MDGx
 Comprehensive Windows Registry Guide
+
200+ Ways To Hack Your Windows
9x/NT4/2000/ME/XP/2003 Registry

I will post here ALL New Registry Hacks [in chronological order] every time I'll also add them to REGISTRY.TXT, TIPSXP.TXT, TIPSME.TXT, TIPS2000.TXT, TIPS98.TXT, TIPSNT4.TXT, OSR2TIPS.TXT or AOLTIPS.TXT, all part of my Updated Windows 9x/NT4/2000/ME/XP/2003 + DOS 7.xx/8.00 ©Tricks + Secrets Files [W95-11D.EXE], FREEware.

1. Comprehensive Windows Registry Guide

The Registry

DEFINITION: The Windows 95/98/NT/2000/ME/XP/2003/Vista/2008/7 Registry (also called Registration Database) is a complex, unified, system wide, continually referenced during operation database, used for centrally storing, locating, editing and administering system, hardware, software and user configuration information, following a hierarchical structure.
Its role is to replace the text/ASCII based MS-DOS configuration (.BAT, .SYS) and Windows initialization (.INI) files, used by the old MS-DOS 3/4/5/6.xx, Windows 3.xx and Windows for WorkGroups 3.1x (REG.DAT) releases.
Most data from the MS-DOS startup configuration files: AUTOEXEC.BAT and CONFIG.SYS, and from the Windows system initialization files: CONTROL.INI, SYSTEM.INI, WIN.INI, PROTOCOL.INI, NETWORK.INI etc, is now contained into the Registry, together with most of the other system settings. Most Win32 [32-bit (x86)] and Win64 [64-bit (x64)] specific applications store their initialization and configuration data into the Registry instead of into .INI, .CFG etc files. The MS-DOS and .INI files are kept only for backward compatibility with older MS-DOS and Win16 (16-bit) based programs.
The Registry is stored in binary data format (.DAT), and the information it contains can be accessed (read from/written to) at any time during operation by any Registry aware Windows programs, as needed.

More info:

The Windows 95/98/ME Registration Database is contained in these 5 files, with the Hidden, Read-only attributes for write-protection purposes, usually located in the %WinDir% folder (default is C:\Windows) in stand-alone single-user environments:

This other file is specific only to Windows 95/98/ME and resides usually on the central (host) server in multi-user environments/networks or in %WinDir% on stand-alone multi-user machines:

In Windows 95 retail, 95a OSR1, 95B OSR 2.0, 95B OSR 2.1 and 95C OSR 2.5 the HKEY_LOCAL_MACHINE and HKEY_USERS Registry Hive keys can be backed up manually by using the Configuration Backup tool (Cfgback.exe) found on the Windows Setup CD-ROM in the \Other\Misc\Cfgback subfolder, and also part of Microsoft Windows 95 CD-ROM Extras:
Get CFGBACK.EXE [46 KB, free, unsupported].
On computers with more than one user only HKEY_LOCAL_MACHINE is backed up.
More info.
CfgBack can create up to 9 different compressed Registry backup copies with the .RBK extension. Registry BacKup files (.RBK) must reside in %WinDir%, and can be used exclusively by CfgBack to restore an older set of working Registry Hive keys.
See "REGISTRY BACKUP + RESTORE" to learn how to backup/restore your entire Registry safely.
MSKB: Confirmed CfgBack BUGs:

In Windows 98, 98 SE(U) and ME working Registry files (.DAT) are backed up automatically upon loading Windows by the Scan Registry tool (%WinDir%\Scanregw.exe) into compressed Cabinet files (.CAB = Microsoft proprietary compression technology based on LZX compression algorithm) found in the %WinDir%\Sysbckup subfolder (default), and holding 5 (default), up to a maximum of 99 different backup copies, a new one being created upon the first successful GUI boot of each new day (the oldest is replaced with the newest). They are named from: RB000.CAB, RB001.CAB, ... up to RB099.CAB. Check their date/time stamp to determine the newest backup set.
Windows 98/ME automatic Registry backup is enabled by this command:

C:\Windows\Scanregw.exe /autorun

found as a String Value called "ScanRegistry" under this Registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

See "SCANREGW, SCANREG + SCANREG.INI" for more details.

The Windows NT/2000/XP/2003 Registration Database is contained in these 6 files located in the %SystemRoot%\System32\Config folder (default is C:\Winnt\System32\Config for Windows NT or C:\Windows\System32\Config for Windows 2000/XP/2003):

these 2 files located in the %SystemRoot%\Profiles\%UserName% and/or %SystemRoot%\Documents and Settings\%UserName% folder(s):

and their automatically created backups from the last known good booting process (successful startup):

This other file is specific only to Windows NT4/2000/XP/2003 and resides usually on the central (host) server in multi-user environments/networks or in %SystemRoot%\Inf on stand-alone multi-user machines:

In Windows NT 4.0, 2000, XP and 2003 the Registry Hive keys can be backed up or restored manually by using the command line Registry Console tool (Reg.exe) located in %SystemRoot%\System32, also part of Microsoft Windows NT4/2000/XP/2003 Resource Kits (RK).
More info.
REG Command in Windows XP.
REG.EXE.
Elder Geek: Backing Up and Restoring Windows XP Registry.
Windows Registry Backup, Restore + Tweaking tools [free(ware)]: see "FREE Windows 9x/NT/2000/ME/XP/2003/Vista/2008/7 System + Registry Fixers", also in SOFTWARE.TXT [part of W95-11D.EXE].
MSKB: How to Backup, Edit and Restore the Registry in:

Back 2 Contents

Registry Structure

The Registry consists of 2 basic components (elements):

  1. (Sub)Key: storage container (folder, directory, tree, heading, node). They organize the Registry data in a consistent and hierarchical format. Keys can contain subkeys and/or values. Each (sub)key name is predefined by the system or created by users or Win32/64 (32-bit/64-bit) programs, and consists of most printable ANSI (alphanumeric) characters: 32 - 127, except: asterisk (*), backslash (\), space ( ), question mark (?), non-localized (other than latin alphabet) characters. Key names starting with a period (.) are reserved.
    A (sub)key is defined by its complete pathway starting at the root level (main key = Hive Key = HKEY).
    NOTE: These examples of Registry (Sub)Keys and Values follow the .REG file rules (more on this subject further below).

    • HKEY_KEY_NAME = Root Handle/Hive/Main/Parent Key. The Windows 95/98/ME Registry consists of 6 Root Keys under the "My Computer" heading (see further below). Hive Keys can contain one or more Child (Sub)Key(s) (see below).
      Example:
      [HKEY_LOCAL_MACHINE]

    • HKEY_KEY_NAME\SubKeyName = Child (Sub)Key. They are nested underneath each other (like branches) following a single or multiple level tree structure (like folders).
      Example:
      [HKEY_LOCAL_MACHINE\Software]

  2. Value: stores actual Registry data created/modified/used by the system, users and Registry aware Win32/64 [32-bit (x86)/64-bit (x64)] applications to control hardware, software and user settings. Values (like files) are stored inside (sub)keys (like folders):

      "ValueName"=ValueType(API Code #):ValueData

    Value Type defines Value Data, displayed in multiple alphanumeric formats.

    This is how they appear in the Registry Editor:

    RegEdit

    LEGEND:
    Left hand panel:
    		 (1) Main Heading [Tree]
     (2) Hive [Root] Key
     (3) Sub [Child] Key    		  
    Right hand panel:
    		 (4) Value Name
     (5) Value Data
     (6) Value Type

    More details:

    RegEdit32

    • There are 4 basic (simple) Registry Value types, 3 of them (except REG_QWORD) valid for all Windows 95, 98, ME, NT, 2000, XP, 2003, Vista, 2008 + 7 releases, and available in both RegEdit and RegEdt32:

      • REG_DWORD [DWORD Value: API code 4] = Double WORD numerical data of 4 bytes (32 bits) in length, in 3 numeric formats: decimal (base of 10), hexadecimal (base of 16) or binary (base of 2).
        This applies to all 32-bit Windows OSes.
        Example:
        [HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem]
        "ContigFileAllocSize"=dword:00000800
        There are 2 REG_DWORD Registry Value subtypes:
        • REG_DWORD_LITTLE_ENDIAN [DWORD Value: API code 4] = Windows/DOS OSes are designed to operate on Little Endian computer architecture ("normal order"): a multi-byte value is stored from the rightmost lowest byte ("little end", "low order") to the leftmost highest byte ("big end", "high order"). Example: the value 0x12345678 is stored as 0x78 0x56 0x34 0x12.
        • REG_DWORD_BIG_ENDIAN [DWORD Value: API code 5] = UNIX/Linux/BSD (*nix) OSes are designed to operate on Big Endian computer architecture ("reversed order"): a multi-byte value is stored from the leftmost highest byte ("big end", "high order") to the rightmost lowest byte ("little end", "low order"). Example: the value 0x12345678 is stored as 0x12 0x34 0x56 0x78.

      • REG_QWORD [QWORD Value: API code 11] = Quadruple WORD numerical data of 4 bytes (64 bits) in length, in 3 numeric formats: decimal (base of 10), hexadecimal (base of 16) or binary (base of 2).
        This applies only to 32-bit Windows 2000/XP/2003/Vista/2008/7 (NTx = NT based) OSes (x86) and to all 64-bit Windows OSes (x64).
        There is only 1 REG_QWORD Registry Value subtype:
        REG_QWORD_LITTLE_ENDIAN [QWORD Value: API code 11].

      • REG_BINARY [Binary Value: API code 3] = 8-bit or 16-bit data of any length, in 2 numeric formats: binary (base of 2) or hexadecimal (base of 16).
        Example:
        [HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem]
        "Win31FileSystem"=hex:00

      • REG_SZ [String Value: API code 1] = Data of any length, in 3 ANSI or Unicode formats: simple text/ASCII (fixed string), expanded (%string% variable string) or extended (multi-string) null terminated string -> see below for 2nd and 3rd String Value types.
        Example:
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
        "Version"="Windows ME"

    • There are several complex (multiple) Registry Value types (contain multiple or a list of data types of any length separated and terminated by null characters), valid only for Windows NT4, 2000, XP, 2003, Vista, 2008 + 7, and available only in RegEdt32:

      • REG_EXPAND_SZ [Expanded String Value: API code 2] = in system variable (%string%) format, stores environment variables within strings, accessed by substituting variables with actual system path names.

      • REG_LINK [Link String Value: API code 6] = symbolic link in Unicode format between system or software data.

      • REG_MULTI_SZ [Multiple String Value: API code 7] = in extended multi-string format, stores an array of empty-string terminated multiple strings into a single Registry entry terminated by an empty-string and a null character.

      • REG_RESOURCE_LIST [Resource List Value: API code 8] = device driver and hardware component list of hardware resources stored under the HKEY_LOCAL_MACHINE\HARDWARE\ResourceMap tree.

      • REG_FULL_RESOURCE_DESCRIPTOR [Resource Descriptor Value: API code 9] = device driver and hardware component description of nested arrays of hardware resources stored under the HKEY_LOCAL_MACHINE\HARDWARE\Description tree.

      • REG_RESOURCE_REQUIREMENTS_LIST [Resource Requirements List Value: API code 10] = device driver and hardware component list of hardware resource requirements stored under the HKEY_LOCAL_MACHINE\HARDWARE\ResourceMap tree.

This is the complete list of supported 32-bit Windows (Win32) OS (x86) Registry Value types:

Value TypeAPI Code #Value Description
REG_ERROR-1Error request value
REG_NONE0Undefined binary value type
REG_SZ1Null terminated Unicode fixed string value
REG_EXPAND_SZ2Null terminated unexpanded Unicode/ANSI environment string value
REG_BINARY3Binary value of any form/length
REG_DWORD432-bit numerical value
REG_DWORD_LITTLE_ENDIAN432-bit numerical value
REG_DWORD_BIG_ENDIAN532-bit reversed numerical value
REG_LINK6Symbolic Unicode link string value
REG_MULTI_SZ7Array of multiple Unicode strings separated by empty strings and ended by null character
REG_RESOURCE_LIST8Device driver list of hardware resources in Resource Map tree
REG_FULL_RESOURCE_DESCRIPTOR9List of hardware resources in Description tree
REG_RESOURCE_REQUIREMENTS_LIST10Device driver list of hardware resource requirements in Resource Map tree
REG_QWORD1164-bit numerical value

Unfortunately most Registry elements have fixed limits:

Registry ElementMAX Allowed Length/Size
(Sub)Key Name255 characters
Value Name [Win2000/XP/2003]255 ANSI or 16,383 Unicode characters
Value Name [Win95/98/ME]255 characters
Value Data [Win2000/XP/2003]Limited by available RAM
Value Data [Win95/98/ME]16,383 Bytes [16 KB]
All Values within same (Sub)Key
[Win2000/XP/2003]		Limited by available RAM
All Values within same (Sub)Key
[Win95/98/ME]		65,535 Bytes [64 KB]

Values larger than 2,048 Bytes [2 KB] should be stored as separate files, and their file names stated in the Registry, for optimal efficiency.
More info @ MSDN.
Even more info.
Do NOT confuse this with the "RegistrySizeLimit" (RSL) Registry DWORD [REG_DWORD] Value used to configure paged database memory pools in Windows NT4/2000, and subsequently removed from Windows XP/2003/newer.
More info @ MS TechNet.

When you run the Registry Editor (see further below), you'll see the following expandable Registry subtrees, each marked with a plus [+] sign, under the "My Computer" heading (main tree).
To further expand each subtree and view all underlying branches (subkeys), click on the plus [+] signs of the 6 main Hive Keys (HKEY) below.
(Sub)key/(sub)tree/(sub)heading are used here as synonyms.
This layout is a typical example of Windows 95/98/ME Registry:

[+] My Computer
 |
 |--[+] HKEY_CLASSES_ROOT (HKCR): Software settings, DDE, OLE,
 |      drag-and-drop, Win31 backward compatibility, shortcut
 |      settings and subkeys for every defined file association,
 |      also found at HKEY_LOCAL_MACHINE\Software\Classes .
 |
 |--[+] HKEY_CURRENT_USER (HKCU): Currently logged on user
 |   |  configuration settings, also found at HKEY_USERS\Username .
 |   |  Subkeys:
 |   |
 |   |--[+] AppEvents: Assigned system and applications sound events
 |   |      settings.
 |   |
 |   |--[+] Control Panel: Control Panel settings, similar to those
 |   |      defined in SYSTEM.INI, WIN.INI and CONTROL.INI in
 |   |      Windows/WfWG 3.xx.
 |   |
 |   |--[+] Identitites: Created and used by MS Outlook Express 4/5/6
 |   |      and its Address Book. [Thank you Ojatex!]
 |   |
 |   |--[+] InstallLocationsMRU (Most Recently Used): Installation and
 |   |      Startup folders paths.
 |   |
 |   |--[+] Keyboard: Current keyboard layout.
 |   |
 |   |--[+] Network: Network connection settings.
 |   |
 |   |--[+] RemoteAccess: Current logon location settings if using
 |   |      Dial-Up Networking (DUN).
 |   |
 |   *--[+] Software: Software configuration settings for the currently
 |          logged on user, sorted by developer/manufacturer/vendor.
 |
 |--[+] HKEY_LOCAL_MACHINE (HKLM): User independent hardware and
 |   |  software machine specific information: bus type, device drivers,
 |   |  keyboard layout etc. Subkeys:
 |   |
 |   |--[+] Config: System and software configuration.
 |   |
 |   |--[+] Drivers: Used by the Device Manager to keep track of active
 |   |      loaded drivers for hardware peripherals: PnP devices, PC
 |   |      cards, PCMCIA etc. [Thank you Ojatex!]
 |   |
 |   |--[+] Enum: Hardware devices information and settings.
 |   |
 |   |--[+] Hardware: Serial communication port(s) information and
 |   |      settings.
 |   |
 |   |--[+] Network: Information and settings about network(s) the user
 |   |      is currently logged on to.
 |   |
 |   |--[+] Security: Network security information and settings.
 |   |
 |   |--[+] Software: Software specific information and settings sorted
 |   |      by developer/manufacturer/vendor, each stored under its own,
 |   |      separate Subkey.
 |   |
 |   *--[+] System: System startup, device drivers and operating system
 |          information and settings.
 |
 |--[+] HKEY_USERS (HKU): Information about Desktop and user specific
 |      settings for each user who logs on to the same Windows 95/98/ME
 |      system. Each user has a separate subkey here. If there is only
 |      one user, the only subkey is .Default .
 |
 |--[+] HKEY_CURRENT_CONFIG (HKCC): Information about current hardware
 |      profile used by the local computer at startup, pointing to
 |      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current .
 |
 *--[+] HKEY_DYN_DATA (HKDD): Virtual key (exists only in memory)
     |  created every time Windows 95/98/ME initializes: dynamic
     |  configuration data about installed PnP devices. Changes constantly
     |  when hardware devices are added, swapped or removed on-the-fly.
     |
     |--[+] Config Manager: Hardware problem codes and status.
     |
     *--[+] PerfStats: System and network performance statistics.

These 6 Hive Keys (HK) are interrelated: the information contained in HKEY_LOCAL_MACHINE (HKLM) and HKEY_USERS (HKU) (the only 2 "real" keys) appears also in 3 other Hive Keys (also called "alias" keys):

Real Hive KeyAlias Hive Key
HKLM\Software\Classes + HKCU\Software\ClassesHKEY_CLASSES_ROOT (HKCR)
HKU\Username [HKU\.Default if only 1 user]HKEY_CURRENT_USER (HKCU)
HKLM\Config\ProfileHKEY_CURRENT_CONFIG (HKCC)

The 3 "alias" keys are the Registry equivalent of Windows shortcuts ("pointers"), and their contents derives from the 4 "real" Hive Keys. Any data written to the "real" keys is also automatically registered ("cloned") into the correspondent "alias" keys, but not the other way around. Exception makes HKCU, which can "clone" HKU\Username [HKU\.Default if only 1 user] subkeys + values and vice versa.
Any data contained in HKEY_CURRENT_USER (HKCU) overrides any data contained in HKEY_LOCAL_MACHINE (HKLM), therefore any change in HKEY_CLASSES_ROOT (HKCR) is always "cloned" into HKEY_CURRENT_USER (HKCU).
Exception makes HKEY_DYN_DATA (HKDD) ("virtual" key) [Windows 95/98/ME only], which is automatically created during every Windows initialization phase, exists only in the computer's memory, and is automatically erased upon system shutdown.

Back 2 Contents

REG Files

Windows 95/98/ME/NT/2000/XP/2003/Vista/2008/7 use dedicated files in different (mostly plain text/ASCII, but also Unicode) formats: .HTA (HyperText Application), .INF (INFormation), .REG (REGistration), .VBS (Visual Basic Script) etc, to import (insert, merge) and export (save) information into and from the Registry.
Exception: Windows 2000 can import ONLY binary (Unicode) .REG files.
Their purpose is to add, modify or delete Registry (Sub)Keys and/or Values.
See "DELETE REGISTRY KEY/VALUE" to learn how to delete Registry (Sub)Keys and Values in Windows 95B/95C OSR 2.x, 98, 98 SP1, 98 SE(U), ME, 2000, XP, 2003, Vista, 2008 and 7.
More info @ MSKB.
This can be achieved by running them directly from the Start -> Run... box, Windows Explorer (%windir%\Explorer.exe), File Manager (FM = %windir%\WINFILE.EXE) or native/real/true/pure MS-DOS prompt in Windows 95/98/ME (using %winbootdir%\REGEDIT.EXE command line switches = see further below).
This is possible because in all Windows 32-bit/64-bit (Win32/64) OSes REG files are associated by default with the Registry Editor (RegEdit.exe/RegEdt32.exe) executable, which resides in the main Windows directory/folder (%windir%), listed on the system path.

We will discuss here the most well known and easy to create/modify/use, the "all mighty" .REG file, which can be in:Text .REG files can be easily viewed/created/edited by hand using any text/ASCII editor, like Notepad [%windir%\Notepad.exe, included with all Windows releases, but primitive, and limited to a maximum file size of only 64 KB :(], or any other 3rd party text editor [see "FREE Windows 9x/NT/2000/ME/XP/2003/Vista/2008/7 Text Editors" for better Notepad replacement tools], eventually by cutting & pasting Registry specific text strings from other sources, like a fragment of, or entire Registry, saved as plain text .REG file by using a Registry Editor.
See "REGISTRY BACKUP + RESTORE" to learn how to backup/restore your entire Windows 95/98/ME Registry safely by exporting/importing .REG files.
Note that Regedit always saves REG files in plain text/ASCII format in Windows 95/98/ME, but in Windows 2000/XP/2003/Vista/2008/7 they are always exported (default) in binary (Unicode) format, unless the user selects a different (text/ASCII) file format from the Export Registry File menu, like the "Win9x/NT4 Registration Files (*.reg)" format, available to both Regedit and Regedt32 in Windows 2000, XP, 2003, Vista, 2008 and 7.

Registration (.REG) file structure:

  1. Header line: this FIRST line is mandatory. MUST contain only these exact words (case sensitive = character capitalization required!):
    • REGEDIT4 = (RegEdit v4.0) Windows 95/98/ME + NT 4.0 or
    • Windows Registry Editor Version 5.00 = (RegEdit v5.0) Windows 2000/XP/2003/Vista/2008/7.
    This is the only way 32-bit/64-bit Windows OSes can recognize/validate, run/merge and import/export .REG files.
    Windows 2000/XP/2003/Vista/2008/7 also support the REGEDIT4 header line, but only for plain text/ASCII encoded Registry values, not for some complex binary/Unicode encoded Registry values.
    Limitation:
    RegEdit v4.0 ("REGEDIT4" header) .REG files (Windows 95, 98, ME + NT 4.0) support only comma separated, null terminated single byte character hex values: REG_EXPAND_SZ [hex(2)] + REG_MULTI_SZ [hex(7)], therefore they do not support non-ASCII (non-Latin, non-ISO-8859) code pages/characters/languages.
    RegEdit v5.0 ("Windows Registry Editor Version 5.00" header) .REG files (Windows 2000, XP, 2003, Vista, 2008 + 7) support comma separated, null terminated double byte character hex values (see above), therefore they do support all non-ASCII (non-Latin, non-ISO-8859) code pages/characters/languages.
    Example:
    RegEdit v4.0 .REG file representation of a REG_MULTI_SZ Value:

    -----Begin cut & paste here-----
    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Multi_String]
    "Multi String Value"=hex(7):48,65,6c,6c,6f,21,00,00

    ------End cut & paste here------

    RegEdit v5.0 .REG file representation of same REG_MULTI_SZ Value above in Unicode format:

    -----Begin cut & paste here-----
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Multi_String]
    "Multi String Value"=hex(7):48,00,65,00,6c,00,6c,00,6f,00,21,00,00,00,00,00

    ------End cut & paste here------

    In v5.0 each character of the word "Hello!" is expressed as a double byte (H = 48h,00h | E = 65h,00h | etc), but in v4.0 it is expressed as a single byte (H = 48h | E = 65h | etc).

  2. Empty (blank) line: this second line is optional. Similar to inserting a carriage return (CR).

  3. Remarked (comment) line(s): optional. MUST begin with a semicolon (;) which may be followed by a space (optional). Can contain Registry (Sub)Keys and Values (which can be disabled this way) or plain text comments/reminders. Windows does NOT process (ignores) remarked lines, treating them as comments. May be inserted anywhere in the .REG file, but NOT before the Header, which MUST be present as FIRST line.

  4. (Sub)Key line: MUST be preceded and terminated by square parentheses ([]). (Sub)Key name MUST start with the Hive Key name (left end) and MUST contain entire Subkey pathway leading to the current Subkey name (right end). Consecutive (Sub)Key names MUST be separated by SINGLE backslash marks (\):

    [HKEY_KEY_NAME\SubKeyName0\SubKeyName1\SubKeyName2\etc...]

    Example:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]

    (Sub)Key names not present in the Registry will be automatically created when the REG file is merged into the Registry. Exception: new Hive (Root) Keys can be created ONLY in Windows NT4/2000/XP/2003/Vista/2008/7, but NOT in Windows 95/98/ME.

  5. Value line: MUST contain these elements in this EXACT order:
    • Value name: MUST be preceded and terminated by quotation marks ("").
    • Equal mark (=): MUST separate Value name from Value type.
    • Value type: MUST be specified: dword: [DWORD = REG_DWORD], hex(#): [Binary = REG_BINARY] ONLY IF Value type other than String [REG_SZ].
    • (API Code #): MUST be specified as alphanumeric hex value: from 2 [hex(2)] up to 11 [hex(b)] and MUST be preceded and terminated by round parentheses [()] ONLY IF Value type other than String [REG_SZ] (API Code 1) or DWORD [REG_DWORD] (API Code 4 or 5).
      Refer to the complete list of supported Registry Value types further above for details.
    • Colon mark (:): MUST separate Value type from Value data ONLY IF Value type other than String [REG_SZ].
    • Value data: MUST be in the same format as defined by Value type: text/ASCII, Unicode/ANSI, (alpha)numeric (decimal, hexadecimal or binary) etc. MUST be preceded and terminated by quotation marks ("") ONLY IF Value type is String [REG_SZ].
      Syntax:

      • String Value: hex(1) [REG_SZ] (API Code 1):

        "ValueName"="ValueData"

        Value Data is expressed here in Unicode or ANSI formats: simple text/ASCII, expanded or extended.

      • DWORD Value: hex(4) [REG_DWORD] (API Code 4):

        "ValueName"=ValueType:ValueData

        Value Data is expressed here in Double WORD (4 bytes = 32 bits) formats: decimal, hexadecimal or binary.

      • Simple (8-bit) or complex (16-bit) Binary (hex) Value of any length:
        • hex(1) [REG_SZ (hex notation)] (API Code 1),
        • hex(2) [REG_EXPAND_SZ] (API Code 2),
        • hex(3) [REG_BINARY (hex notation)] (API Code 3),
        • hex(4) [REG_DWORD (hex notation)] (API Code 4),
        • hex(5) [REG_DWORD_BIG_ENDIAN (hex notation)] (API Code 5),
        • hex(6) [REG_LINK] (API Code 6),
        • hex(7) [REG_MULTI_SZ] (API Code 7),
        • hex(8) [REG_RESOURCE_LIST] (API Code 8),
        • hex(9) [REG_FULL_RESOURCE_DESCRIPTOR] (API Code 9),
        • hex(a) [REG_RESOURCE_REQUIREMENTS_LIST] (API Code 10) or
        • hex(b) [REG_QWORD (64-bit Value)] (API Code 11):

        "ValueName"=ValueType(API Code #):ValueData

        Large Value Data Strings can span onto more than one line, in which case each line (except the last one) is terminated by a comma (,) followed by a SINGLE backslash mark (\) and consecutive lines are separated by carriage returns (CR):

        "ValueName"=ValueType(API Code #):ValueData,ValueData,\
        ValueData,ValueData

        Value Data is expressed here in numeric: binary or hexadecimal, or multi-string (complex) formats: binary, hexadecimal, Unicode or ANSI.
        Consecutive bit pairs (double digits) of data MUST be separated by a comma (,).

      Separators and delimiters used in REG files on path name lines to separate drive letters, directory (folder) names and file names, or used on command line parameters lines etc... MUST be typed as DOUBLE backslash marks (\\).
      Here the first backslash (treated by the Registry as Escape character) is used to tag ("mark") the next character, the second backslash in this case. Regedit interprets in fact these two backslashes as a single one, and only the second backslash is processed as such. The first one is ignored.
      Exception: Registry (Sub)Key path names used in REG files MUST be separated by SINGLE backslash marks (\).
      When the REG file is merged into the Registry (Sub)Keys and Value names not present in the Registry will be automatically created. (Sub)Keys and Value names already present under the same Registry (sub)key(s) but containing different Value type(s) and/or data will be automatically updated to match the one(s) in the REG file.

  6. Empty (blank) line: this LAST line is mandatory for proper operation. Similar to inserting a carriage return (CR) or a line feed (LF) or an end of file (EOF) character to mark the end of file.

This is how a generic text/ASCII .REG file looks like:

-----Begin cut & paste here-----
REGEDIT4

; This is a comment line.
[HKEY_KEY_NAME\SubKeyName0\SubKeyName1\SubKeyName2\etc...]
; String Value:
"ValueName"="ValueData"
; DWORD or Binary Value:
"ValueName"=ValueType:ValueData

------End cut & paste here------

... And this is an example of actual text .REG file containing real Keys and Values:

-----Begin cut & paste here-----
REGEDIT4

; First Value below identifies MS Windows OS name:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
; String Value:
"Version"="Windows ME"
; DWORD Value:
"CacheWriteDelay"=dword:00000320
; Binary Value:
"OldWinVer"=hex:00,02

------End cut & paste here------

FYI: Cut & paste lines are not part of the .REG files, of course. ;)

Back 2 Contents

Registry Inconsistencies, Curiosities + Oddities

Thank you Sergio!
Except for the "ACP"="1251" String Value [REG_SZ] below, all these are fictional examples. Merging these REG files into your Registry will achieve nothing. ;)
"Various REG_* Value types can be expressed in REG scripts this way:

-----Begin cut & paste here-----
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\ 5]
; Name only: useful for flag values such as "AlwaysShowExt" [: required].
"0 REG_NONE"=hex(0):
; These strings are Unicode (probably UTF-16).
"1 REG_SZ"=hex(1):48,00,65,00,6c,00,6c,00,6f,00,2c,00,20,00,\
 57,00,6f,00,72,00,6c,00,64,00,21,00,00
"2 REG_EXPAND_SZ"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
 46,00,69,00,6c,00,65,00,73,00,25,00,00,00
"3 REG_BINARY"=hex(3):46,72,65,65,20,66,6f,72,6d,20,62,69,6e,61,72,79
"4 REG_DWORD_LITTLE_ENDIAN"=hex(4):12,34,56,78
"5 REG_DWORD_BIG_ENDIAN"=hex(5):12,34,56,78
"7 REG_MULTI_SZ"=hex(7):4c,00,69,00,6e,00,65,00,20,00,31,00,00,00,\
 4c,00,69,00,6e,00,65,00,20,00,32,00,00,00,\
 4c,00,69,00,6e,00,65,00,20,00,33,00,00,00,\
 4c,00,69,00,6e,00,65,00,20,00,34,00,00,00,\
 00,00
; Windows XP RegEdit silently imports this registry value type, but does not
; recognize nor display it properly. Probably Windows XP 64-bit edition does.
"b REG_QWORD_LITTLE_ENDIAN"=hex(11):12,34,56,78,9a,bc,de,f0
; So it does with this weird line.
"f REG_REDMOND_ONE_MICROSOFT_WAY"=hex(15):aa,bb,cc,dd,ee,ff

------End cut & paste here------

Some inconsistencies exist between string representation in different versions of REG scripts (5.0 and 4), as following example shows:

-----Begin cut & paste here-----
REGEDIT4
[HKEY_CURRENT_USER\ 4]
; Only this string is Unicode for REGEDIT4 script, the rest are ANSI.
; Probably RegEdit handles REG_SZ differently, even in this form.
"1 REG_SZ"=hex(1):48,00,65,00,6c,00,6c,00,6f,00,2c,00,20,00,\
 57,00,6f,00,72,00,6c,00,64,00,21,00,00,00
"2 REG_EXPAND_SZ"=hex(2):25,50,72,6f,67,72,61,6d,\
 46,69,6c,65,73,25,00
"7 REG_MULTI_SZ"=hex(7):4c,69,6e,65,20,31,00,\
 4c,69,6e,65,20,32,00,\
 4c,69,6e,65,20,33,00,\
 4c,69,6e,65,20,34,00,\
 00

------End cut & paste here------

Windows 95/98/ME RegEdit will expect:

"1 REG_SZ"=hex(1):48,65,6c,6c,6f,2c,20,57,6f,72,6c,64,21,00

Windows XP RegEdit exports REGEDIT4 scripts as text files encoded in current ANSI codepage (example):

-----Begin cut & paste here-----
REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodePage]
"ACP"="1251"

------End cut & paste here------

so localized value names and data should comply with it. But nothing will stop you from creating REGEDIT4 scripts as Unicode (as far as I know, only low-endian UTF-16 encoded text files with byte order mark FF FE are recognized) or Windows Registry Editor Version 5.00 scripts as ANSI encoded text files.

Windows 98 SE RegEdit (the DOS part of dual REGEDIT.EXE) imports REG_SZ value data verbatim, no translation done, so to be compatible, REGEDIT4 scripts should be properly encoded.

It appears that RegEdit simply parses scripts ignoring white space for value name (quoted string before equal sign), value type and value data [in generic form hex(#):b1,b2,b3... with #==3 if omitted together with both parentheses, or specific "string" for hex(1), dword:12345678 for hex(4)], then submit them along with data size to RegSetValueEx() Win32 API function, which in turn simply posts it to the Registry. You can make a value of type REG_NONE with arbitrary data, confuse RegEdit with non-four-byte REG_DWORD, explore and exploit buffer overflows with null-unterminated REG*_SZ values etc. ;-)"

This comes directly from the "horse's mouth" (formerly independent developer Sysinternals was "acquired" by Microsoft) and demonstrates what can be done with the Registry using NT Native API... RegHide any1?

Back 2 Contents

Registry Editing Rules

To modify the Registry, you need to use a Registry Editor:

Microsoft Windows 95/98/NT4/2000/ME/XP/2003 Registry Editor is a tool used to display, search, modify, create, delete, save, import and export Windows Registry (Sub)Keys and Values.

Windows NT4/2000 RegEdit.exe versus RegEdt32.exe side by side comparison:

REGEDIT.EXEREGEDT32.EXE
16-bit Windows + DOS executable32-bit Windows only executable
Single window displaySeparate Hive Key window display
Key and Value level SearchKey level Search only
Handles only simple Value types [see above]Handles also complex Value types [see above]
Only Read and Write modeOptional Read Only mode
No Security modeOptional Permissions Security mode
No Security controlFull Security control
[Win2000/XP/2003 only]
Text REG files export and importText REG files export only
No binary REG files export or importBinary REG files export and import
Creates/renames/deletes only SubkeysCreates/renames/deletes also Hive Keys
Opens at last accessed (Sub)Key level
[WinME/XP/2003 only]		Opens at Root level only

Windows 95/98/ME do not include nor support RegEdt32.exe.
In Windows XP/2003 RegEdt32.exe is just a "stub" that actually starts RegEdit.exe.
More info @ MSKB.

You can use either RegEdit's (Windows 95/98/ME/NT/2000/XP/2003) or RegEdt32's (Windows NT/2000) interface (see above) in protected mode Windows environment from within Windows GUI, or REGEDIT's DOS based (Windows 95/98/ME) command line parameters in native/real/true/pure mode MS-DOS from outside Windows.
To learn how to use the REGEDIT.EXE available DOS mode switches, run:


C:\>REGEDIT

Imports and exports registry files to and from the registry.

REGEDIT [/L:system] [/R:user] filename1
REGEDIT [/L:system] [/R:user] /C filename2
REGEDIT [/L:system] [/R:user] /E filename3 [regpath1]
REGEDIT [/L:system] [/R:user] /D regpath2

/L:system     Specifies the location of the SYSTEM.DAT file.
/R:user       Specifies the location of the USER.DAT file.
filename1     Specifies the file(s) to import into the registry.
/C filename2  Specifies the file to create the registry from.
/E filename3  Specifies the file to export the registry to.
regpath1      Specifies the starting registry key to export from.
              (Defaults to exporting the entire registry).
/D regpath2   Specifies the registry key to delete. Win98/ME ONLY!
/S            UNDOCUMENTED [USE WITH CAUTION!]: executes all
              REGEDIT command line operations quietly, without
              ANY confirmation. Available ONLY in Windows GUI
              mode!
              See "UNATTENDED REGISTRATION" for details.

from native MS-DOS.
More info @ MSKB.

RegEdit is NOT installed as a Start Menu shortcut!
To create a RegEdit shortcut: right-click on an empty raised Taskbar spot -> select Properties -> click Start Menu Programs tab -> click the Add button -> browse to your main Windows folder -> (double)-click on Regedit.exe -> click the Next button -> (double)-click: Start Menu -> Programs -> Accessories -> System Tools -> click the Next button -> in the Select name for the shortcut box type Registry Editor -> click the Finish button.

If you are NOT familiar/comfortable "messing" with your Registry, do NOT attempt to make ANY changes!
But let's presume you ARE familiar enough with your Registry's "innards", and would like to tweak it for MAXimum performance, stability, security etc. After all this is *THE* purpose of this "dissertation". :) So keep reading...

If you don't like to modify your Registry directly, there is an "easier" [:-)] alternative: use one of these "FREE WINDOWS 9x/NT/2000/ME/XP/2003/Vista/2008/7 SYSTEM + REGISTRY TWEAKERS". My favorite is X-Setup Pro 6.6 (freeware for personal use), the BEST Windows 9x/NT/2000/ME/XP/2003 Registry "hacker", capable of tweaking 1600+ Registry, System, Software, User, Network etc settings.

Or better, "hack" the Registry yourself... like I do. ;-)

In the following Registry Hacks, the subkeys/pathways in the Registry Editor left hand pane point to a specific Subkey or Value located in the Registry right hand pane, with complete explanations of what they do, and how/why you may want to modify/rename/delete them and/or add new ones to customize/speed-up/fix your Windows computer.

WARNING: FIRST BACKUP ALL YOUR HARD DRIVES TO A SAFE LOCATION BEFORE ATTEMPTING TO MAKE ANY SYSTEM CHANGES!
*READ* "REGISTRY BACKUP + RESTORE" for DETAILS!
Take EXTREME CAUTION when modifying your System/Startup settings! Faulty changes may result in crashes/lockups/permanent data loss, or might lead to having you REINSTALL your Operating System(s)!
YOU are the ONLY one responsible for ANY changes YOU make!
ALWAYS HAVE YOUR MOST RECENT SYSTEM BACKUP READY!

NOTE: These hacks have been tried by others (and most by me), but with NO guarantee they will also work for YOU!

BEWARE: Whenever using RegEdit or RegEdt32 to MODIFY your Registry in ANY way, ALL CHANGES TAKE PLACE INSTANTLY, WITHOUT ANY CONFIRMATION!

To learn about Registry editing, run Regedit.exe (or Regedt32.exe) and click on Help.
To learn MORE about the Registry, (double)-click on the Windows 95/98 Resource Kit (RK) Help file, found on your Windows 9x Setup CD-ROM:and READ the Registry related topics!

I also recommend to check frequently the MicroSoft Knowledge Base (MSKB), for detailed info, updates, patches + bug fixes related to your Windows OS + MS applications/games.
See "MICROSOFT KNOWLEDGE BASE MADE EASY" for MSKB access details.

MicroSoft Developer Network (MSDN) and Microsoft TechNet post periodically detailed info about the Registry for the more technically inclined [read "geeks" ;)].

Back 2 Contents

Registry Credits + Links

As far as I'm aware, this is 1 of the most comprehensive Windows 95/98/NT4/2000/ME/XP/2003/IE/OE/AOL/Netscape/etc Registry Hacks, Tweaks, Secrets, Speed-Ups, Workarounds + Fixes databases on the Internet. Some of the following tips I stumbled upon while browsing the Internet, some have been kindly sent by concerned readers (all authors/contributors are acknowledged and reliable sources given proper credit), and some I discovered on my own (clearly marked) while "messing" with the Registry.
Enjoy the ride!

NOTE: Contributed tips (clearly marked) posted here do not necessarily reflect the opinion of the owner of this web site.

Please send me your comments, corrections, tips.

The Registry on the Internet:

Back 2 Contents
... Enuff said. Let's have some fun now... ;-)

2. 200+ Registry Hacks List
[new hacks added at the TOP]

Back 2 Hacks List
Back 2 Contents
©1996-2010 MDGx (AXCEL216): Everything here is FREEware. I have created [August 1996], maintain and update these web pages entirely by hand using Programmer's File Editor [replaced Notepad]. I do not promote, speak in the behalf of, advertise or work for any computing, news or internet profit business. All ®registered ©copyrights and ™trademarks referred herein retain the property of their respective owners.

Back!