5.1 Registry Editor Crash Course

Although the Registry is stored in multiple files on your hard disk, it is represented by a single logical hierarchical structure, similar to the folders on your hard disk. The Registry Editor ( Regedit.exe ) is included with Windows XP to enable you to view and manually edit the contents of the Registry.

When you open the Registry Editor, you'll see a window divided into two panes: the left side shows a tree with keys (represented as folders), and the right side shows the contents ( values ) stored in the currently selected key.

Editing the Registry generally involves navigating down through branches to a particular key and then modifying an existing value or creating a new key or value. You can modify the contents of any value by double-clicking it.

Although most Registry settings are entirely benign , you can irrevocably disable certain components of Windows XP ”or even prevent Windows from starting ”if you don't excercise some caution. You can limit the risk by creating Registry patches ( backups ) of keys before you modify their contents by going to File Export. Better yet, a complete system backup will ensure that even the most severe mistakes are recoverable.

To add a new key or value, select New from the Edit menu, select what you want to add, and then type a name . You can delete a key or value by clicking on it and pressing the Del key or by right-clicking on it and selecting Delete. You can also rename any existing value and almost any key with the same methods used to rename files in Explorer: right-click on an object and click Rename, click on it twice (slowly), or just highlight it and press the F2 key. Renaming a key or value is a safe alternative to deleting.

Similar to Explorer, though, is the notion of a path . A Registry path is a location in the Registry described by the series of nested keys in which a setting is located. For example, if a particular value is in the Microsoft key under SOFTWARE , which is under HKEY_LOCAL_MACHINE , the Registry path is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft .

5.1.1 Registry Structure

There are five primary, or "root," branches, each containing a specific portion of the information stored in the Registry:

HKEY_CLASSES_ROOT

This branch contains the information that comprises your Windows file types. This entire branch is a symbolic link, or "mirror," of HKEY_LOCAL_MACHINE\SOFTWARE\Classes , but is displayed separately in this branch for clarity and easy access.

HKEY_USERS

This branch contains a sub-branch for the currently logged-in user, the name of which is the current user 's SID (security identifier), a unique, 37-digit string of numbers . Use HKEY_CURRENT_USER for a more convenient point of entry to the data in this branch.

HKEY_CURRENT_USER

This branch points to a portion of HKEY_USERS , signifying the currently logged-in user. This way, any application can read and write settings for the current user without having to know which user is currently logged on. In each user's branch are the settings for that user, such as Control Panel and Explorer settings, application preferences, and other personal settings.

The Software branch, subdivided by software manufacturer and application name, is where you'll find most of the interesting settings. As though Windows was just another application on your system, you'll find most user-specific Windows settings in HKEY_CURRENT_USER\Software\Microsoft\Windows .

HKEY_LOCAL_MACHINE

This branch contains information about all the hardware and software installed on your computer that isn't specific to the currently logged-in user. The settings in this branch are the same for all users on your system. The Software branch, similar to the one in HKEY_CURRENT_USER , contains settings arranged by software manufacturer and then product name.

HKEY_CURRENT_CONFIG

This branch typically contains a small amount of information, most of which simply points to other portions of the Registry. There's little reason to mess with this branch.

5.1.2 Value Types

Values are where Registry data is actually stored (as opposed to keys, which are simply used to organize values). The Registry contains several types of values, each appropriate to the type of data it is intended to hold. There are five primary types of values that are displayed and modified in the Registry Editor:

String values ( REG_SZ )

String values contain strings of characters , more commonly known as plain text.

String array/Multi-String values ( REG_MULTI_SZ )

Contains several strings, concatenated (glued) together and separated by null characters. Although Registry Editor lets you create these values, it's impossible to type null characters (ASCII character #0) from the keyboard. The only way to generate a null character is programmatically or via cut-and-paste.

Expandable string values ( REG_EXPAND_SZ )

Contains special variables , into which Windows substitutes information before delivering to the owning application. For example, an expanded string value intended to point to a sound file may contain %SystemRoot%\Media\doh.wav . When Windows reads this value from the Registry, it substitutes the full Windows path for the variable, %SystemRoot% ; the resulting data then becomes (depending on where Windows is installed) c:\Windows\Media\doh.wav . This way, the value data is correct regardless of the location of the Windows folder.

Binary values ( REG_BINARY )

Similarly to string values, binary values hold strings of characters. The difference is the way the data is entered. Instead of a standard text box, binary data is entered with hexadecimal codes in an interface commonly known as a hex editor . Each individual character is specified by a two-digit number in base-16 (e.g., 6E is equivalent to 110 in base 10), which allows characters not found on the keyboard to be entered. You can type hex codes on the left or normal text on the right, depending on where you click with the mouse.

DWORD values ( REG_DWORD )

Essentially, a DWORD is a number. Often, the contents of a DWORD value are easily understood , such as for no and 1 for yes, or 60 for the number of seconds in some timeout setting. A DWORD value would be used where only numerical digits are allowed, whereas string and binary values allow anything.

In the DWORD value editor, you can change the base of the number displayed, a setting that will result in the wrong value being entered if set incorrectly. In most cases, you'll want to select Decimal (even though it's not the default), because decimal notation is what we use for ordinary counting numbers.

The application that creates each value in the Registry solely determines the particular type and purpose of the value. In other words, no strict rules limit which types are used in which circumstances or how values are named. A programmer may choose to store, say, the high scores for some game in a binary value called High Scores or in a string value called Lard Lad Donuts .

An important thing to notice at this point is the string value named (default) that appears at the top of every key. The default value cannot be removed or renamed , although its contents can be changed; an empty default value is signified by value not set . The (default) value doesn't necessarily have any special meaning that would differentiate it from any other value, apart from what might have been assigned by the programmer of the particular application that created the key. Figure 5-1 shows an example of such a value being edited.

Figure 5-1. Double-click any value to edit its contents