The HKEY LOCAL MACHINEHARDWARE Key

The HKEY_LOCAL_MACHINE/HARDWARE Key

The HKEY_LOCAL_MACHINE HARDWARE registry key contains hardware data recreated during each system startup. This data includes information about the devices on the motherboard and the data on the IRQs used by individual device drivers.

The HARDWARE key contains important data sets subdivided between the following three subkeys: DESCRIPTION, DEVICEMAP, and RESOURCEMAP.

All the information contained under HKEY_LOCAL_MACHINE\HARDWARE is volatile. This means that the settings are computed and recreated each time the system starts up, and are lost when you shut the system down. All drivers and applications use this subtree for obtaining information on system components and for storing the data directly under the DEVICEMAP subkey and indirectly under the RESOURCEMAP subkey (Fig. 7.1).

click to expand
Fig. 7.1: The HKEY_LOCAL_MACHINE\HARDWARE registry key

Note 

As was explained in Chapter 5, integrated support for Plug and Play and power management in Windows 2000/XP is available only on computers that have an Advanced Configuration and Power Interface (ACPI) BIOS. At boot time, the operating system loader checks whether such a BIOS is loaded. If so, ACPI is enabled in the operating system. If such a BIOS is not loaded, ACPI is disabled and the less reliable Advanced Power Management (APM) model is used instead. Microsoft supplies the ACPI driver as part of the operating system. On systems that have an ACPI BIOS, the HAL causes the ACPI driver to be loaded during system start-up at the base of the device tree, where it acts as the interface between the operating system and the BIOS. The ACPI driver is transparent to other drivers. If your system has ACPI BIOS, the HKEY_LOCAL_MACHINE\HARDWARE registry tree will contain the nested ACPI subkey (Fig. 7.1).

Don't try to edit the data under HKEY_LOCAL_MACHINE\HARDWARE directly. This information is usually stored in binary format and is difficult to understand if you can't interpret binary data.

Tip 

If you are working with Windows 2000, and need to view the hardware data in user-friendly format, select Programs | Administrative Tools | Computer Management from the Start menu and expand the MMC console tree. To view the same information in Windows XP, click the Start button, then select the All Programs | Accessories | System Tools | System Information commands to open the System Information window (Fig. 7.2). Like Windows 2000 hardware data, Windows XP hardware information will be represented in user-friendly format (the system also reads it from the system registry).

click to expand
Fig. 7.2: Viewing Windows XP hardware information using the System Information utility

The DESCRIPTION Subkey

The DESCRIPTION subkey under HKEY_LOCAL_MACHINE\HARDWARE displays information from the hardware database. For x86 computers, this information contains data on the devices detected by Ntdetect.com and Ntoskrnl.exe.

Ntdetect.com is the standard DOS-style program that uses BIOS calls for selecting hardware information and configuring hardware devices. This includes date and time information stored in the CMOS chip; bus types (for example, ISA, PCI, EISA) and identifiers of the devices on these buses; data on the number, type, and capacity of the hard drives installed in the system; and the number and types of parallel ports. Based on this information, the system creates internal data structures that Ntoskrnl.exe stores under HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION during system startup.

A specific feature of the Ntdetect.com version included with Windows 2000 and Windows XP is that PnP detection functions are delegated to PnP drivers. In contrast, the Windows NT 4.0 version of Ntdetect.com detects all installed hardware (due to limited PnP support in Windows NT 4.0).

Ntdetect.com detects the following hardware:



  • Type of bus/adapter

  • Keyboard

  • SCSI adapters

  • COM-ports

  • Machine ID



  • Video adapter

  • Arithmetic co-processor

  • Mouse

  • Floppy drives

  • Parallel ports


Note 

Network adapters aren't detected at this phase. The system detects network adapters either during Windows NT/2000/XP installation, or when you install a new network adapter.

There are more subkeys, each of them corresponds to a certain bus controller type. These subkeys are located under HKEY_LOCAL_MACHINE\Hardware\Description\System\MultifunctionAdapter. Each of these keys describes a specific controller class (including hard disk controllers, display controllers, parallel port controllers, and SCSI controllers.) The path to the subkey describes the component type. All physical devices are numbered, beginning from 0.

Each detected hardware component has Component Information and Configuration Data settings, which contain binary data on the version of a specific component and its configuration (Fig. 7.3). The Identifier setting contains the component name (if specified).

click to expand
Fig. 7.3: The HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter registry key

The DEVICEMAP Subkey

The HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP registry key contains a set of subkeys. The subkeys contain one or more settings that specify the path to the drivers required by each device. Let's consider using this information for searching for device drivers. For example, how does the registry store information on the video drivers? Fig. 7.4 shows an example illustrating the contents of the VIDEO subkey under the DEVICEMAP key (the information you'll see when you open the registry key will differ from what's shown in this figure). However, the information will show you what you'll see in general.

click to expand
Fig. 7.4: The HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO registry key

The HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\VIDEO registry key contains settings that are actually links to currently active devices. These registry items use an ordinal naming scheme (for example, in Fig. 7.4 it's \Device\VideoN, where N is an ordinal number (0, 1, 2). The values of each of these registry settings are REG_SZ strings that reference particular device drivers.

Note 

Notice that these strings have a specific data format. For example, the Device\Video0 setting represented in Fig. 7.4 is set to \Registry\Machine\System\CurrentControlSet\Control\Video\{AFCB39E1–9FBB–4404–A3AE–29492CF7D79D}\0000 value. This format is different from the one that's normally used (for example, HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER). What does it mean?

All Windows NT-based operating systems, including Windows 2000 and Windows XP, are object-oriented, which means that they manipulate several object types, including devices, ports, events, directories, and symbolic links. Registry keys are objects of special types. The registry root key is the object of the Key type named REGISTRY. In the DDK (Device Driver Kit) documentation, the names of all the registry keys begin with the \REGISTRY string (for example, \REGISTRY\Machine\CurrentControlSet\Services). Thus, the HKEY_LOCAL_MACHINE handle is the key named \REGISTRY\Machine, and the HKEY_USERS handle is the key named \REGISTRY\User.

Now let's expand the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{AFCB39E1–9FBB–4404–A3AE–29492CF7D79D}\0000 registry key (Fig. 7.5). Notice that it contains quite a lot of entries, mostly in binary format.

click to expand
Fig. 7.5: The contents of the HKLM\SYSTEM\CurrentControlSet\Control\Video\{AFCB39E1–9FBB–4404–A3AE–29492CF7D79D}\0000 registry key

However, among these entries there is the Device Description value (data type REG_SZ), which, as its name implies, contains the device description (NVIDIA RIVA TNT, in our example). Besides, it also contains another value, InstalledDisplayDrivers, which references the driver for this device. In our case it references the nv4 service. The information on this service can be found in the registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry key, which must contain a nested key with the same name (nv4 in our example). Let us expand the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key; there we'll find a nested key named nv4 (Fig. 7.6). It must exist for the device to function properly, and you'll certainly find it.

click to expand
Fig. 7.6: The contents of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nv4 registry key

Tip 

Use Regedit.exe searching capabilities to find the key, since in our case this is the easiest way to locate the required key.

The key that you'll locate contains standard settings that specify the start mode for the driver: Start, Tag, Type, ErrorControl, and Group. Depending on the driver type, its key may contain several other settings, such as the ImagePath setting that specifies an actual path to the directory where the driver resides.

Note 

Notice how the image path has been specified. The loading order for the driver is specified by the Start setting (as we saw in the previous chapter). Sometimes the system doesn't assign drive mappings at the time the driver's loaded. Because of this, an error may result if you specify, for example, "C:\WINNT\System32\DRIVERS\<YourDriver>" as a value for ImagePath.

The HKEY_LOCAL_MACHINE\SYSTEM\ControlSetnnn\Services\<Driver> key may contain an optional REG_SZ setting named DisplayName. The value assigned to this parameter is a text string displayed by administrative utilities like the Devices Control Panel applet (Windows NT 4.0) or the MMC console (Windows 2000 and Windows XP). If the DisplayName setting is omitted, then the actual name of the service or driver will be displayed in the list (in our example, the list will display the nv4 driver name).

In addition to the settings listed above, the video driver key under HKEY_LOCAL_MACHINE\SYSTEM\ControlSetnnn\Services contains several subkeys. One of the most important subkeys within this key is DeviceN—in our example, this is the Device0 subkey (Fig. 7.7).

click to expand
Fig. 7.7: An example of the contents of the DeviceN nested key for the device driver subkey under HKEY_LOCAL_MACHINE\SYSTEM\ControlSetnnn\Services

Depending on the video driver implementation, this key may contain a variety of parameters, including the VgaCompatible standard setting, which is set to FALSE for most modern drivers. If the parameter is set to FALSE, the driver is based on the MS VGA miniport driver.

The following REG_BINARY settings under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Video\{AFCB39E1–9FBB–4404–A3AE–29492CF7D79D}\0000:

 HardwareInformation.ChipType,   HardwareInformation.Crc32, HardwareInformation.DacType   HardwareInformation.MemorySize 

contain hardware information displayed by administrative utilities. Notice that these settings are present in both the Windows NT 4.0/Windows 2000 and in Windows XP registries, but under different locations.

When Windows GUI starts, the system reads the video settings contained under the following registry key (Fig. 7.8):

click to expand
Fig. 7.8: Registry settings that specify the video mode

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\   Current\System\CurrentControlSet\Control\VIDEO\   {AFCB39E1-9FBB-4404-A3AE-29492CF7D79D}\0000 

After reading these settings, the system checks whether the display driver supporting the specified mode is present. As soon as the appropriate driver has been found, the startup procedure continues. What happens, though, if the system can't find an appropriate driver? The answer's simple: the system will use standard VGA mode (16 colors).

Thus, we have considered the usage of the HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP information for searching for specific device driver data. We've used the video adapter as an example, but the system uses a similar algorithm for locating the appropriate drivers for any other device. To summarize, let's note that the HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP data describes either an actual port name or the path to the appropriate subkey under HKEY_LOCAL_MACHINE\System\ControlSetnnn\Services. This, in turn, contains the necessary information on the device driver. Sometimes system administrators may need this information for troubleshooting purposes. It should be noted again that administrative utilities, such as Device Manager, display the same information presented in user-friendly format rather than raw binary data.

The RESOURCEMAP Subkey

The RESOURCEMAP subkey under HKEY_LOCAL_MACHINE\HARDWARE maps device drivers and hardware resources allocated to these drivers. Each setting stored within the RESOURCEMAP key contains the data reported by the device driver concerning memory addresses, IRQs, and DMA channels requested by respective drivers. All the data contained within this key is volatile. Windows NT/2000 and Windows XP recreate the key during every system startup.

Because Windows 2000 and Windows XP implement full-featured Plug and Play support and include a new kernel-mode component (Plug and Play Manager), the contents of the HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP registry key are different for Windows 2000/XP from what they are for Windows NT 4.0. In the Windows NT 4.0 registry, the RESOURCEMAP key contains multiple <DeviceClass> subkeys, which are used to store information on specific device driver classes. Each of these keys contains one or more <DriverName> subkeys that store information related to individual drivers.

The RESOURCEMAP key in Windows 2000/Windows XP registries looks somewhat different (Fig. 7.9). The kernel-mode Plug and Play Manager now controls all the hardware devices. Because of this, the data concerning system resources is stored under the following registry key: HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\PnP Manager\PnpManager.

click to expand
Fig. 7.9: The RESOURCEMAP key in Windows XP



Windows XP Registry
Linux Enterprise Cluster: Build a Highly Available Cluster with Commodity Hardware and Free Software
ISBN: N/A
EAN: 2147483647
Year: 2000
Pages: 144
Authors: Karl Kopper

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net