110 lines
4.5 KiB
PowerShell
110 lines
4.5 KiB
PowerShell
# READ-ONLY registry audit — OLE DB providers, ODBC drivers, CLSIDs
|
|
# No modifications. No secrets displayed.
|
|
param([switch]$OleDb, [switch]$OdbcReg, [switch]$Clsid, [switch]$All)
|
|
|
|
$ErrorActionPreference = "SilentlyContinue"
|
|
|
|
if ($All -or $OleDb) {
|
|
Write-Host "========== OLE DB PROVIDERS =========="
|
|
$classesRoots = @("HKLM:\SOFTWARE\Classes", "HKLM:\SOFTWARE\WOW6432Node\Classes")
|
|
|
|
# Search ProgIDs
|
|
foreach ($c in $classesRoots) {
|
|
Get-ChildItem $c -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "^PCSOFT\.|^HFSQL|HyperFile" } | ForEach-Object {
|
|
$progid = $_.PSChildName
|
|
Write-Host "ProgID: $progid (under $c)"
|
|
$clsidPath = Join-Path $c "$progid\CLSID"
|
|
if (Test-Path $clsidPath) {
|
|
$clsid = (Get-ItemProperty $clsidPath).'(default)'
|
|
Write-Host " CLSID: $clsid"
|
|
if ($clsid) {
|
|
$detail = Join-Path $c "CLSID\$clsid"
|
|
if (Test-Path $detail) {
|
|
$dll = (Get-ItemProperty "$detail\InprocServer32").'(default)'
|
|
if ($dll) { Write-Host " DLL: $dll" }
|
|
$ver = (Get-ItemProperty "$detail\Version").'(default)'
|
|
if ($ver) { Write-Host " Version: $ver" }
|
|
}
|
|
}
|
|
}
|
|
Write-Host "---"
|
|
}
|
|
}
|
|
|
|
# Search OLE DB Provider descriptions
|
|
Write-Host "`n=== OLE DB Provider Descriptions (HFSQL/PC SOFT) ==="
|
|
foreach ($c in $classesRoots) {
|
|
$clsidBase = Join-Path $c "CLSID"
|
|
if (Test-Path $clsidBase) {
|
|
Get-ChildItem $clsidBase -ErrorAction SilentlyContinue | ForEach-Object {
|
|
$clsid = $_.PSChildName
|
|
$olePath = "$clsidBase\$clsid\OLE DB Provider"
|
|
if (Test-Path $olePath) {
|
|
$desc = (Get-ItemProperty $olePath).'(default)'
|
|
if ($desc -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT") {
|
|
Write-Host "Description: $desc"
|
|
Write-Host "CLSID: $clsid"
|
|
$dll = (Get-ItemProperty "$clsidBase\$clsid\InprocServer32").'(default)'
|
|
if ($dll) { Write-Host "DLL: $dll" }
|
|
Write-Host "---"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($All -or $OdbcReg) {
|
|
Write-Host "`n========== ODBC REGISTRY (HFSQL/WINDEV) =========="
|
|
$odbcPaths = @(
|
|
"HKLM:\SOFTWARE\ODBC\ODBCINST.INI\ODBC Drivers",
|
|
"HKLM:\SOFTWARE\WOW6432Node\ODBC\ODBCINST.INI\ODBC Drivers"
|
|
)
|
|
foreach ($p in $odbcPaths) {
|
|
if (Test-Path $p) {
|
|
$props = Get-ItemProperty $p
|
|
$props.PSObject.Properties | Where-Object { $_.Name -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT|WINDEV|WD300" } | ForEach-Object {
|
|
Write-Host "Driver: $($_.Name) Value: $($_.Value) Path: $p"
|
|
}
|
|
}
|
|
}
|
|
|
|
# Driver details
|
|
$iniPaths = @(
|
|
"HKLM:\SOFTWARE\ODBC\ODBCINST.INI",
|
|
"HKLM:\SOFTWARE\WOW6432Node\ODBC\ODBCINST.INI"
|
|
)
|
|
foreach ($p in $iniPaths) {
|
|
Get-ChildItem $p -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "HFSQL|Hyper.?File|PC.?SOFT|PCSOFT|WINDEV|WD300" } | ForEach-Object {
|
|
$name = $_.PSChildName
|
|
Write-Host "`nDriverSection: $name (under $p)"
|
|
$props = Get-ItemProperty "$p\$name"
|
|
$props.PSObject.Properties | Where-Object { $_.Name -notin @("PSPath","PSParentPath","PSChildName","PSDrive","PSProvider") } | ForEach-Object {
|
|
Write-Host " $($_.Name)=$($_.Value)"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($All -or $Clsid) {
|
|
Write-Host "`n========== CLSID Search (PCSOFT/HFSQL specific) =========="
|
|
# We use a targeted approach — search ProgID first
|
|
$found = @{}
|
|
foreach ($c in @("HKLM:\SOFTWARE\Classes","HKLM:\SOFTWARE\WOW6432Node\Classes")) {
|
|
Get-ChildItem $c -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match "^PCSOFT|^WD300|^HAccess|HFSQL" } | ForEach-Object {
|
|
$progid = $_.PSChildName
|
|
if (-not $found[$progid]) {
|
|
$found[$progid] = $true
|
|
Write-Host "ProgID: $progid"
|
|
$clsidPath = "$c\$progid\CLSID"
|
|
if (Test-Path $clsidPath) {
|
|
$clsid = (Get-ItemProperty $clsidPath).'(default)'
|
|
Write-Host " CLSID: $clsid"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
Write-Host "`nDone."
|