Windows Registry: Difference between revisions

From Computers Wiki
Jump to navigationJump to search
(→‎REGEDT16.EXE: Add another note)
(Switch to new KB template)
 
(3 intermediate revisions by the same user not shown)
Line 40: Line 40:
*If the <code>&nbsp;=&nbsp;</code> and value are omitted, the key is created without a value.
*If the <code>&nbsp;=&nbsp;</code> and value are omitted, the key is created without a value.
*Escape sequences are not understood.
*Escape sequences are not understood.

=== Hive file format ===

The native and IE5 file formats appear to be the same despite the enhanced functionality in the IE5 registry; they both even start with the same header (<code>SHCC3.10</code>). hivex 1.3.23 does not understand the format, saying "not a Windows NT Registry hive file".<ref>https://github.com/libguestfs/hivex/blob/v1.3.23/lib/handle.c#L174</ref> There is an undated document written by B.D. detailing the format of the Windows 3.1 registry and how it differs from later versions.<ref>https://web.archive.org/web/20110107144933fw_/http://files.volatileminds.net/winreg.txt</ref>

TODO: figure out where all the REGEDIT4-style data gets stored in the Windows 3.1-style <code>REG16X2.DAT</code>


=== KB articles ===
=== KB articles ===


*[https://helparchive.huntertur.net/viewer/document/99262 Q78346: Windows: Maximum Valid Size for REG.DAT and .INI Files]
*{{KB|Q78346|Windows: Maximum Valid Size for REG.DAT and .INI Files}}
*[https://helparchive.huntertur.net/viewer/document/96873 Q80393: How to Rebuild the Default Windows REG.DAT File]
*{{KB|Q80393|How to Rebuild the Default Windows REG.DAT File}}
*[https://helparchive.huntertur.net/viewer/document/96150 Q81530: Cannot Use How To Use Help in Registration Editor]
*{{KB|Q81530|Cannot Use How To Use Help in Registration Editor}}
*[https://helparchive.huntertur.net/viewer/document/97857 Q82144: REG.DAT May Need Update if Both Windows 3.0, 3.1 Installed]
*{{KB|Q82144|REG.DAT May Need Update if Both Windows 3.0, 3.1 Installed}}
*[https://helparchive.huntertur.net/viewer/document/97518 Q82650: OLE: SETUP.REG Can Be Used to Repair REG.DAT]
*{{KB|Q82650|OLE: SETUP.REG Can Be Used to Repair REG.DAT}}
*[https://helparchive.huntertur.net/viewer/document/98841 Q82810: Where Windows Searches for REG.DAT]
*{{KB|Q82810|Where Windows Searches for REG.DAT}}
*[https://helparchive.huntertur.net/viewer/document/97812 Q82814: Re-Registering .REG Files]
*{{KB|Q82814|Re-Registering .REG Files}}
*[https://helparchive.huntertur.net/viewer/document/97859 Q82821: Registration Info Editor (REGEDIT) Command-Line Switches]
*{{KB|Q82821|Registration Info Editor (REGEDIT) Command-Line Switches}}
*[https://helparchive.huntertur.net/viewer/document/95973 Q84791: Associating Files and Passing Command-Line Parameters]
*{{KB|Q84791|Associating Files and Passing Command-Line Parameters}}
*[https://helparchive.huntertur.net/viewer/document/99084 Q85326: Windows Err Msg: Failed to Register Server]
*{{KB|Q85326|Windows Err Msg: Failed to Register Server}}


== References ==
== References ==
Line 58: Line 64:
<references />
<references />


[[Category:File Formats]]
[[Category:Windows]]
[[Category:Windows]]

Latest revision as of 02:33, 31 October 2023

The Windows Registry is a unnecessarily nested key-value store.

Windows for Workgroups 3.11

The following things were noticed after installing the 16-bit version of Internet Explorer 5.01.

REGEDIT.EXE

This one is bundled with the operating system. Run it with the /v flag to make it actually usable.

  • It only sees the type registrations (HKEY_CLASSES_ROOT in REGEDT16.EXE).
  • In verbose mode, spaces in keys are replaced with #.
  • There is only one value per key ((Default) in REGEDT16.EXE), and it is always a string.
  • A "Revert to Last Save" menu item exists.
  • Data is stored in %WINDIR%\REG.DAT.[1]
  • Separate REGEDIT.HLP and REGEDITV.HLP files exist. The latter is used for the Help menu when running in verbose mode.
  • Verbose mode takes significantly longer to start than standard mode.

REGEDT16.EXE

This one comes with the 16-bit version of Internet Explorer 5.01.

  • This gets dumped into %WINDIR%\SYSTEM unlike the native REGEDIT.EXE
  • The About dialog states this is for both Windows 3.1 and Windows NT 3.51.
  • HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE are present too.
  • String, Binary, and DWORD are the only types.
  • Data is stored in %WINDIR%\REG16X2.DAT.[2]
  • REG16X2.Enn for 00-99 are created next to the file for each installation and uninstallation attempt.
  • The program starts significantly more quickly than REGEDIT.EXE /V.
  • %WINDIR%\SYSTEM\REGDATA also gets created with a bunch of .BIN files. They are full of strings about certificate authorities. Microsoft states this directory is used for Terminal Server licensing, but the timestamps of the files show that they were created with the IE5 installation.[3]

Native .REG file format

This section details the native format understood by Windows 3.1. 16-bit Internet Explorer 5.01 and the like instead use the newer REGEDIT4 format.

  • The first line is REGEDIT with no version afterwards. Contrast this with REGEDIT4 and Windows Registry Editor Version 5.00 present in later versions.
  • HKEY_CLASSES_ROOT is explicitly prepended to every key. Contrast this with REGEDIT.EXE /V strongly implying that the root is \ instead.
  • Every processed line has the format HKEY_CLASSES_ROOT\path\to\key = Value of key.
  • Lines that do not start with HKEY_CLASSES_ROOT are ignored; no special character is needed to start a comment.[4]
  • If the  =  and value are omitted, the key is created without a value.
  • Escape sequences are not understood.

Hive file format

The native and IE5 file formats appear to be the same despite the enhanced functionality in the IE5 registry; they both even start with the same header (SHCC3.10). hivex 1.3.23 does not understand the format, saying "not a Windows NT Registry hive file".[5] There is an undated document written by B.D. detailing the format of the Windows 3.1 registry and how it differs from later versions.[6]

TODO: figure out where all the REGEDIT4-style data gets stored in the Windows 3.1-style REG16X2.DAT

KB articles

References