Libguestfs - Dec 2017 - [PATCH 0/1] hivexregedit: add --max-depth option for exports

This new option allows you to only export what you care about
from a registry hive by specifying a max recursion depth.

Michael Meyer (1):
  hivexregedit: add --max-depth option for exports

 perl/lib/Win/Hivex/Regedit.pm | 14 ++++++++++++--
 regedit/hivexregedit          | 18 +++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

-- 
2.14.3 (Apple Git-98)

---
 perl/lib/Win/Hivex/Regedit.pm | 14 ++++++++++++--
 regedit/hivexregedit          | 18 +++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/perl/lib/Win/Hivex/Regedit.pm b/perl/lib/Win/Hivex/Regedit.pm
index 355699e..34426f1 100644
--- a/perl/lib/Win/Hivex/Regedit.pm
+++ b/perl/lib/Win/Hivex/Regedit.pm
@@ -487,11 +487,12 @@ sub reg_export
 {
     my $h = shift;
     my $key = shift;
+    my $fh = shift;
 
     my $node = _node_lookup ($h, $key);
     croak "$key: path not found in this hive" unless $node;
 
-    reg_export_node ($h, $node, @_);
+    reg_export_node ($h, $node, $fh, 0, @_);
 }
 
 =head2 reg_export_node
@@ -510,8 +511,17 @@ sub reg_export_node
     my $h = shift;
     my $node = shift;
     my $fh = shift;
+    my $depth = shift;
     my %params = @_;
 
+    my $max_depth = $params{max_depth};
+    if (defined $max_depth && $max_depth >= 0) {
+        # Check if we've gone deep enough
+        if ($depth >= $max_depth) {
+            return;
+        }
+    }
+
     confess "reg_export_node: \$node parameter was undef" unless
defined $node;
 
     # Get the canonical path of this node.
@@ -622,7 +632,7 @@ sub reg_export_node
     }
 
     @children = sort { $h->node_name ($a) cmp $h->node_name ($b) }
@children;
-    reg_export_node ($h, $_, $fh, @_) foreach @children;
+    reg_export_node ($h, $_, $fh, $depth + 1, @_) foreach @children;
 }
 
 # Escape " and \ when printing keys.
diff --git a/regedit/hivexregedit b/regedit/hivexregedit
index cd49063..737450d 100755
--- a/regedit/hivexregedit
+++ b/regedit/hivexregedit
@@ -259,6 +259,20 @@ Use heuristics to tolerate certain levels of corruption
within hives.
 This is unsafe but may allow to export/merge valid keys/values in an
 othewise corrupted hive.
 
+=cut
+
+my $max_depth;
+
+=item B<--max-depth> depth
+
+Limits the recursion depth of the export. For example, an export
+with a max depth of 1 will only include values directly under the
+specified key/prefix. A max depth of 0 will return no values.
+
+Exports include all child keys by default (fully recursive),
+which may take a while if the registry hive is large / bloated.
+This behavior can also be achieved by providing a negative max depth.
+
 =back
 
 =cut
@@ -271,6 +285,7 @@ GetOptions ("help|?" => \$help,
             "encoding=s" => \$encoding,
             "unsafe-printable-strings" =>
\$unsafe_printable_strings,
             "unsafe" => \$unsafe,
+            "max-depth=i" => \$max_depth,
     ) or pod2usage (2);
 pod2usage (1) if $help;
 
@@ -332,7 +347,8 @@ if ($merge) {                   # --merge (reg_import)
     reg_export ($h, $key, \*STDOUT,
                 prefix => $prefix,
                 unsafe_printable_strings => $unsafe_printable_strings,
-                unsafe => $unsafe);
+                unsafe => $unsafe,
+                max_depth => $max_depth);
 }
 
 =head1 SEE ALSO
-- 
2.14.3 (Apple Git-98)

Thanks, I pushed this just now.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v