For my registry tweaks, I have decided to use entries_*.ini syntax.

Some tweaks, however, refer to HKCU, so my question is what will happen with this snippet:

[registry_addreg]

...

HKCU,"foo1\foo2\foo3","bar",,"baz"

...

Update: typo fix (HKCR to HKCU)

Edited August 15, 200719 yr by andreyvul

HKCR is a symbolic link to a subroot of HKLM

HKCU edits applied before the first user logon propagate to all users.

For more explanaition and details see short notes I made some time ago: attached

Registry_structure.doc

Edited August 15, 200719 yr by BikinDutchman

Oh, so HKCU refers to HKU\.DEFAULT, which is the NTUSER.DAT of "Default User".

So basically, if I diff(unix-speak for compare)ed a fresh install before first logon, Adminstrator\NTUSER.DAT and Default User\NTUSER.DAT would be almost identical.

Thanks a lot!

andreyvul

It is not quite that simple (unfortunately). For the details really: see my attachment.

However everything that you change under the HKCU key BEFORE the first (Administrator) logon ends up in all user registry settings, so also in HKU\.Default.

HKU\.Default has the user registry settings of the SYSTEM account.

The Default User registry settings are not normally loaded. You have to do that with a load hive command.

kinda offtopic, but is HKLM\HARDWARE kinda like /proc in UNIX/Linux?

That is, can a driver use registry read/write commands to HKLM\HARDWARE\foo\bar as user<->driver interface (the UNIX/Linux equivalent being /proc/foo/bar/)?

FYI, / is a directory separator, unless it is at the beginning at the path, then it refers to the absolute root of the filesystem, like \\?\ in windows

andreyvul

I have been out of UNIX for a long time so I do not know about any registry equivalents in UNIX.

HKLM\Hardware is generated dynamically during startup. There is no file where this info is stored.

There are actually only two real registry hives: HKLM and HKU.

To clarify, /proc is a dynamically loaded virtual folder loaded by the kernel on startup, allowing usage of stdio.h read/write commands to virtual files to communicate with the kernel and its loaded drivers.

So, would HKLM\HARDWARE be like /proc, but instead of stdio.h, win32.h is used for the registry read/write commands to communicate with the drivers?

(I have no clue if driver<->user communication via HKLM\HARDWARE is covered in ntddk docs. probably is, but I'm not sure)

HKLM\Hardware is fairly simple and not related to editable files.

It contains mainly pointers to subkeys in HKLM\SYSTEM\CurrentControlSet\Control. I sometimes go there to fix problems with USB devices.

I think HKLM\SYSTEM\CurrentControlSet\Control might be more like what you are looking for. You might search for "enum" and see what shows up.

Note I am not a real expert I just collected all I needed to fix hardware and installation problems .