📄 winreg.htm
字号:
<html>
<head>
<title>file:///e:/kaifa/format/windows/winreg.txt</title>
</head>
<body background="../jpg/di1.JPG">
<p align="center"><font size="6" color="#0000ff">windows registry files</font></p>
<div align="center"><center>
<table border="0" width="88%">
<tr>
<td width="100%"> <pre>agreement:
==========</pre>
<pre>the author of this document will not be responsible for any damage and/or
license violation that may occur. the information within this document is
provided "as is" without warranty of any kind...
this information was "collected" during sleepless nights, and is not
officially released by microsoft! it shall give you a peek at the windows(tm)
internals to give you a chance to recover from corrupted data.</pre>
<pre>the author has nothing to do with microsoft, except that he uses their
products...</pre>
<pre>if you don't agree with this, stop reading this document, and delete it at
once!
</pre>
<pre>history:
========</pre>
<pre>what is the registry? where did it came from? two questions, which i will try to
answer here. the registry is a database (at least microsoft thinks so:)
which contains configuration information about the system.
it mainly is a memory dump which is saved to one or more files on the windows
host drive. it is loaded every system-boot and remains resident until
shutdown. since parts of it are not used during normal operation it will be
swapped out very soon. the registry appeared with windows 3.?? (sorry, i can't
remember any earlier version :-), where it was used for file associations and
the "ole" functions (the conection between ole-id's and the applications).
this is a critical information and since the registry has (almost) no
checksum information (!), it sometimes gets corrupted. this is the main
reason for this doc.</pre>
<pre>using windows 3.x, almost every configuration was done using good old ".ini"-
files, which were readable but slow and limited in size (64k). in windows 95
(and nt), the registry was used instead of these files. so, to edit a
particular setting, you would have to run the application which manages these
settings. :( but what if this app won't start? ms included a tool named
regedit in windows 3.?? and 95, and a regedt32 in windows nt. you can use
these apps to edit all contents of the registry (in windows nt the registry
supports security, as well as it provides the security for the whole system!)</pre>
<pre>an application can open a "key", write values (variables) to it and fill them
with data. each key represents also a value called "default" and can contain
any number of sub-keys. this will form a tree-structure as you can see at
the left half of regedit. (note: regedit from windows 3.?? has to be started
with /v or /y, i can't remember now)
</pre>
<pre>where can i find the registry???
================================</pre>
<pre>that differs for each windows-version:</pre>
<pre>version file(s) contents
3.1x reg.dat complete windows 3.?? registry</pre>
<pre>95 system.dat system-values (hkey_local_machine)
user.dat user-values (hkey_users)</pre>
<pre>nt system32\config\sam sam-part of the registry (=nt security)
system32\config\software software-specific part
(hkey_local_machine\software)
system32\config\system system-specific part
(hkey_local_machine\system)
profiles\%username%\ntuser.dat user-specific part
(hkey_current_user\{s-1-xxx...})
profiles\%username%\ntuser.man like ntuser.dat but a
mandatory-profile</pre>
<pre>if you are using a roaming-profile with windows nt, ntuser.xxx can be on
a network-share as well...
</pre>
<pre>terms
=====</pre>
<pre>the registry consists of the following elements:</pre>
<pre> hive: strating point of the structure. the name of an hive starts
with the "hkey_"-prefix. can be seen as a "drive" in a file
system.</pre>
<pre>hive name beschreibung 3.1 95 nt4
hkey_classes_root points to the "class" key in
the "hkey_local_machine" hive,
the only hive in windows 3.?? x x x</pre>
<pre>hkey_current_user information and settings valid
for the currently logged in
user. (points to the correct x x
key under "hkey_users")</pre>
<pre>hkey_current_config settings for the currently
active hardware profile.
points to "hkey_local_machine\ x x
control\controlsetxxx</pre>
<pre>hkey_users contains all currently active
user settings. since nt is a
single user system, there
will be only one key (the s-id x x
of the active user), and a
".defualt" key (the settings
for the ctrl-alt-del environment)</pre>
<pre>hkey_localmachine all local settings x x</pre>
<pre>hkey_dyn_data as the name says, here you'll find x
dynamic data (cpu-usage,...)
</pre>
<pre> key: a key to the registry can be seen as a directory in a file
system.
value: can be seen as the registrys "file"
data: is the actual setting, can be seen as the contents of a
file
</pre>
<pre>windows 3.x
===========</pre>
<pre>this registry is the easiest one. it consists of 3 blocks, which are not
"signed" at all:</pre>
<pre>block position size
header 0 32 bytes
navigation-info 0x00000020 ???
data-block ??? ???</pre>
<pre>the "???" marked values can be read from the header.</pre>
<pre>header
======</pre>
<pre>offset size description
0x0000 8 byte ascii-text: "shcc3.10"
0x0008 d-word ?
0x000c d-word ? (always equal the d-word at 0x0008)
0x0010 d-word number of entrys in the navigation-block
0x0014 d-word offset of the data-block
0x0018 d-word size of the data-block
0x001c word ?
0x001e word ?</pre>
<pre>values marked "?" are not important for a read-access, and therefore unknown
to me...</pre>
<pre>navigation-block
================</pre>
<pre>this is where chaos rules! it consists of two different, 8 byte long blocks:</pre>
<pre> * navigation-info-record,
* text-info-record</pre>
<pre>the first record in the navigation block is a navigation info record.</pre>
<pre>navigation-info-record</pre>
<pre>offset size contents
0x00 word next key (same level)
0x02 word first sub-key (one level deeper)
0x04 word text-info-record key-namens
0x06 word text-info-record key-value (default)</pre>
<pre>the values are the locical number of the block inside the file:</pre>
<pre> offset=blocksize*blocknumber+headersize</pre>
<pre>since 2 of this values are constant:</pre>
<pre> offset=8*blocknumber+0x20
</pre>
<pre>text-info-record
================
</pre>
<pre>offset size contents
0x00 word ?
0x02 word number of references to this text
0x04 word text-length
0x06 word offset of the text-string inside the data-block</pre>
<pre>to get the text-offset inside the file you have to add this offset to the
data-offset inside the header.</pre>
<pre>data-block
==========</pre>
<pre>the data-block only consists of a collection of text-strings. right in front
of every text is a word which may or may not have a meaning. the offset in
the text-info record points directly to the text, the text-size has to be
defined in the text-info record too.
</pre>
<pre>windows 95
==========</pre>
<pre>the windows95-registry files:</pre>
<pre>inside the windows-directory (default: c:\windows) are 2 files which are
loaded to form the registry:</pre>
<pre> system.dat</pre>
<pre>and</pre>
<pre> user.dat</pre>
<pre>this files are mapped to the following hives:</pre>
<pre> hkey_local_machine in system.dat</pre>
<pre>and</pre>
<pre> hkey_users in user.dat
</pre>
<pre>the file structure:
===================
</pre>
<pre>both files have the same structure. each of them consists of 3 blocks where
1 of these blocks can be repeated.
every block has a 4 byte long signature to help identify its contents.</pre>
<pre>id block-contents max. size
creg header 32 bytes @ offset 0
rgkn directory information
(tree-structure) ??? @ offset 32
rgdb the real data
(values and data) max. 65535 bytes an offset ??</pre>
<pre>these blocks are "sticked together" with no space between them, but always
a multiple of 16 in size.</pre>
<pre>the creg-block
==============</pre>
<pre>offset size inhalt
0x00000000 d-word ascii-"creg" = 0x47455243
0x00000008 d-word offset of 1st rgdb-block
0x00000010 d-word # of rgdb-blocks</pre>
<pre>all other values are not needed to read the registry...
</pre>
<pre>the rgkn-block
==============</pre>
<pre>i assume that rgkn stands for registry-key-navigation. this block contains
the information needed to built the tree-structure of the registry. this
block will be larger then 65536 bytes (0xffff)!</pre>
<pre>all offset-values are relative to the rgkn-block!</pre>
<pre>offset size contents
0x00000000 d-word ascii-"rgkn" = 0x4e4b4752
0x00000004 d-word size of the rgkn-block in bytes
0x00000008 d-word rel. offset of the root-record
0x00000020 ???? tree-records (often the 1st record)</pre>
<pre>the tree-record
===============</pre>
<pre>the tree-record is a "complete" registry-key. it contains the "hash"-info
for the real data stored in this key.</pre>
<pre>offset size contents
0x0000 d-word always 0
0x0004 d-word hash of the key-name
0x0008 d-word always -1 (0xffffffff)
0x000c d-word offset of the owner (parent)-records
0x0010 d-word offset of the 1st sub-sey record
0x0014 d-word offset of the next record in this level
0x0018 d-word id-number of the real key</pre>
<pre>the 1st entry in a "usual" registry file is a nul-entry with subkeys: the
hive itself. it looks the same like other keys. even the id-number can
be any value.</pre>
<pre>the "hash"-value is a value representing the key's name. windows will not
search for the name, but for a matching hash-value. if it finds one, it
will compare the actual string info, otherwise continue with the next key.</pre>
<pre>end of list-pointers are filled with -1 (0xffffffff)
</pre>
<pre>the id-field has the following format:</pre>
<pre> bits 31..16: number of the corresponding rgdb-blocks
bits 15..0: continuous number inside this rgdb-block.
</pre>
<pre>the hash-method:
================</pre>
<pre>you are looking for the key: software\microsoft</pre>
<pre>first you take the first part of the string and convert it to upper case</pre>
<pre> software</pre>
<pre>the "\" is used as a seperator only and has no meaning here.
next you initialize a d-word with 0 and add all ascii-values of the string
which are smaller than 0x80 (128) to this d-word.</pre>
<pre> software = 0x0000026b</pre>
<pre>now you can start looking for this hash-value in the tree-record.
if you want to modify key names, also modify the hash-values, since they
cannot be found again (although they would be displayed in regedit)</pre>
<pre>the rgdb-block
==============</pre>
<pre>header:</pre>
<pre>offset size contents
0x0000 d-word ascii-"rgdb" = 0x42444752
0x0004 d-word size of this rgdb-block
0x0020 ???? rgdb records
</pre>
<pre>rgdb-record (key-information)
=============================</pre>
<pre>offset size contents
0x0000 d-word record length in bytes
0x0004 d-word id-number
0x0008 d-word ??? size ???
0x000c word text length of key name
0x000e word number of values inside this key
0x0010 d-word always 0
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -