Windows Registry

[jadecook]

I know this is sort of a noobish question but I was wondering how registry keys work? I get that they store config settings and options but in plain English: where are they located, how do you read them, what can they do, and how do they work?

[WallShadow]

The Windows registry is a large set of values written in the computer's hardware. the registry is designed in three key parts, for example, take the following registry key:

HKCU/Software/Sysinternals/Process Monitor "AlwaysOnTop" REG_DWORD 0x00000000 (0)

this is an example of a registry key from my computer. 'HKCU' denotes the HIVE that it is located in. all registry keys are located in a HIVE. there are always only 5 different HIVE's, but the 2 main ones are HKCU (HKEY_Current_User) and HKLM (HKEY_Local_Machine). '/Software/Sysinternals/Process Monitor' is a file path (just like normal file paths on your file system) to the key. 'AlwaysOnTop' denotes the name of the key, 'REG_DWORD' denotes the type of it (REG_DWORD means a 4 byte value), and '0x00000000 (0)' denotes the value. You can associate the HIVE as a drive letter, the path as a path through folders, the key name as a name of the file, the type as a file extension, and the value being the contents of the file. the registry is a miniature file system for various configurations.

To access it, many languages provide API's to list through it, but you can also use the REGEDIT.exe application to view it yourself. Just go to start and type in 'regedit' and press enter. You will need administrator rights to view it. Be careful with it as certain keys are very important to the system and you can actually make your system unusable if you start changing values.

You can also access it from command line by using the REG command. ex, to view the key's in Environment, you type in:

REG QUERY HKCU\Environment

Where are they located? look at this: http://lmgtfy.com/?q=where+is+HKLM+located

-WallShadow <3