Thursday, January 13, 2011

Add & delete registry keys using .reg files

A .reg file has the following syntax:
-----------------------------------
RegistryEditorVersion
Blank line
[RegistryPath1]
"DataItemName1"="DataType1:DataValue1"
"DataItemName2"="DataType2:DataValue2"
Blank line
[RegistryPath2]
"DataItemName3"="DataType3:DataValue3"
-----------------------------------
Example
-----------------------------------
Windows Registry Editor Version 5.00

; Created by staraphd.

[HKEY_LOCAL_MACHINE\Software\Test]
@="Default Value"
"REG_SZ - String Value"="String Value"
"REG_BINARY - Binary Value"=hex:01,02,03,04
"REG_DWORD - DWORD Value"=dword:00000001
"REG_EXPAND_SZ - Expandable String Value"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6D,00,52,00,6F,00,6F,00,74,00,25,00,5C,00,53,00, 79,00,73,00,74,00,65,00,6D,00,33,00,32,00,00,00
"REG_MULTI_SZ - Multi-String
Value"=hex(7):4D,00,75,00,6C,00,74,00,69,00,2D,00,53,00,74,00,72,00,69,00,6E,00,67,00,20,00,56,00,61,00,6C,00,75,00,65,00,00,00

[HKEY_LOCAL_MACHINE\Software\Test]
"TestValue"=-

[-HKEY_LOCAL_MACHINE\Software\Test]
-----------------------------------
Variants
-----------------------------------
hex = hex(3)so instead of hex:01,02,03,04 you can write
hex(3):01,02,03,04
REG_SZ = hex(1) so instead of "String Value" you can write
hex(1):53,00,74,00,72,00,69,00,6E,00,67,00,20,00,56,00,61,00,6C,00,75,00,65,00,00,00
dword = hex(4) so instead of writing dword:1 you can write
hex(4):01,00,00,00

hex(0) = REG_NONE
hex(1) = REG_SZ
hex(2) = REG_EXPAND_SZ
hex(3) = REG_BINARY
hex(4) = REG_DWORD
hex(5) = REG_DWORD_BIG_ENDIAN
hex(6) = REG_LINK
hex(7) = REG_MULTI_SZ
hex(8) = REG_RESOURCE_LIST
hex(9) = REG_FULL_RESOURCE_DESCRIPTOR
hex(a) = REG_RESOURCE_REQUIREMENTS_LIST
hex(b) = QWORD
-----------------------------
@ = (Default) (Data Type = REG_SZ)
; = Comment

Ref: http://www.windowsitpro.com/article/tips/jsi-tip-8615-understanding-regedit-exe-reg-files-.aspx
Ref: http://smiljanzdero.com/creating-a-reg-file

1 comment: