Understanding: The Windows Registry

The
Windows registry is a hierarchical database that contains virtually all
information about your PC’s configuration. Under previous versions of
Windows, these settings were contained in files like config.sys,
autoexec.bat, win.ini, system.ini, control.ini, and so on. The structure of
the registry is similar to the INI file structure. However, it goes beyond
the concept of INI files, as it offers a hierarchical structure similar to
the folders and files on your hard disk. In fact, you access the elements of
the registry the same way you access folders and files.

Here, I examine only the Win
95/98 registry, though the NT registry is also quite similar.

The registry editor

The registry editor–regedit.exe–is a utility that allows you to see,
search, modify, and save the Windows registry database. It doesn’t
validate the values you’re writing, but allows any operation. So you have
to pay close attention while using it to modify your registry.

To launch the registry
editor, run regedit.exe (under Win NT, run regedt32.exe with administrator
privileges).

The registry editor is
divided into two panes. The one on the left shows you a hierarchical
structure of the database (the screen looks like Windows Explorer), and the
one on the right shows the values.

The registry is organized
into keys and sub keys. Each key contains a value entry, and has a name, a
type or class, and the value itself. The name is a string that identifies
the key. The length and the format of the value depends on the data type.

The registry is divided into
five principal keys–there’s no way to add or delete keys at this level.
Only two of these keys are effectively saved on the hard disk–HKEY_LOCAL_MACHINE
and HKEY_USERS. The others are just branches of the main keys or are
dynamically created by Windows.

HKEY_LOCAL_MACHINE

This key contains hardware, applications, and services information. A lot of
hardware information is updated automatically when the computer boots. The
data stored in this key is shared with any user. This handle has many sub
keys.

Config:  Contains
configuration data for different hardware configurations.

Enum:  This
is the device data. For each device in your computer, you can find
information such as the device type, the hardware manufacturer, device
drivers, and the configuration.

Hardware: 
Contains a list of serial ports, processors, and floating-point
processors.

Network: 
Contains network information.

Security: 
Shows you network security information.

Software: This key
contains data about installed software.

System Contains data that
checks which device drivers are used by Windows and how they’re
configured.

Command line registry arguments

/L:SYSTEM To specify the
position of SYSTEM.DAT

/R:USER To specify the position
of USER.DAT

/e FILENAME.REG To export
the registry to a file. If the key is specified, the whole branch will
be exported.

/c FILENAME.REG To substitute
the entire registry with a .reg file

/s To work without prompt
information or Warnings.

HKEY_classes_root 

This key is an alias of the branch HKEY_LOCAL_MACHINE\Software\Classes and
contains OLE, drag-n-drop, shortcut, and file association information.

HKEY_CURRENT_CONFIG

This key is also an alias. It contains a copy of the branch HKEY_LOCAL_
MACHINE\Config, with the current computer configuration.

HKEY_DYN_DATA

Some information stored in the registry changes frequently, so Windows
maintains part of the registry in memory instead of the hard disk. For
example, this key stores plug-n-play information and computer performance.
This key has two sub keys.

Config Manager This key
contains all hardware information problem codes, with their status. There’s
also the sub key HKEY_LOCAL_MACHINE\Enum, but it’s written in a different
way.

PerfStats It contains
performance data about the system and the network.

HKEY_USERS

This important key contains the sub key .default and another key for each
user who has access to the computer. If there’s only one user, only the
.default key exists. Each sub key maintains the preferences of each user–the
desktop colors, the fonts used, and also the settings of many programs. A
user sub key contains five important sub keys.

AppEvent Contains the path of
audio files that Windows plays on specific events, such as emptying the
recycle bin, etc.

Control panel Contains the
settings defined in the Control Panel. These used to be stored in win.ini
and control.ini.

Keyboard layouts It contains
some advanced code that identifies the actual keyboard disposition and how
it is set into the Control Panel.

Network This key stores sub
keys that describe current and recent network shortcuts.

RemoteAccess The settings of
Remote Access are stored here.

Software Contains all
software settings. This data used to be stored in win.ini and private INI
files earlier. HKEY_CURRENT_USER

This is an alias to the current user of HKEY_USERS. If your computer is not
configured for usage by several users, it points to the sub key .default of
HKEY_USERS.

The .reg file

A .reg file is created when you export your registry. You can also write
your own .reg file. Here, I assume that you already have a .reg file on your
hard disk and want to know more about how it’s structured. Don’t double
click the .reg file or its contents will be added to the registry (of
course, a warning message will pop up). To view the properties of the .reg
file, open it in Notepad.

To do so, launch Notepad from
Start>Programs>Accessories>Notepad.

Then, through the open menu,
open the .reg file.

What differentiates .reg
files from other files is the word "REGEDIT4". This is the first
word in all .reg files. If this word is not there, the registry editor can’t
recognize the file as a .reg file.

This word will be followed by
a key declaration. This will be within square brackets and with the full
path. If the key doesn’t exist then it will be created.

After the key declaration,
you’ll see a list of values that have to be set in the particular key in
the registry. The values look like this:

"value name"=type:value

The value name is in double
quotes. "Type" can be absent for string values. dword: is used for
dword values and

hex: for binary values. For all other values, you have to use the code
hex(#):, where "#" indicates the API code of the type.

Here are some examples of
values.

"My string" =
"string value" is a string

"My dword" =
dword:123456789 is a dword

"My binary" =
hex:AA,BB,CC is a standard binary

"My other type"
= hex(2):AA,BB,00 is an expand string

Expand string has API
code=2 and extended string has API code=7.

As you can see, strings are
in double quotes, dword is hexadecimal, and binary is a sequence of
hexadecimal byte pairs, with a comma between each. If you want to add a
backslash into a string, remember to repeat it twice while writing a .reg
file, so the value "c:\Windows" will be "c:\\Windows".