windows - How can I read a reg_qword in winreg in python 3.4? -
i inserted registry key, hkey_local_machine\software\test\test_qword
of type reg_qword
, value 20150509091344
(0x1253a7efba10
).
i tried load using winreg
following code in python 3.4:
import winreg key_dir = r"software\test" reg = winreg.openkey(winreg.hkey_local_machine, key_dir, 0, winreg.key_wow64_64key+winreg.key_all_access) test_dir = list(winreg.queryvalueex(reg, r'test_qword'))[0] print(test_dir) ans = "".join(map(lambda b: format(b, "02x"), test_dir)) print(ans) print(int(ans, 16))
and got following console output:
b'\x10\xba\xef\xa7s\x12\x00\x00' 10baefa753120000 1205539352207294464
which not original value. how can retrieve original value winreg
?
the code wrote interprets value big-endian-stored integer. however, reg_qword
stored little-endian number.
there's easier way convert bytes
value of 64-bit integer: using struct.unpack()
. format '<q'
read signed 64-bit little-endian integer:
>>> struct.unpack('<q', b'\x10\xba\xef\xa7s\x12\x00\x00') (20150509091344,)
and if wanted read big-endian:
>>> struct.unpack('>q', b'\x10\xba\xef\xa7s\x12\x00\x00') (1205539352207294464,)
you can see gives same incorrect value getting in code.
more information on format codes struct.unpack()
, inverse, struct.pack()
, in the docs struct
module.
Comments
Post a Comment