Igor Delovski Board

[delovski]

Bug with RegCreateKeyEx on Win2K!

On CBoard: RegCreateKeyEx Returning ERROR_FILE_NOT_FOUND with REG_OPTION_BACKUP_RESTORE

"Everything works fine in XP. If the key exists, it is opened. If it does not
exist, it is created and opened. However, in win2k, the code works properly
if the key exists, but if it does not, the function returns
ERROR_FILE_NOT_FOUND."

From there, we're pointed to Microsoft's Knowledge Base: BUG: RegCreateKeyEx May Fail When Using REG_OPTION_BACKUP_RESTORE

[delovski]

C Board: RegSaveKey And Identical Keys

"I am trying to create a copy of registry keys without using RegSaveKey.
Part of it is a learning excercise, and the other part of it is wanting to develop
a registry copying mechanism that does not overwrite the existing data
upon restoration (like RegRestoreKey does).

As far as I can tell my copy mechanism is working right. Value data, subkey
data, and security descriptor data seems to be an identical match when I
compare a copied key to it's original. However, when I attempt to save the
copied key using RegSaveKey and compare it to the original key saved
with RegSaveKey, a binary comparison of the file shows differences."

[XNote]

MSDN: RegSaveKey

Saves the specified key and all of its subkeys and values to a new file,
in the standard format.

[delovski]

Shell Revealed: Default Programs: How do you unassociate a file extension in Vista?

"Our guidance for uninstall is not to worry about the HKCU per user default
as windows makes sure to broker it correctly. However, when uninstalling,
your app should restore the HKLM value to what it was before it took over.
Your app should do this by recording what the default was before it takes
over the machine default and using the recorded value on uninstall to restore
the system. This method does have some flaws though."

[delovski]

Two really useful Registry tips by Raymod Chen:

1. Beware of non-null-terminated registry strings.

"Lots of people lie about their registry data. You'll find lots of things that should be REG_DWORD
stored as a four-byte REG_BINARY. (This is in part a holdover from Windows 95's registry,
which didn't support REG_DWORD.)

One of the most insidious lies is to lie about the length of a string you're writing to the registry.

This has security implications. If your program assumes that strings in the registry are
always null-terminated, then you can be tricked into a buffer overflow if you happen across a
non-null-terminated string."

2. Why does Add or Remove Programs show a large blank space?

"If you go to the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall,
you'll find a list of programs that have registered for appearing in the Add or Remove Programs
control panel. Some of them might have been so kind as to provide a "DisplayIcon" value,
thereby saving the control panel the indignity of having to guess at an appropriate icon.
Unfortunately, if they put a bad icon registration in that registry value, the result is a bunch of
blank space since the control panel is trying to reserve space for a bogus icon."

[delovski]

CodeGuru: An AES Encrypting Registry Class,
by Jeffrey Walton

"The CAESEncRegKey class addresses the occasional problem of securely
saving data to the Registry. This article presents Yet Another Registry Class
that uses AES to encrypt data."

[Ike]

Raymond Chen: The .Default user is not the default user

"Unfortunately, the name .Default has led people to believe that this user's
settings are the basis for new user profiles. In retrospect, calling it .Default
was probably a bad decision."

[delovski]

RC: What is the difference between the Folder and Directory (and other special) progids?

"When you're installing your shell extension, you need to know which progid
to hang it off of inside HKEY_CLASSES_ROOT. We'll start with the title question
and then move on to other predefined (but perhaps not well-known) progids."

[XNote]

Remove "Shortcut" Text From New Shortcuts in Vista

"A source of annoyance for many Windows users is the " - Shortcut" text
that is added to the name of newly created shortcuts, and every time you
have to manually edit the shortcut and remove that text. Wouldn't it be
great if there was a registry hack for this?"

[Ike]

RC: How did registry keys work in 16-bit Windows?

"Back in 16-bit Windows, the registry was a very different beast. Originally,
the only registry hive was HKEY_CLASSES_ROOT, and the only things it was
used for were COM object registration and file type registration."

[delovski]

OldNewThing: Why do registry keys have a default value?

> The whole registry nomenclature is a bit confusing, because a "key" has
> multiple "values", and each "value" has an associated name and value.
> (Except for the default value, which is not named.) So to get a setting
> out of the registry you have to get the "value value."

(Yes, I know, backwards compatibility forces your hand, like in everything.)
[The correct term for the contents of a value is data, so it's not "value value"
but rather "value data". Not that it helps much. -Raymond]

[delovski]

Richard WM Jones - Why the Windows Registry sucks … technically

"It’s quite popular to bash the Windows Registry in non-technical or lightly
technical terms. I’ve just spent a couple of weeks reverse engineering the
binary format completely for our hivex library and shell which now suppo-
rts both reading and writing to the registry. So now I can tell you why the
Registry sucks from a technical point of view too."