValue

For i = lBound(strValue) to uBound(strValue)

ErString=ErString&strValue(i)

Next

WshSHell.popup "Reading binary value:"&vbcrlf&vbcrlf&ErString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Enumerate primary key "SUB_KEY"--------------------------------------

oReg.EnumKey strKeyRoot, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys

ArrSubKeyStr=ArrSubKeyStr&vbcrlf&subkey

Next

WshSHell.popup "Enumerating primary key:"&vbcrlf&vbcrlf&ArrSubKeyStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Enumerate key value and key value type "KEY_Value_Types"--------------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 

For i=0 To UBound(arrValueNames)

If Len(arrValueNames(i)) > 0 Then

Select Case arrValueTypes(i)

Case REG_SZ ValueType=" >>>Is: String value"

Case REG_EXPAND_SZ ValueType=" >>>Is: Expanded string value"

Case REG_BINARY ValueType=" >>>Is: Binary value"

Case REG_DWORD ValueType=" >>>Is: Double-byte value"

Case REG_MULTI_SZ ValueType=" >>>Is: Multi-string value"

End Select

arrValueStr=arrValueStr&vbcrlf&arrValueNames(i)&ValueType

End If

Next

WshSHell.popup "Enumerating key values and types:"&vbcrlf&vbcrlf&arrValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Enumerate key value and key value content one "KEY_Value_Contenct"----------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 

For i=0 To UBound(arrValueNames)

If Len(arrValueNames(i)) > 0 Then

oReg.GetStringValue strKeyRoot,strKeyPath,arrValueNames(i),strValue'''Suitable for string type

ValueStr=ValueStr&vbcrlf&arrValueNames(i)&vbcrlf&strValue

end if

Next

WshSHell.popup "Enumerating key values and content one:"&vbcrlf&vbcrlf&ValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Enumerate key value and key value content two "KEY_Value_Contenct"----------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 

i=0

For Each strValue in arrValueNames

If Len(strValue) > 0 Then

i=i+1

oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand'''Suitable for string type

intLength = Len(strRunCommand)

if intLength > 35 then'''Aesthetic echo, (can add more code to judge whether the path contains broken Chinese characters)

strRunCommand = Left(strRunCommand, 20)&"……"&Right(strRunCommand, 13)

end if

StrRoot= i&".【"&strValue&"】"&vbCRLF&"  "&strRunCommand

ARoot=ARoot&vbCRLF&StrRoot

End If

Next

WshSHell.popup "Enumerating key values and content two:"&vbcrlf&vbcrlf&ARoot&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Delete key value "REG_VALUE"-------------------------------------

oReg.DeleteValue strKeyRoot, strKeyPath, "5 Binary value"

WshSHell.popup "Deleting key value:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&"\5 Binary value"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''----------------- Delete primary key "SUB_KEY"---------------------------------------

oReg.DeleteKey strKeyRoot, strKeyPathNew

WshSHell.popup "Deleting primary key:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPathNew&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''-----------------Judge whether the key value exists-----------------------------------------

strValue="""Virus"""

oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand

If IsNull(strRunCommand) Then  

    WshSHell.popup strValue&"This registry key value does not exist."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

Else  

    WshSHell.popup strValue&"This key value exists in the registry."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

End If 

'''----------------- Check registry access permission "Check Up Extent Of Power"------------

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_QUERY_VALUE, bHasAccessRight

If bHasAccessRight = True Then

aaa="Can query value"

Else

aaa="Cannot query value"

End If         

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_SET_VALUE, bHasAccessRight

If bHasAccessRight = True Then

bbb="Can set value"

Else

bbb="Cannot set value"

End If         

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_CREATE_SUB_KEY, bHasAccessRight

If bHasAccessRight = True Then

ccc="Can create primary key"

Else

ccc="Cannot create primary key"

End If

oReg.CheckAccess strKeyRoot, strKeyPath, DELETE, bHasAccessRight

If bHasAccessRight = True Then

ddd="Can delete key value"

Else

ddd="Cannot delete key value"

End If

WshSHell.popup "Registry access permission:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&vbcrlf&vbcrlf&aaa&vbcrlf&bbb&vbcrlf&ccc&vbcrlf&ddd&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64

'''－－－－－Restore registry to original state--------

oReg.DeleteValue strKeyRoot, strKeyPath, "4 Expanded string name"

oReg.DeleteValue strKeyRoot, strKeyPath, "3 Multi-string name"

oReg.DeleteValue strKeyRoot, strKeyPath, "2 Double-byte name"

oReg.DeleteValue strKeyRoot, strKeyPath, "1 String name"

'''-----------------Monitor registry key value "REG_KEY_SZ"-------------------------------

'''Used to monitor all changes in the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 String name" branch in the registry.

'Set wmiServices = GetObject("winmgmts:root/default") 

'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 

'wmiServices.ExecNotificationQueryAsync wmiSink, _ 

    '"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ 

    '"KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' AND ValueName='1 String name'" 

'WScript.Echo "Start monitoring changes in the value of the HKLM_Run primary key value in the registry......" & vbCrLf 

'While(1) 

    'WScript.Sleep 1000 

'Wend 

'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 

    'WScript.Echo ".........Registry changed......" & vbCrLf & _ 

                 '"----------Monitor changes in the value of the registry key value-----------" & vbCrLf & _ 

                 'wmiObject.GetObjectText_() 

'WScript.Quit(0)'''Used to exit after prompting if a change is found

'End Sub

'''-----------------Monitor registry primary key "REG_SubKey_SZ"-----------------------------

'''Monitor the registry to find any changes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

'Set wmiServices = GetObject("winmgmts:root/default") 

'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 

'wmiServices.ExecNotificationQueryAsync wmiSink, _ 

    '"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ 

    '"KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'" 

'WScript.Echo "Start monitoring changes in the key value of the HKLM_Run primary key in the registry......" & vbCrLf 

'While(1) 

    'WScript.Sleep 1000 

'Wend 

'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 

    'WScript.Echo ".........Registry changed......" & vbCrLf & _ 

                 '"----------Monitor changes in the primary key value of the registry-----------" & vbCrLf & _ 

                 'wmiObject.GetObjectText_() 

'WScript.Quit(0)'''Used to exit after prompting if a change is found

'End Sub

'''-----------------Monitor registry root key "REG_RootKey_SZ"----------------------------

'''Monitor the registry to find any changes to HKLM.

Set wmiServices = GetObject("winmgmts:root/default") 

Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 

wmiServices.ExecNotificationQueryAsync wmiSink, _ 

    "SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath=''" 

WScript.Echo "Start monitoring all changes in the HKLM root key in the registry......" & vbCrLf 

While(1) 

    WScript.Sleep 1000 

Wend 

Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 

    WScript.Echo ".........Registry changed......" & vbCrLf & _ 

                 "----------Monitor all changes in the registry root key-----------" & vbCrLf & _ 

                 wmiObject.GetObjectText_() 

WScript.Quit(0)'''Used to exit after prompting if a change is found

End Sub

Don't understand VBS. If the system disables VBS, then it's useless, right? Still, batch processing is better. It would be great if batch processing could be implemented. Still waiting~~~

@echo off
for /f "delims=" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows') do (if "%%i"=="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin" goto 1)
goto no
:1
for /f "tokens=1,2,*" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin') do (if "%%i%%j%%k"=="WinsREG_SZmondy" goto yes)
:no
echo no
goto end
:yes
echo yes
:end
pause

Indeed, the second floor is just for demonstration. Actually, it's very simple. As long as there's one mismatch, it exits.

@echo off

reg query HKLM\SOFTWARE\Microsoft\Windows|find "Sysin"||echo No

reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins"|find "REG_SZ"|find "mondy"||echo No

pause

Or

@echo off

reg query HKLM\SOFTWARE\Microsoft\Windows|find "Sysin"&&reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins"|find "REG_SZ"|find "mondy"||echo No

pause

Thanks everyone, learned new knowledge again, hehe~~