|< Windows User Accounts & Groups Programming 4 | Main | Windows Registry Tutorial 2 >| Site Index | Download |

---

 

 

 

 

MODULE O

WINDOWS OS

.:: REGISTRY:  STORY & PROGRAM EXAMPLES ::.

PART 1

 

 

 

 

What are in this Module?

1. Introduction

2. Structure of the Registry

3. Registry Storage Space

4. Windows Server 2003 and Windows XP

5. Windows 2000 and Windows NT

6. Predefined Keys

7. Registry Hives

8. Categories of Data

9. Opening, Creating, and Closing Keys

10. Writing and Deleting Registry Data

11. Retrieving Data from the Registry

12. Registry Files

13. Registry Key Security and Access Rights

 

 

 

 

 

 

 

 

 

My Training Period: xx hours. Before you begin, read some instruction here. Program examples compiled using Visual C++ .Net (Visual studio .Net 2003) except whenever mentioned.

 

The expected skills: Able to understand Windows Registry. Able to understand and use functions to manipulate Windows Registry. Able to gather and understand the required information in order to use those functions. Introduction   The registry is a system-defined database in which applications and system components store and retrieve configuration data.  The data stored in the registry varies according to the version of Microsoft® Windows®.  Applications use the registry API to retrieve, modify, or delete registry data.  You should not edit registry data that does not belong to your application unless it is absolutely necessary.  If there is an error in the registry, your system may not function properly.  If this happens, you can restore the registry to the state it was in when you last started the computer successfully.   Structure of the Registry   The registry stores data in a tree format. Each node in the tree is called a key.  Each key can contain both subkeys and data entries called values.  Sometimes, the presence of a key is all the data that an application requires; other times, an application opens a key and uses the values associated with the key.  A key can have any number of values, and the values can be in any form.  Each key has a name consisting of one or more printable characters.  Key names cannot include a backslash (\), but any other printable or unprintable character can be used.  The name of each subkey is unique with respect to the key that is immediately above it in the hierarchy.  Key names are not localized into other languages, although values may be.  The following figure is an example registry key structure as displayed by the Registry Editor (regedit.exe).     Figure 1: Registry Editor.

 

Each of the trees under My Computer is a key.  The HKEY_LOCAL_MACHINE key has the following subkeys: HARDWARE, SAM, SECURITY, SOFTWARE, and SYSTEM.  Each value consists of a value name and its associated data, if any.  MaxObjectNumber and VgaCompatible are values under the DEVICEMAP\VIDEO subkey that contain data.

 

Registry Storage Space

 

Although there are few technical limits to the type and size of data an application can store in the registry, certain practical guidelines exist to promote system efficiency.  An application should store configuration and initialization data in the registry, and store other kinds of data elsewhere. Generally, data consisting of more than one or two kilobytes (KB) should be stored as a file and referred to by using a key in the registry rather than being stored as a value.  Instead of duplicating large pieces of data in the registry, an application should save the data as a file and refer to the file.  Executable binary code should never be stored in the registry. A value entry uses much less registry space than a key.  To save space, an application should group similar data together as a structure and store the structure as a value rather than storing each of the structure members as a separate key.  Storing the data in binary form allows an application to store data in one value that would otherwise be made up of several incompatible types.

 

Windows Server 2003 and Windows XP

 

Views of the registry files are mapped in the computer cache address space.  Therefore, regardless of the size of the registry data, it is not charged more than 4 megabytes (MB).  There are no longer any explicit limits on the total amount of space that may be consumed by hives in paged pool memory, and in disk space.  The size of the system hive is limited only by physical memory.

 

Windows 2000 and Windows NT

 

Registry data is stored in the paged pool, an area of physical memory used for system data that can be written to disk when not in use.  The RegistrySizeLimit value establishes the maximum amount of paged pool that can be consumed by registry data from all applications.  This value is located in the following registry key:

 

HKEY_LOCAL_MACHINE

     System

          CurrentControlSet

               Control

 

By default, the registry size limit is 25 percent of the paged pool.  The default size of the paged pool is 32 MB, so this is 8 MB.  The system ensures that the minimum value of RegistrySizeLimit is 4 MB and the maximum is approximately 80 percent of the PagedPoolSize value.  If the value of this entry is greater than 80 percent of the size of the paged pool, the system sets the maximum size of the registry to 80 percent of the size of the paged pool.  This prevents the registry from consuming space needed by processes. Note that setting this value does not allocate space in the paged pool, nor does it assure that the space will be available if needed.  The paged pool size is determined by the PagedPoolSize value in the following registry key:

 

HKEY_LOCAL_MACHINE

     System

          CurrentControlSet

               Control

                    SessionManager

                         MemoryManagement

1. Windows 2000:  The maximum paged pool is approximately 300,470 MB so the registry size limit is 240-376 MB.  However, if the /3GB switch is used, the maximum paged pool size is 192 MB, so the registry can be a maximum of 153.6 MB.

2. Windows NT 4.0:  The maximum paged pool size is 192 MB, so the registry size limit is 153.6 MB.

3. Windows NT 3.51 and earlier:  The maximum paged pool is 128 MB, so the registry size limit is 102 MB.

 

Predefined Keys

 

An application must open a key before it can add data to the registry.  To open a key, an application must supply a handle to another key in the registry that is already open.  The system defines predefined keys that are always open.  Predefined keys help an application navigate in the registry and make it possible to develop tools that allow a system administrator to manipulate categories of data.  Applications that add data to the registry should always work within the framework of predefined keys, so administrative tools can find and use the new data.

An application can use handles to these keys as entry points to the registry.  These handles are valid for all implementations of the registry, although the use of the handles may vary from platform to platform.  In addition, other predefined handles have been defined for specific platforms.  The following are handles to the predefined keys.

 

 

The RegOverridePredefKey() function enables you to map a predefined registry key to a specified key in the registry.  For instance, a software installation program could remap a predefined key before installing a DLL component.  This enables the installation program to easily examine the information that the DLL's installation procedure writes to the predefined key.

 

 

Figure 2: HKEY_CLASSES_ROOT registry key.

 

 

Figure 3: HKEY_CURRENT_USER registry key.

 

 

Figure 4: HKEY_LOCAL_MACHINE registry key.

 

 

Figure 5: HKEY_USERS registry key.

 

Figure 6: HKEY_CURRENT_CONFIG registry key.

Registry Hives

 

A hive is a group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data.  The setup phase of the Windows boot process automatically retrieves data from these supporting files.  You can also retrieve data manually using the Import Registry File menu item of the Registry Editor (Regedit.exe).  When you shut down Windows, the operating system automatically writes the hive data to the supporting files.  You can also back up the hive data manually using the Export Registry File menu item of the Registry Editor.

The supporting files for all hives except HKEY_CURRENT_USER are in the %SystemRoot%\System32\Config directory; the supporting files for HKEY_CURRENT_USER are in the %SystemRoot%\Documents and Settings\Username directory and for Windows NT it is in %SystemRoot%\Profiles\Username directory.  The file name extensions of the files in these directories, and in some cases a lack of an extension, indicate the type of data they contain.  The following table lists these extensions along with a description of the data in the file.

 

 

Figure 7: The C:\Documents and Settings\Johnny directory, user supporting files.

 

 

Figure 8: C:\WINDOWS\system32\config directory, supporting files for all hives.

 

 

The following table lists the standard hives and their supporting files.

 

 

Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile.  This is called the user profile hive.  A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers.  User profile hives are located under the HKEY_USERS key.  The supporting file for the user profile hive for a particular user is located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\ CurrentVersion\ProfileList\SID\ProfileImagePath, and is named Ntuser.dat.  The value of ProfileImagePath is a binary representation of the directory name of the user's profile, which includes the user's name.  Use the Registry Editor to display this binary value as a string.

 

 

Figure 9: User (Johnny) profile hives under ProfileList key.

 

 

Figure 10: Ntuser.dat, the supporting file for the user (Johnny) profile hive.

 

Categories of Data

 

Before putting data into the registry, an application should divide the data into two categories:

 

1. Computer-specific data and

2. User-specific data.

 

By making this distinction, an application can support multiple users, and yet locate user-specific data over a network and use that data in different locations, allowing location-independent user profile data.  A user profile is a set of configuration data saved for every user.  When the application is installed, it should record the computer-specific data under the HKEY_LOCAL_MACHINE key.  In particular, it should create keys for the company name, product name, and version number, as shown in the following example:

 

HKEY_LOCAL_MACHINE\Software\MyCompany\MyProduct\1.0

 

If the application supports COM, it should record that data under HKEY_LOCAL_MACHINE\Software\Classes.   An application should record user-specific data under the HKEY_CURRENT_USER key, as shown in the following example:

 

HKEY_CURRENT_USER\Software\MyCompany\MyProduct\1.0

 

Opening, Creating, and Closing Keys

 

Before an application can add data to the registry, it must create or open a key.  To create or open a key, an application always refers to the key as a subkey of a currently open key.  The following predefined keys are always open:

 

1. HKEY_LOCAL_MACHINE.

2. HKEY_CLASSES_ROOT.

3. HKEY_USERS and

4. HKEY_CURRENT_USER.

 

An application uses the RegOpenKeyEx() function to open a key and the RegCreateKeyEx() function to create a key.

An application can use the RegCloseKey() function to close a key and write the data it contains into the registry.  RegCloseKey() does not necessarily write the data to the registry before returning; it can take as much as several seconds for the cache to be flushed to the hard disk.  If an application must explicitly write registry data to the hard disk, it can use the RegFlushKey() function.  RegFlushKey(), however, uses many system resources and should be called only when absolutely necessary.

 

Writing and Deleting Registry Data

 

An application can use the RegSetValueEx() function to associate a value and its data with a key.  To delete a value from a key, an application can use the RegDeleteValue() function.  To delete a key, it can use the RegDeleteKey() function.  A deleted key is not removed until the last handle to it has been closed.  Subkeys and values cannot be created under a deleted key.  It is not possible to lock a registry key during a write operation to synchronize access to the data.  However, you can control access to a registry key using security attributes.

 

Retrieving Data from the Registry

 

To retrieve data from the registry, an application typically enumerates the subkeys of a key until it finds a particular one and then retrieves data from the value or values associated with it.  An application can call the RegEnumKeyEx() function to enumerate the subkeys of a given key. To retrieve detailed data about a particular subkey, an application can call the RegQueryInfoKey() function.  The RegGetKeySecurity() function retrieves a copy of the security descriptor protecting a key. An application can use the RegEnumValue() function to enumerate the values for a given key, and RegQueryValueEx() function to retrieve a particular value for a key.  An application typically calls RegEnumValue() to determine the value names and then RegQueryValueEx() to retrieve the data for the names.

The RegQueryMultipleValues() function retrieves the type and data for a list of value names associated with an open registry key.  This function is useful for dynamic key providers because it assures consistency of data by retrieving multiple values in an atomic operation. Because other applications can change the data in a registry value between the time your application can read a value and use it, you may need to ensure your application has the latest data.  You can use the RegNotifyChangeKeyValue() function to notify the calling thread when there are changes to the attributes or contents of a registry key, or if the key is deleted.  The function signals an event object to notify the caller.  If the thread that calls RegNotifyChangeKeyValue() exits, the event is signaled and the monitoring of the registry key is stopped. You can control or specify what changes should be reported through the use of a notify filter or flag.  Usually, changes are reported by signaling an event that you specify to the function.  Note that the RegNotifyChangeKeyValue() function does not work with remote handles.

 

Registry Files

 

Applications can save part of the registry in a file and then load the contents of the file back into the registry.  A registry file is useful when a large amount of data is being manipulated, when many entries are being made in the registry, or when the data is transitory and must be loaded and then unloaded again.  Applications that back up and restore parts of the registry are likely to use registry files.  To save a key and its subkeys and values to a registry file, an application can call the RegSaveKey() function. RegSaveKey() creates the file with the following information, depending upon which operating system it is running on.

 

 

To write the registry file back to the registry, an application can use the RegLoadKey(), RegReplaceKey(), or RegRestoreKey() function.  RegLoadKey() loads registry data from a specified file into a specified subkey under HKEY_USERS or HKEY_LOCAL_MACHINE on the calling application's computer or on a remote computer.  The function creates the specified subkey if it does not already exist.  After calling this function, an application can use the RegUnLoadKey() function to restore the registry to its previous state. RegReplaceKey() replaces a key and all its subkeys and values in the registry with the data contained in a specified file.  The new data takes effect the next time the system is started.

RegRestoreKey() loads registry data from a specified file into a specified key on the calling application's computer or on a remote computer.  This function replaces the subkeys and values below the specified key with the subkeys and values that follow the top-level key in the file. The RegConnectRegistry() function establishes a connection to a predefined registry handle on another computer.  An application uses this function primarily to access information from a remote registry on other machines in a network environment, which you can also do by using the Registry Editor.  You might want to access a remote registry to back up a registry or regulate network access to it.  Note that you must have appropriate permissions to access a remote registry using this function.

 

Registry Key Security and Access Rights

 

The Windows security model enables you to control access to registry keys.  You can specify a security descriptor for a registry key when you call the RegCreateKeyEx() or RegSetKeySecurity() function.  If you specify NULL, the key gets a default security descriptor.  The ACLs in a default security descriptor for a key are inherited from its direct parent key.  To get the security descriptor of a registry key, call the GetNamedSecurityInfo() or GetSecurityInfo() function.  The valid access rights for registry keys include the DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER standard access rights.  Registry keys do not support the SYNCHRONIZE standard access right.  The following table lists the specific access rights for registry key objects.

 

 

When you call the RegOpenKeyEx() function, the system checks the requested access rights against the key's security descriptor.  If the user does not have the correct access to the registry key, the open operation fails.  If an administrator needs access to the key, the solution is to enable the SE_TAKE_OWNERSHIP_NAME privilege and open the registry key with WRITE_OWNER access.  You can request the ACCESS_SYSTEM_SECURITY access right to a registry key if you want to read or write the key's SACL.

 

 

 

 

 

 

 

Further reading and digging:

 

1. For Multibytes, Unicode characters and Localization please refer to Locale, wide characters & Unicode (Story) and Windows users & groups programming tutorials (Implementation).

2. Structure, enum, union and typedef story can be found C/C++ struct, enum, union & typedef.

3. Notation used in MSDN is Hungarian Notation instead of CamelCase and is discussed Windows programming notations.

4. Windows data type information is in Windows data types used in Win32 programming.

5. Check the best selling C, C++ and Windows books at Amazon.com.

6. Microsoft C references, online MSDN.

7. Microsoft Visual C++, online MSDN.

8. ReactOS - Windows binary compatible OS - C/C++ source code repository, Doxygen.

9. Linux Access Control Lists (ACL) info can be found atAccess Control Lists.

|< Windows User Accounts & Groups Programming 4 | Main | Windows Registry Tutorial 2 >| Site Index | Download |

---