Cygwin comes with a number of command-line utilities that are used to manage the UNIX emulation portion of the Cygwin environment. While many of these reflect their UNIX counterparts, each was written specifically for Cygwin. You may use the long or short option names interchangeably; for example, --help and -h function identically. Usage: cygcheck [OPTIONS] [program ...] -c, --check-setup check packages installed via setup.exe -s, --sysinfo system information (not with -k) -v, --verbose verbose output (indented) (for -s or programs) -r, --registry registry search (requires -s) -k, --keycheck perform a keyboard check session (not with -s) -h, --help give help about the info (not with -c) -V, --version output version information and exit You must at least give either -s or -k or a program name The cygcheck program is a diagnostic utility that examines your system and reports the information that is significant to the proper operation of Cygwin programs. It can give information about specific programs or libraries you are trying to run, general system information, or both. If you list one or more programs on the command line, it will diagnose the runtime environment of that program or programs, providing the names of DLL files on which the program depends. If you specify the -s option, it will give general system information. If you specify -s and list one or more programs on the command line, it reports on both. The -h option prints additional helpful messages in the report, at the beginning of each section. It also adds table column headings. While this is useful information, it also adds some to the size of the report, so if you want a compact report or if you know what everything is already, just leave this out. The -v option causes the output to be more verbose. What this means is that additional information will be reported which is usually not interesting, such as the internal version numbers of DLLs, additional information about recursive DLL usage, and if a file in one directory in the PATH also occurs in other directories on the PATH. The -r option causes cygcheck to search your registry for information that is relevent to Cygwin programs. These registry entries are the ones that have "Cygwin" in the name. If you are paranoid about privacy, you may remove information from this report, but please keep in mind that doing so makes it harder to diagnose your problems. The -c option causes the arguments to be interpreted as package names. cygcheck will report the current version of the package that you specify, or with no arguments, on all packages. The cygcheck program should be used to send information about your system for troubleshooting when requested. When asked to run this command save the output so that you can email it, for example: C:\cygwin> cygcheck -s -v -r -h > cygcheck_output.txt Usage: cygpath (-d|-m|-u|-w|-t TYPE) [-c HANDLE] [-f FILE] [options] NAME cygpath [-ADHPSW] Output type options: -d, --dos print DOS (short) form of NAME (C:\PROGRA~1\) -m, --mixed like --windows, but with regular slashes (C:/WINNT) -u, --unix (default) print Unix form of NAME (/cygdrive/c/winnt) -w, --windows print Windows form of NAME (C:\WINNT) -t, --type TYPE print TYPE form: 'dos', 'mixed', 'unix', or 'windows' Path conversion options: -a, --absolute output absolute path -l, --long-name print Windows long form of NAME (with -w, -m only) -p, --path NAME is a PATH list (i.e., '/bin:/usr/bin') -s, --short-name print DOS (short) form of NAME (with -w, -m only) System information: -A, --allusers use `All Users' instead of current user for -D, -P -D, --desktop output `Desktop' directory and exit -H, --homeroot output `Profiles' directory (home root) and exit -P, --smprograms output Start Menu `Programs' directory and exit -S, --sysdir output system directory and exit -W, --windir output `Windows' directory and exit The cygpath program is a utility that converts Windows native filenames to Cygwin POSIX-style pathnames and vice versa. It can be used when a Cygwin program needs to pass a file name to a native Windows program, or expects to get a file name from a native Windows program. Alternatively, cygpath can output information about the location of important system directories in either format. The -u and -w options indicate whether you want a conversion to UNIX (POSIX) format (-u) or to Windows format (-w). Use the -d to get DOS-style (8.3) file and path names. The -m option will output Windows-style format but with forward slashes instead of backslashes. This option is especially useful in shell scripts, which use backslashes as an escape character. In combination with the -w option, you can use the -l and -s options to use normal (long) or DOS-style (short) form. The -d option is identical to -w and -s together. Caveat: The -l option does not work if the check_case parameter of CYGWIN is set to strict, since Cygwin is not able to match any Windows short path in this mode. The -p option means that you want to convert a path-style string rather than a single filename. For example, the PATH environment variable is semicolon-delimited in Windows, but colon-delimited in UNIX. By giving -p you are instructing cygpath to convert between these formats. The -i option supresses the print out of the usage message if no filename argument was given. It can be used in make file rules converting variables that may be omitted to a proper format. Note that cygpath output may contain spaces (C:\Program Files) so should be enclosed in quotes. #!/bin/sh if [ "${1}" = "" ]; then XPATH="."; else XPATH="$(cygpath -w "${1}")"; fi explorer $XPATH & The capital options -D, -H, -P, -S, and -W output directories used by Windows that are not the same on all systems, for example -S might output C:\WINNT\SYSTEM32 or C:\WINDOWS\SYSTEM. The -H shows the Windows profiles directory that can be used as root of home. The -A option forces use of the "All Users" directories instead of the current user for the -D and -P options. On Win9x systems with only a single user, -A has no effect; -D and -AD would have the same output. By default the output is in UNIX (POSIX) format; use the -w or -d options to get other formats. Usage: dumper [OPTION] FILENAME WIN32PID Dump core from WIN32PID to FILENAME.core -d, --verbose be verbose while dumping -h, --help output help information and exit -q, --quiet be quiet while dumping (default) -v, --version output version information and exit The dumper utility can be used to create a core dump of running Windows process. This core dump can be later loaded to gdb and analyzed. One common way to use dumper is to plug it into cygwin's Just-In-Time debugging facility by adding error_start=x:\path\to\dumper.exe to the CYGWIN environment variable. Please note that x:\path\to\dumper.exe is Windows-style and not cygwin path. If error_start is set this way, then dumper will be started whenever some program encounters a fatal error. dumper can be also be started from the command line to create a core dump of any running process. Unfortunately, because of a Windows API limitation, when a core dump is created and dumper exits, the target process is terminated too. To save space in the core dump, dumper doesn't write those portions of target process' memory space that are loaded from executable and dll files and are unchangeable, such as program code and debug info. Instead, dumper saves paths to files which contain that data. When a core dump is loaded into gdb, it uses these paths to load appropriate files. That means that if you create a core dump on one machine and try to debug it on another, you'll need to place identical copies of the executable and dlls in the same directories as on the machine where the core dump was created. Usage: getfacl [-adn] FILE [FILE2...] Display file and directory access control lists (ACLs). -a, --all display the filename, the owner, the group, and the ACL of the file -d, --dir display the filename, the owner, the group, and the default ACL of the directory, if it exists -h, --help output usage information and exit -n, --noname display user and group IDs instead of names -v, --version output version information and exit When multiple files are specified on the command line, a blank line separates the ACLs for each file. For each argument that is a regular file, special file or directory, getfacl displays the owner, the group, and the ACL. For directories getfacl displays additionally the default ACL. With no options specified, getfacl displays the filename, the owner, the group, and both the ACL and the default ACL, if it exists. For more information on Cygwin and Windows ACLs, see see in the Cygwin User's Guide. The format for ACL output is as follows: # file: filename # owner: name or uid # group: name or uid user::perm user:name or uid:perm group::perm group:name or gid:perm mask:perm other:perm default:user::perm default:user:name or uid:perm default:group::perm default:group:name or gid:perm default:mask:perm default:other:perm Usage: kill [-f] [-signal] [-s signal] pid1 [pid2 ...] kill -l [signal] -f, --force force, using win32 interface if necessary -l, --list print a list of signal names -s, --signal send signal (use kill --list for a list) -h, --help output usage information and exit -v, --version output version information and exit The kill program allows you to send arbitrary signals to other Cygwin programs. The usual purpose is to end a running program from some other window when ^C won't work, but you can also send program-specified signals such as SIGUSR1 to trigger actions within the program, like enabling debugging or re-opening log files. Each program defines the signals they understand. You may need to specify the full path to use kill from within some shells, including bash, the default Cygwin shell. This is because bash defines a kill builtin function; see the bash man page under BUILTIN COMMANDS for more information. To make sure you are using the Cygwin version, try $ /bin/kill --version which should give the Cygwin kill version number and copyright information. Unless you specific the -f option, the "pid" values used by kill are the Cygwin pids, not the Windows pids. To get a list of running programs and their Cygwin pids, use the Cygwin ps program. ps -W will display all windows pids. The kill -l option prints the name of the given signal, or a list of all signal names if no signal is given. To send a specific signal, use the -signN option, either with a signal number or a signal name (minus the "SIG" part), like these examples: $ kill 123 $ kill -1 123 $ kill -HUP 123 $ kill -f 123 Here is a list of available signals, their numbers, and some commentary on them, from the file <sys/signal.h>, which should be considered the official source of this information. SIGHUP 1 hangup SIGINT 2 interrupt SIGQUIT 3 quit SIGILL 4 illegal instruction (not reset when caught) SIGTRAP 5 trace trap (not reset when caught) SIGABRT 6 used by abort SIGEMT 7 EMT instruction SIGFPE 8 floating point exception SIGKILL 9 kill (cannot be caught or ignored) SIGBUS 10 bus error SIGSEGV 11 segmentation violation SIGSYS 12 bad argument to system call SIGPIPE 13 write on a pipe with no one to read it SIGALRM 14 alarm clock SIGTERM 15 software termination signal from kill SIGURG 16 urgent condition on IO channel SIGSTOP 17 sendable stop signal not from tty SIGTSTP 18 stop signal from tty SIGCONT 19 continue a stopped process SIGCHLD 20 to parent on child stop or exit SIGTTIN 21 to readers pgrp upon background tty read SIGTTOU 22 like TTIN for output if (tp->t_local&LTOSTOP) SIGPOLL 23 System V name for SIGIO SIGXCPU 24 exceeded CPU time limit SIGXFSZ 25 exceeded file size limit SIGVTALRM 26 virtual time alarm SIGPROF 27 profiling time alarm SIGWINCH 28 window changed SIGLOST 29 resource lost (eg, record-lock lost) SIGUSR1 30 user defined signal 1 SIGUSR2 31 user defined signal 2 Usage: mkgroup [OPTION]... [domain] This program prints a /etc/group file to stdout Options: -l,--local print local group information -d,--domain print global group information from the domain specified (or from the current domain if there is no domain specified) -o,--id-offset offset change the default offset (10000) added to uids in domain accounts. -s,--no-sids don't print SIDs in pwd field (this affects ntsec) -u,--users print user list in gr_mem field -h,--help print this message -v,--version print version information and exit One of `-l' or `-d' must be given on NT/W2K. The mkgroup program can be used to help configure your Windows system to be more UNIX-like by creating an initial /etc/group substitute (some commands need this file) from your system information. It only works on the NT series (Windows NT, 2000, and XP). mkgroup does not work on the Win9x series (Windows 95, 98, and Me) because they lack the security model to support it. To initially set up your machine, you'd do something like this: $ mkdir /etc $ mkgroup -l > /etc/group Note that this information is static. If you change the group information in your system, you'll need to regenerate the group file for it to have the new information. The -d and -l options allow you to specify where the information comes from, either the local machine or the default (or given) domain. The -o option allows for special cases (such as multiple domains) where the GIDs might match otherwise. The -s option omits the NT Security Identifier (SID). For more information on SIDs, see in the Cygwin User's Guide. The -u option causes mkgroup to enumerate the users for each group, placing the group members in the gr_mem (last) field. Note that this can greatly increase the time for mkgroup to run in a large domain. Usage: mkpasswd [OPTION]... [domain] This program prints a /etc/passwd file to stdout Options: -l,--local print local user accounts -d,--domain print domain accounts (from current domain if no domain specified) -o,--id-offset offset change the default offset (10000) added to uids in domain accounts. -g,--local-groups print local group information too if no domain specified -m,--no-mount don't use mount points for home dir -s,--no-sids don't print SIDs in GCOS field (this affects ntsec) -p,--path-to-home path use specified path instead of user account home dir -u,--username username only return information for the specified user -h,--help displays this message -v,--version version information and exit One of `-l', `-d' or `-g' must be given on NT/W2K. The mkpasswd program can be used to help configure your Windows system to be more UNIX-like by creating an initial /etc/passwd substitute (some commands need this file) from your system information. It only works on the NT series (Windows NT, 2000, and XP). mkpasswd does not work on the Win9x series (Windows 95, 98, and Me) because they lack the security model to support it. To initially set up your machine, you'd do something like this: $ mkdir /etc $ mkpasswd -l > /etc/passwd Note that this information is static. If you change the user information in your system, you'll need to regenerate the passwd file for it to have the new information. The -d and -l options allow you to specify where the information comes from, either the local machine or the default (or given) domain. The -o option allows for special cases (such as multiple domains) where the UIDs might match otherwise. The -g option creates a local user that corresponds to each local group. This is because NT assigns groups file ownership. The -m option bypasses the current mount table so that, for example, two users who have a Windows home directory of H: could mount them differently. The -s option omits the NT Security Identifier (SID). For more information on SIDs, see in the Cygwin User's Guide. The -p option causes mkpasswd to use a prefix other than /home/. For example, this command: $ mkpasswd -l -p "$(cygpath -H)" > /etc/passwd would put local users' home directories in the Windows 'Profiles' directory. The -u option allows mkpasswd to search for a specific username, greatly reducing the amount of time it takes in a large domain. Usage: mount [OPTION] [ ] -b, --binary text files are equivalent to binary files (newline = \n) -c, --change-cygdrive-prefix change the cygdrive path prefix to -f, --force force mount, don't warn about missing mount point directories -h, --help output usage information and exit -m, --mount-commands write mount commands to replace user and system mount points and cygdrive prefixes -p, --show-cygdrive-prefix show user and/or system cygdrive path prefix -s, --system (default) add system-wide mount point -t, --text (default) text files get \r\n line endings -u, --user add user-only mount point -v, --version output version information and exit -x, --executable treat all files under mount point as executables -E, --no-executable treat all files under mount point as non-executables -X, --cygwin-executable treat all files under mount point as cygwin executables The mount program is used to map your drives and shares onto Cygwin's simulated POSIX directory tree, much like as is done by mount commands on typical UNIX systems. Please see for more information on the concepts behind the Cygwin POSIX file system and strategies for using mounts. If you just type mount with no parameters, it will display the current mount table for you. c:\cygwin\> mount c:\cygwin\bin on /usr/bin type system (binmode) c:\cygwin\lib on /usr/lib type system (binmode) c:\cygwin on / type system (binmode) c: on /c type user (binmode,noumount) d: on /d type user (binmode,noumount) In this example, c:\cygwin is the POSIX root and D drive is mapped to /d. Note that in this case, the root mount is a system-wide mount point that is visible to all users running Cygwin programs, whereas the /d mount is only visible to the current user. The mount utility is also the mechanism for adding new mounts to the mount table. The following example demonstrates how to mount the directory \\pollux\home\joe\data to /data. c:\cygwin\> ls /data ls: /data: No such file or directory c:\cygwin\> mount \\pollux\home\joe\data /data mount: warning - /data does not exist! c:\cygwin\> mount \\pollux\home\joe\data on /data type sytem (binmode) c:\cygwin\bin on /usr/bin type system (binmode) c:\cygwin\lib on /usr/lib type system (binmode) c:\cygwin on / type system (binmode) c: on /c type user (binmode,noumount) d: on /d type user (binmode,noumount) Note that mount was invoked from the Windows command shell in the previous example. In many Unix shells, including bash, it is legal and convenient to use the forward "/" in Win32 pathnames since the "\" is the shell's escape character. The -s flag to mount is used to add a mount in the system-wide mount table used by all Cygwin users on the system, instead of the user-specific one. System-wide mounts are displayed by mount as being of the "system" type, as is the case for the / partition in the last example. Under Windows NT, only those users with Administrator priviledges are permitted to modify the system-wide mount table. Note that a given POSIX path may only exist once in the user table and once in the global, system-wide table. Attempts to replace the mount will fail with a busy error. The -f (force) flag causes the old mount to be silently replaced with the new one. It will also silence warnings about the non-existence of directories at the Win32 path location. The -b flag is used to instruct Cygwin to treat binary and text files in the same manner by default. Binary mode mounts are marked as "binmode" in the Flags column of mount output. By default, mounts are in text mode ("textmode" in the Flags column). Normally, files ending in certain extensions (.exe, .com, .bat, .cmd) are assumed to be executable. Files whose first two characters begin with '#!' are also considered to be executable. The -x flag is used to instruct Cygwin that the mounted file is "executable". If the -x flag is used with a directory then all files in the directory are executable. This option allows other files to be marked as executable and avoids the overhead of opening each file to check for a '#!'. The -X option is very similar to -x, but also prevents Cygwin from setting up commands and environment variables for a normal Windows program, adding another small performance gain. The opposite of these flags is the -E flag, which means that no files should be marked as executable. The -m option causes the mount utility to output a series of commands that could recreate both user and system mount points. You can save this output as a backup when experimenting with the mount table. It also makes moving your settings to a different machine much easier. Whenever Cygwin cannot use any of the existing mounts to convert from a particular Win32 path to a POSIX one, Cygwin will, instead, convert to a POSIX path using a default mount point: /cygdrive. For example, if Cygwin accesses z:\foo and the z drive is not currently in the mount table, then z:\ will be accessible as /cygdrive/z. The mount utility can be used to change this default automount prefix through the use of the "--change-cygdrive-prefix" option. In the following example, we will set the automount prefix to /: c:\cygwin\> mount --change-cygdrive-prefix / Note that you if you set a new prefix in this manner, you can specify the -s flag to make this the system-wide default prefix. By default, the cygdrive-prefix applies only to the current user. You can always see the user and system cygdrive prefixes with the -p option. Using the -b flag with --change-cygdrive-prefix makes all new automounted filesystems default to binary mode file accesses. Limitations: there is a hard-coded limit of 30 mount points. Also, although you can mount to pathnames that do not start with "/", there is no way to make use of such mount points. Normally the POSIX mount point in Cygwin is an existing empty directory, as in standard UNIX. If this is the case, or if there is a place-holder for the mount point (such as a file, a symbolic link pointing anywhere, or a non-empty directory), you will get the expected behavior. Files present in a mount point directory before the mount become invisible to Cygwin programs. It is sometimes desirable to mount to a non-existent directory, for example to avoid cluttering the root directory with names such as a, b, c pointing to disks. Although mount will give you a warning, most everything will work properly when you refer to the mount point explicitly. Some strange effects can occur however. For example if your current working directory is /dir, say, and /dir/mtpt is a mount point, then mtpt will not show up in an ls or echo * command and find . will not find mtpt. Usage: passwd (-l|-u|-S) [USER] passwd [-i NUM] [-n MINDAYS] [-x MAXDAYS] [-L LEN] User operations: -l, --lock lock USER's account -u, --unlock unlock USER's account -S, --status display password status for USER (locked, expired, etc.) System operations: -i, --inactive set NUM of days before inactive accounts are disabled (inactive accounts are those with expired passwords) -n, --minage set system minimum password age to MINDAYS -x, --maxage set system maximum password age to MAXDAYS -L, --length set system minimum password length to LEN Other options: -h, --help output usage information and exit -v, --version output version information and exit passwd changes passwords for user accounts. A normal user may only change the password for their own account, the administrators may change the password for any account. passwd also changes account information, such as password expiry dates and intervals. Password changes: The user is first prompted for their old password, if one is present. This password is then encrypted and compared against the stored password. The user has only one chance to enter the correct password. The administrators are permitted to bypass this step so that forgotten passwords may be changed. The user is then prompted for a replacement password. passwd will prompt again and compare the second entry against the first. Both entries are require to match in order for the password to be changed. After the password has been entered, password aging information is checked to see if the user is permitted to change their password at this time. If not, passwd refuses to change the password and exits. Password expiry and length: The password aging information may be changed by the administrators with the -x, -n and -i options. The -x option is used to set the maximum number of days a password remains valid. After max days, the password is required to be changed. The -n option is used to set the minimum number of days before a password may be changed. The user will not be permitted to change the password until min days have elapsed. The -i option is used to disable an account after the password has been expired for a number of days. After a user account has had an expired password for inact days, the user may no longer sign on to the account. Allowed values for the above options are 0 to 999. The -L option sets the minimum length of allowed passwords for users, which doesn't belong to the administrators group, to len characters. Allowed values for the minimum password length are 0 to 14. In any of the above cases, a value of 0 means `no restrictions'. Account maintenance: User accounts may be locked and unlocked with the -l and -u flags. The -l option disables an account. The -u option re-enables an account. The account status may be given with the -S option. The status information is self explanatory. Limitations: Users may not be able to change their password on some systems. Usage: ps [-aefls] [-u UID] -a, --all show processes of all users -e, --everyone show processes of all users -f, --full show process uids, ppids -h, --help output usage information and exit -l, --long show process uids, ppids, pgids, winpids -s, --summary show process summary -u, --user list processes owned by UID -v, --version output version information and exit -W, --windows show windows as well as cygwin processes With no options, ps outputs the long format by default The ps program gives the status of all the Cygwin processes running on the system (ps = "process status"). Due to the limitations of simulating a POSIX environment under Windows, there is little information to give. The PID column is the process ID you need to give to the kill command. The WINPID column is the process ID that's displayed by NT's Task Manager program. Usage: umount.exe [OPTION] [] -A, --remove-all-mounts remove all mounts -c, --remove-cygdrive-prefix remove cygdrive prefix -h, --help output usage information and exit -s, --system remove system mount (default) -S, --remove-system-mounts remove all system mounts -u, --user remove user mount -U, --remove-user-mounts remove all user mounts -v, --version output version information and exit The umount program removes mounts from the mount table. If you specify a POSIX path that corresponds to a current mount point, umount will remove it from the user-specific registry area. The -s flag may be used to specify removing the mount from the system-wide registry area instead (Administrator priviledges are required). The umount utility may also be used to remove all mounts of a particular type. With the extended options it is possible to remove all mounts, all automatically-mounted mounts, all mounts in the current user's registry area, or all mounts in the system-wide registry area (with Administrator privileges). See ) for more information on the mount table. Usage: strace.exe [OPTIONS] Usage: strace.exe [OPTIONS] -p -b, --buffer-size=SIZE set size of output file buffer -d, --no-delta don't display the delta-t microsecond timestamp -f, --trace-children trace child processes (toggle - default true) -h, --help output usage information and exit -m, --mask=MASK set message filter mask -n, --crack-error-numbers output descriptive text instead of error numbers for Windows errors -o, --output=FILENAME set output file to FILENAME -p, --pid=n attach to executing program with cygwin pid n -S, --flush-period=PERIOD flush buffered strace output every PERIOD secs -t, --timestamp use an absolute hh:mm:ss timestamp insted of the default microsecond timestamp. Implies -d -T, --toggle toggle tracing in a process already being traced. Requires -p -v, --version output version information and exit -w, --new-window spawn program under test in a new window MASK can be any combination of the following mnemonics and/or hex values (0x is optional). Combine masks with '+' or ',' like so: --mask=wm+system,malloc+0x00800 Mnemonic Hex Corresponding Def Description ========================================================================= all 0x00001 (_STRACE_ALL) All strace messages. flush 0x00002 (_STRACE_FLUSH) Flush output buffer after each message. inherit 0x00004 (_STRACE_INHERIT) Children inherit mask from parent. uhoh 0x00008 (_STRACE_UHOH) Unusual or weird phenomenon. syscall 0x00010 (_STRACE_SYSCALL) System calls. startup 0x00020 (_STRACE_STARTUP) argc/envp printout at startup. debug 0x00040 (_STRACE_DEBUG) Info to help debugging. paranoid 0x00080 (_STRACE_PARANOID) Paranoid info. termios 0x00100 (_STRACE_TERMIOS) Info for debugging termios stuff. select 0x00200 (_STRACE_SELECT) Info on ugly select internals. wm 0x00400 (_STRACE_WM) Trace Windows msgs (enable _strace_wm). sigp 0x00800 (_STRACE_SIGP) Trace signal and process handling. minimal 0x01000 (_STRACE_MINIMAL) Very minimal strace output. exitdump 0x04000 (_STRACE_EXITDUMP) Dump strace cache on exit. system 0x08000 (_STRACE_SYSTEM) Serious error; goes to console and log. nomutex 0x10000 (_STRACE_NOMUTEX) Don't use mutex for synchronization. malloc 0x20000 (_STRACE_MALLOC) Trace malloc calls. thread 0x40000 (_STRACE_THREAD) Thread-locking calls. The strace program executes a program, and optionally the children of the program, reporting any Cygwin DLL output from the program(s) to file. This program is mainly useful for debugging the Cygwin DLL itself. Usage: regtool.exe [OPTION] (add | check | get | list | remove | unset) KEY Actions: add KEY\SUBKEY add new SUBKEY check KEY exit 0 if KEY exists, 1 if not get KEY\VALUE prints VALUE to stdout list KEY list SUBKEYs and VALUEs remove KEY remove KEY set KEY\VALUE [data ...] set VALUE unset KEY\VALUE removes VALUE from KEY Options for 'list' Action: -k, --keys print only KEYs -l, --list print only VALUEs -p, --postfix like ls -p, appends '\' postfix to KEY names Options for 'set' Action: -e, --expand-string set type to REG_EXPAND_SZ -i, --integer set type to REG_DWORD -m, --multi-string set type to REG_MULTI_SZ -s, --string set type to REG_SZ Other Options: -h, --help output usage information and exit -q, --quiet no error output, just nonzero return if KEY/VALUE missing -v, --verbose verbose output, including VALUE contents when applicable -V, --version output version information and exit KEY is in the format [host]\prefix\KEY\KEY\VALUE, where host is optional remote host in either \\hostname or hostname: format and prefix is any of: root HKCR HKEY_CLASSES_ROOT (local only) config HKCC HKEY_CURRENT_CONFIG (local only) user HKCU HKEY_CURRENT_USER (local only) machine HKLM HKEY_LOCAL_MACHINE users HKU HKEY_USERS You can use forward slash ('/') as a separator instead of backslash, in that case backslash is treated as escape character Example: regtool.exe get '\user\software\Microsoft\Clock\iFormat' The regtool program allows shell scripts to access and modify the Windows registry. Note that modifying the Windows registry is dangerous, and carelessness here can result in an unusable system. Be careful. The -v option means "verbose". For most commands, this causes additional or lengthier messages to be printed. Conversely, the -q option supresses error messages, so you can use the exit status of the program to detect if a key exists or not (for example). The list command lists the subkeys and values belonging to the given key. The add command adds a new key. The remove command removes a key. Note that you may need to remove everything in the key before you may remove it, but don't rely on this stopping you from accidentally removing too much. The check command checks to see if a key exists (the exit code of the program is zero if it does, nonzero if it does not). The set command sets a value within a key. -i means the value is an integer (DWORD). -s means the value is a string. -e means it's an expanding string (it contains embedded environment variables). -m means it's a multi-string (list). If you don't specify one of these, it tries to guess the type based on the value you give. If it looks like a number, it's a number. If it starts with a percent, it's an expanding string. If you give multiple values, it's a multi-string. Else, it's a regular string. The unset command removes a value from a key. The get command gets the value of a value of a key, and prints it (and nothing else) to stdout. Note: if the value doesn't exist, an error message is printed and the program returns a non-zero exit code. If you give -q, it doesn't print the message but does return the non-zero exit code.