Now that you have an understanding of how the Registry operates, you are ready to start |-hacking it! hackers are not just those who create malicious viruses or attempt to break into systems. In fact, anyone who decides to get under the hood of any system to discover how it works, tweaks it to gain some advantage, or does it just out of curiosity to see what happens when something is changed, can be considered as a hacker. The hacker is more interested in the mechanics of the hack rather than the result. Once you get into the Registry and change things around, you may want to create your own .reg files to distribute to friends or publish it on your Web site or blog. Use this capability with caution, and be extra sure of what you are doing. A wrong entry here can potentially wreak havoc on a user's system.
The .reg file is actually a text file which will open in any ASCII editor like Notepad. It uses a specific syntax that the registry recognizes. Following the rules of this syntax you can create and publish your own registry hack.
The .reg file uses the syntax:
RegistryEditorVersion
Blank line
[RegistryPath1]
"DataItemName1"="DataType1:DataValue1"
"DataItemName2"="DataType2:DataValue2"
Blank line
[RegistryPath2]
"DataItemName3"="DataType3:DataValue3"
For Windows XP and Windows 2000, the header
RegistryEditorVersion should always read "Windows Registry Editor Version 5.00". You can also create .reg files for use on older Windows 98 and Windows NT4.0 systems.
REGEDIT4 is the version entry in the header of the .reg file for Windows 98 and NT4.0 systems.
Typical entries in a .reg file
A .reg file with the REGEDIT4 header will work both on Windows XP/2000 as well as on Windows 98/NT4.0 systems, since the Registry is backwards-compatible. However, .reg files with the header "Windows Registry Editor Version 5.00" will only work on Windows XP/2000 based systems.
Note that when creating a hack on Windows XP/2000 targeted at earlier versions of Windows, you should always test whether these hacks will work on those earlier OSes. If you are unable to test it on earlier Windows versions, release the .reg file with the header "Windows Registry Editor Version 5.00" to prevent accidental updates into the registries of those earlier Windows versions. If you are quite certain that the hack is harmless to Windows 98/NT4.0 machines, and you do want to release it to that group of users as well, then at the very least, include a disclaimer such as "Not tested on Windows 98/NT4.0; deploy at your own risk!" so that the user is sufficiently warned about what he is about to do.
The
Blank line informs the Registry of the start of a new Registry path. Every key and sub-key starts with a new Registry path and helps you identify the location of each of the entries in the registry when examining the contents of the .reg file.
RegistryPathx is the path to the location in the Registry of the particular key or sub-key whose values you will be adding, modi- Typical entries in a .reg file fying or deleting. The path has to be enclosed in square brackets, and each sub-key level is separated by a backslash. For example:
[HKEY_CURRENT_USER\Control Panel\International]. If the subkey in the path does not exist, it will be created—hence it is important that you follow the correct order in specifying the path. For example, if you erroneously create the path as
[HKEY_CURRENT_ USER\International\Control Panel], then a new key called International will be created under
HKEY_CURRENT_USER with a sub-key called Control Panel. Multiple entries in the .reg file will each start with their own paths separated by blank lines.
The
"DataItemName1"="DataType1:DataValue1" determines the specific values of the key (or sub-key). Each key can have one or more
DataItemName. This is the specified name of the data, and is enclosed in quotation marks. It is immediately followed by an equals sign. To the right of the equals sign, the data type (DWORD or hexadecimal) is specified, followed by the actual data. If the data is of the String type, then no data type is specified, and the Registry will understand that the data type is String. The data type and the data value are separated by colons, and the entire entry is enclosed in quotations. Here's an example.
[HKEY_CURRENT_USER\Control Panel\Appearance]
"Current"="Windows 2000"
"PreviewMode"=hex:04,00,00,00
"ShowNewProcesses"=dword:00000000
Here, the data name
Current has a string value:
"Windows 2000". The data name
PreviewMode has a binary value represented in hexadecimal. The data name
ShowNewProcesses has a DWORD value of
00000000.
If the data name does not exist it will be created in the sub-key specified in the path; if it exists, it will overwrite the existing value with the new values. If you want to delete entries in the Registry with a .reg file, you can use the hyphen symbol. For example,
[-HKEY_CURRENT_USER\Control Panel\Test] will delete the "Test" key in the specified path. To delete a value, put the hyphen symbol immediately after the equals sign of the data name. For example…
[HKEY_CURRENT_USER\Control Panel\Test]
"TestItem"=-
…will delete the TestItem data name in the Test sub-key of the Control Panel key in the
HKEY_CURRENT_USER hive.
To rename an entry, first delete the entry using the above procedure, then specify the new name and values in the same .reg file. Both entries have to be separated by blank lines. An example:
[-HKEY_CURRENT_USER\Software\Yahoo\Pager\
IMVironments\baseball3]
[HKEY_CURRENT_USER\Software\Yahoo\Pager\IMVironments\baseball4]
"promo"=dword:00000002
"name"="Precious Moments"
[HKEY_CURRENT_USER\Software\Yahoo\Pager\IMVironments\baseball4]
"promo"=dword:00000002
"name"=-
In this example, the sub-key
"baseball3" will get deleted first. Then, the sub-key
"baseball4" will be created with the data names
"promo" and
"name" containing a
DWORD value of
00000002, and a
String value called
"Precious Moments" respectively. Then the data name
"name" will get deleted from the sub-key
"baseball4".
It is good practice to distribute your .reg file as a zipped archive to prevent accidental insertion into the Registry. Even though the user will be prompted before adding the .reg file to the registry, using the archive method will act as double insurance against carelessness on the user's part. The user will need to unzip the .reg file and double-click on it. Then, he will be prompted to add the information in the .reg file to the Registry.
If you right click on a .reg file, the first three options will allow you to either Merge the file with the Registry (which is the same as double-clicking on it), print out the text, or edit it with your text editor—usually Notepad or WordPad.
To even make it safer still, you might want to change the default double-click action of merging the .reg file with the Registry to be changed to open it in Notepad. Look for this tweak in what follows!