python - 使用 python pandas 读取 .reg 文件

Question

我有一组来自几台机器的 .reg 文件，我想用 python pandas 解析它们。

如果换行符以 [ 开头，则它是以下项目的路径

如果换行符以“开头，则从新行开头到等号的项是其上方路径的键

如果该行包含 : 并且不是路径，则 = 符号之后且冒号之前的项目被视为类型。

如果没有类型，则等号后面的项就是值

如果类型完全包含十六进制，则需要将其后面的行添加到完整键值中，而无需反斜杠，基本上将十六进制全部放在数据帧中的一行上。

数据集如下所示，实际文件中包含更多内容:

[HKEY_CURRENT_USER\System\GameConfigStore\Children\f198275c-96a8-45b6-a936-a5218456ebe3]
"Type"=dword:00000001
"Revision"=dword:00000517
"Flags"=dword:00000033
"Parent"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
  00,00,db,b0,ca,53,b8,b8,23,4c,80,98,d7,99,bf,60,50,ce,04,00,00,00,02,00,00,\
  00,00,00,10,66,00,00,00,01,00,00,20,00,00,00,80,ea,2c,6e,63,eb,73,4a,72,b1,\
  77,6d,b5,8d,22,fb,e0,3b,62,3a,e5,22,a8,41,43,e0,df,a3,14,a7,6a,93,00,00,00,\
  00,0e,80,00,00,00,02,00,00,20,00,00,00,f0,cc,de,f3,db,dd,3f,e0,9d,f2,eb,c9,\
  8c,f2,23,88,33,58,de,2a,9b,42,b3,1f,e0,0d,19,ea,00,df,2a,e4,20,00,00,00,5a,\
  7c,32,2e,fc,1a,c3,c3,50,77,77,ae,56,f8,b0,b1,ef,13,8f,23,f0,89,50,7e,cd,12,\
  6c,e1,b2,c4,c4,e6,40,00,00,00,b1,fe,1e,bb,ee,89,16,f2,8e,01,7d,92,ee,46,5e,\
  7e,6e,16,4c,0b,90,8d,58,e3,94,35,c4,4a,8e,32,c8,2c,7b,0d,05,ed,5e,b4,fe,0a,\
  90,47,6e,57,62,be,1e,1f,43,a2,55,a6,da,38,c1,7c,4d,1c,ec,9c,dc,67,65,fc
"GameDVR_GameGUID"="c2f1cd5f-ede9-4e9e-81b1-1c0d96cd1f38"
"TitleId"="1664882211"

[HKEY_CURRENT_USER\System\GameConfigStore\Parents]

[HKEY_CURRENT_CONFIG\Software\Fonts]
"LogPixels"=dword:00000060
"LogPixel2s"=dword:00000070

[HKEY_CURRENT_CONFIG\Software\S] 

[HKEY_CURRENT_USER\System\GameConfigStore\Parents\1bc1327236aea4735af068c406dfd7d7b60f8d9c]
"Children"=hex(7):32,00,35,00,62,00,36,00,65,00,62,00,36,00,34,00,2d,00,65,00,\
  30,00,65,00,32,00,2d,00,34,00,65,00,33,00,62,00,2d,00,38,00,32,00,64,00,36,\
  00,2d,00,64,00,65,00,65,00,32,00,32,00,32,00,37,00,62,00,36,00,31,00,64,00,\
  32,00,00,00

如果有空格，如何让数据帧读取如下，所有路径、键、类型和值隐式添加“无”？下面的示例(由于大小不包括数据集):

Path                                 Key                Type       Value
[HKEY_CURRENT_CONFIG\Software\Fonts] LogPixels          dword      00000060
[HKEY_CURRENT_CONFIG\Software\Fonts] LogPixel2s         dword      00000070
[HKEY_CURRENT_CONFIG\Software\S]     None               None       None

Answer 1

试试这个:

import re
import io
from configparser import ConfigParser
import pandas as pd


def read_reg(filename, encoding='utf-16'):
    with io.open(filename, encoding=encoding) as f:
        data = f.read()
    # get rid of non-section strings in the beginning of .reg file
    data = re.sub(r'^[^\[]*\n', '', data, flags=re.S)
    cfg = ConfigParser(strict=False)
    # dirty hack for "disabling" case-insensitive keys in "configparser"
    cfg.optionxform=str
    cfg.read_string(data)
    data = []
    # iterate over sections and keys and generate `data` for pandas.DataFrame
    for s in cfg.sections():
        if not cfg[s]:
            data.append([s, None, None, None])
        for key in cfg[s]:
            tp = val = None
            if cfg[s][key]:
                # take care of value type
                if ':' in cfg[s][key]:
                    tp, val = cfg[s][key].split(':')
                else:
                    val = cfg[s][key].replace('"', '').replace(r'\\\n', '')
            data.append([s, key.replace('"', ''), tp, val])
    df = pd.DataFrame(data, columns=['Path','Key','Type','Value'])
    # make `hex` values "one-line"
    df.loc[df.Type.notnull() & df.Type.str.contains(r'^hex'), 'Value'] = \
        df.loc[df.Type.notnull() & df.Type.str.contains(r'^hex'), 'Value'].str.replace(r'\\\n','')
    return df

filename = '/path/to/regfile.reg'    
# NOTE: you might have to specify the encoding: example: `encoding='utf-8-sig'`, default: 'utf-16' - default for Windows Registry files
df = read_reg(filename)
print(df.loc[df.Path.str.contains(r'Software\\(?:Fonts|S)')])

结果:

In [236]: print(df.loc[df.Path.str.contains(r'Software\\(?:Fonts|S)')])
                                 Path         Key   Type     Value
7  HKEY_CURRENT_CONFIG\Software\Fonts   LogPixels  dword  00000060
8  HKEY_CURRENT_CONFIG\Software\Fonts  LogPixel2s  dword  00000070
9      HKEY_CURRENT_CONFIG\Software\S        None   None      None

十六进制值:

In [45]: df.loc[df.Type.notnull() & df.Type.str.contains(r'^hex'), 'Value']
Out[45]:
3     01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,b0,ca,53,b8,b8,23,4c,80,98,d7,99,bf,60,50,ce,04,00,00,00,02
,00,00,00,00...
10    32,00,35,00,62,00,36,00,65,00,62,00,36,00,34,00,2d,00,65,00,30,00,65,00,32,00,2d,00,34,00,65,00,33,00,62,00,2d,00,38,00,32,00,64,00,36
,00,2d,00,64...
Name: Value, dtype: object

In [46]: df.loc[df.Type.notnull() & df.Type.str.contains(r'^hex'), 'Value'].str.len()
Out[46]:
3     737
10    221
Name: Value, dtype: int64

注意:我没有实现任何错误处理 - 这对于生产代码可能是必需的。所以你可能想实现它......