IDEA: registry change detector

[gtoal]

I've looked for something like this with no luck.  I bet it's a contender for a quickie snack:

1) on the first run, the program dumps the registry
2) you do something that affects the registry.  (eg install some program)
2) on the second run, the program dumps the registry again

At this point, it diffs the previous registry with the current registry, and outputs all the changes in the form of two .reg files:

  one reg file, when run, will undo all the changes and make the registry look like it did on step 1 - it'll delete new entries, and it'll reinstate anything that the user code had deleted.

  the other reg file, when run, will re-apply the changes that were made between 1 and 2, whether that was adding a new key, deleting an old one, or just changing the value of one.

This will be really useful for making a 'reinstaller', ie you install a program, register it etc, then want to move it off your disk to save space and then put it back some time later.  Or you may want to move it to another computer.  Sometimes you just don't want to go through the laborious installation process again, especially when you have to register online and you've already filled out all the forms once before...

Graham

[jgpaiva]

I think this probably already exists out there, looks like something useful enough for someone to have thought about doing it already
Let's see if someone suggests something cool!

[Shades]

The best tool I encountered during my travels on the digital highway is this one: eRUNT

[PhilB66]

A few tools mentioned in Regshot and Monitor System Changes threads.

[gtoal]

Thanks!  It looks like the Russian (or is at Ukrainian?) variant of regshot is what I was looking for, with undo.reg and redo.reg files.  Unfortunately when the russians took the open source program and modified it (or is it a reimplementation?  if so they should have used another name.  But I suspect not...), they didn't release their updated sources (it would seem, my Russian is a bit rusty).  And frankly I've been bitten by too many Russian mafia keyloggers to trust running an executable from that part of the world without compiling it myself from source.  However the sourceforge source of the older version is available, and for a change, in a language I know well, so I might just have a hack at writing my own version this weekend... (unless someone beats me to it!)

I also found this page that lists what seem like add-ons to the original regshot, which do what I want: http://bbs.betabbs.c....php?showtopic=61050 - I'll give those a try too.

thanks for all the posts, guys, you look like a friendly bunch; I think I'll hang around here.  Hopefully I'll be able to contribute a few utils myself in the coming months.  (I generally have time to program at the weekends - but not this weekend - with Hurricane Ike heading straight for me, I'll be lucky if I even have electricity by this weekend, never mind networking..!)

Graham

=========
One of the most important things missing from the Regshot tool, is it's inability to output it's traced changes into .reg files.

Paraglider then made a Regshot-mod which could output .txt logfiles using REGEDIT4 format.

Now a Regshot alike freeware tool named Regshot 2.0 unicode has emerged which resembles the old Regshot very much, while adding some nice extra capabilities...


It can output directly to REGEDIT4(ansi) or REGEDIT5(unicode) .reg files.
It can make both REDO.reg and UNDO.reg files.
It can output directly into INF files.
It can make both REDO.inf and UNDO.inf files.
It can auto-translate 'HKEY USERS\S-1-5-21[...]' into 'HKEY_CURRENT_USER'.
It includes a registry exclude list.
It includes an folder exclude list.
It features much more advanced configurability than the original Regshot.


The homepage and tool is in Russian, but the tool can be changed into english from a drop-down box..

http://czechcup.com/regshot/