Registry durchsuchen

[cherry]

hallo...
irgendwie scheint mein code verhext zu sein. Was ich suchen will finde ich. aber wenn ich je nach dem einen Suchbegriff eingebe den es garnicht gibt, gibts manchmal trotzdem ne ausgabe, und zwar immer an derselben stelle... dabei spielt der Suchbegriff nur insofern eine Rolle, dass es plus minus 8 Zeichen sein müssen. Es gibt mir dann diese Ausgabe:

\SYSTEM\ControlSet003\Control\Terminal Server\Wds\rdpwd\SUCHBEGRIFF

vielleich könnte jmd einen kurzen Blick auf meinen code (ich weiss is nicht so schön, war auch nur ein test und ich bin im stress) werfen.
danke schon mal...

Delphi-Quellcode:

program reg;

{$APPTYPE CONSOLE}

uses
  windows, SysUtils, Registry, StrUtils, classes;

var
  RG: TRegistry;

// init
procedure init;
begin
  RG := TRegistry.Create;
end;

// find vals
procedure findvals(txt:string);
var
  valuenames: TStringList;
  I:Integer;
  info: TRegDataInfo;
  data: String;
begin
  valuenames := TStringList.Create;
  RG.GetValueNames(valuenames);
  for I := 0 to valuenames.Count - 1 do
  begin
    if Pos(UPPERCASE(txt),UPPERCASE(valuenames.Strings[i])) > 0 then // VALUENAME FOUND
    begin
      Writeln('[KEY]'+RG.CurrentPath);
      Writeln('    [Valuename]'+valuenames.Strings[i]);
    end;
    if RG.GetDataInfo(valuenames.Strings[i], info) then
    begin
      if (info.RegData = rdString) or (info.RegData = rdExpandString)  then
      begin
        data := RG.ReadString(valuenames.Strings[i]);
        if Pos(UPPERCASE(txt),UPPERCASE(data)) > 0 then // VALUE FOUND
        begin
          Writeln('[KEY]'+RG.CurrentPath);
          Writeln('    [Valuename]'+valuenames.Strings[i]);
          Writeln('              [VALUE]'+data);
        end;
      end;
    end;
//    else
//      WriteLn('ERROR getting data info for: "'+RG.CurrentPath+'\'+key+'"');
  end;
  valuenames.Free;
end;

// find
procedure find(txt: string; RootKey: HKEY);
var
  keynames: TStringList;
  I: Integer;
  toplevelpath: string;

procedure findkeys(key: string);
var
  knames: TStringList;
  I: Integer;
begin

  if Pos(UPPERCASE(txt),UPPERCASE(key)) > 0 then // KEY FOUND
    Writeln(key);

  if RG.OpenKeyReadOnly(key) then
  begin
    knames := TStringList.Create;
    RG.GetKeyNames(knames);
    for I := 0 to knames.Count - 1 do
    begin
      findvals(txt);
      findkeys(key+'\'+knames.Strings[I]);
    end;
    knames.Free;
    //RG.CloseKey;
  end;
//  else
//    WriteLn('ERROR while opening key: "'+key+'"');

end;

begin
  keynames := TStringList.Create;
  RG.RootKey := RootKey;
  if RG.OpenKeyReadOnly(RG.CurrentPath) then
  begin
    RG.GetKeyNames(keynames);
    toplevelpath := RG.CurrentPath;
    for I := 0 to keynames.Count - 1 do
      findkeys(toplevelpath+'\'+keynames.Strings[I]);
    keynames.Free;
    //RG.CloseKey;
  end;
//  else
//    WriteLn('ERROR while opening key: "'+RG.CurrentPath+'"');
end;

begin

  try

    init;

    if ParamStr(1) = '' then
    begin

      writeln('-----------------------------------');
      writeln('- registry tool 2010 by enemyleft -');
      writeln('-----------------------------------');

    end
    else
    begin

      if UPPERCASE(ParamStr(3)) = 'DELETEKEY' then
        DELETEKEY := true
      else if UPPERCASE(ParamStr(3)) = 'DELETEVALUE' then
        DELETEVALUE := true;

      writeln('looking for "'+ParamStr(2)+'" in registry ...');
      if ParamStr(1) = '*' then
      begin
        writeln('ROOTKEY SET TO: HKEY_CLASSES_ROOT');
        find(ParamStr(2), HKEY_CLASSES_ROOT);
        writeln('ROOTKEY SET TO: HKEY_CURRENT_CONFIG');
        find(ParamStr(2), HKEY_CURRENT_CONFIG);
        writeln('ROOTKEY SET TO: HKEY_CURRENT_USER');
        find(ParamStr(2), HKEY_CURRENT_USER);
        writeln('ROOTKEY SET TO: HKEY_LOCAL_MACHINE');
        find(ParamStr(2), HKEY_LOCAL_MACHINE);
        writeln('ROOTKEY SET TO: HKEY_USERS');
        find(ParamStr(2), HKEY_USERS);
        writeln('ROOTKEY SET TO: HKEY_CURRENT_CONFIG');
        find(ParamStr(2), HKEY_CURRENT_CONFIG)
      end
      else if ParamStr(1) = 'HKEY_CLASSES_ROOT' then
      begin
        writeln('ROOTKEY SET TO: HKEY_CLASSES_ROOT');
        find(ParamStr(2), HKEY_CLASSES_ROOT)
      end
      else if ParamStr(1) = 'HKEY_CURRENT_CONFIG' then
      begin
        writeln('ROOTKEY SET TO: HKEY_CURRENT_CONFIG');
        find(ParamStr(2), HKEY_CURRENT_CONFIG)
      end
      else if ParamStr(1) = 'HKEY_CURRENT_USER' then
      begin
        writeln('ROOTKEY SET TO: HKEY_CURRENT_USER');
        find(ParamStr(2), HKEY_CURRENT_USER)
      end
      else if ParamStr(1) = 'HKEY_LOCAL_MACHINE' then
      begin
        writeln('ROOTKEY SET TO: HKEY_LOCAL_MACHINE');
        find(ParamStr(2), HKEY_LOCAL_MACHINE)
      end
      else if ParamStr(1) = 'HKEY_USERS' then
      begin
        writeln('ROOTKEY SET TO: HKEY_USERS');
        find(ParamStr(2), HKEY_USERS)
      end
      else if ParamStr(1) = 'HKEY_CURRENT_CONFIG' then
      begin
        writeln('ROOTKEY SET TO: HKEY_CURRENT_CONFIG');
        find(ParamStr(2), HKEY_CURRENT_CONFIG)
      end;

    end;

  except
    on E:Exception do
      Writeln(E.Classname, ': ', E.Message);
  end;
end.