Puzzling Registry Size Issue

[Foxbat]

I made an attempt to retest RegCompact by grabbing the files from C:\WINDOWS\TEMP this time instead of restarting. Using the CTRL+ALT+DEL task manager to end the task would cause RegCompact to restart the system. Process Explorer was able to end the task without restarting. RegShot can only compare live registry files or hiv files saved from a previous live registry, so Regdat was used instead, which can compare individual registry files to the live registry. Comparison of the compacted registry to the original showed that RegCompact saves all pending registry modifications prior to compacting (this is a good thing, just bad for comparison purposes). Without a pristine unmodified compacted registry (even the live registry periodically updates itself), file comparison is of little value.

What is notable is the duplicate rename entry exists in WININIT.INI for the following four versions:

RegCompact.exe dated 2000-10-18

[rename]

C:\WINDOWS\SYSTEM\..\USER.DAT=C:\WINDOWS\TEMP\RC6356.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RC6355.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RC6355.TMP

RegCompact.exe dated 2000-10-28

[rename]

C:\WINDOWS\SYSTEM\..\USER.DAT=C:\WINDOWS\TEMP\RCA2A4.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCA2A3.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCA2A3.TMP

RegCompact.exe dated 2000-11-18

[rename]

C:\WINDOWS\SYSTEM\..\USER.DAT=C:\WINDOWS\TEMP\RCA0B2.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCA0B1.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCA0B1.TMP

RegCompact.exe dated 2001-05-28

[rename]

C:\WINDOWS\SYSTEM\..\USER.DAT=C:\WINDOWS\TEMP\RCF354.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCF353.TMP

C:\WINDOWS\SYSTEM\..\SYSTEM.DAT=C:\WINDOWS\TEMP\RCF353.TMP

This bug (if it is a bug) has not been fixed in these versions.

EDIT: I was only able to test the four versions which have links available. The other two were not tested.

Edited September 9, 2012 by Foxbat

[jds]

Hi Charlotte,

Yep, you've hit the nail on the head, as they say. Your description of the creation problem is exactly where I'm stuck.

Your description about protected mode 'regedit' gave me an idea :

If, when you first install a system, and have the bare essentials and drivers working, save the 'system.dat' and 'user.dat' files away as a "minimal" registry. Later, when you need to rebuild, export everything with the protected mode 'regedit', then swap the 'system.dat' and 'user.dat' files with the "minimal" set. Reboot, then import all that you exported earlier using the protected mode 'regedit'. Should work, I think.

??? I think I kind of "implied" that in my post about REG.EXE??? I SPECIFICALLY remember creating a Boot Floppy with it for that exact purpose...

Perhaps "Safe Mode" with REGEDIT.EXE -OR- "Safe Mode->Command Prompt"/BootFloppy with REG.EXE (same-o same-o)...

Seriously... what am I missing here?

Sorry if I've overlooked your posting, however, what you've missed is that I'm not a mind reader. I'm sure you may know what you were implying, but I couldn't see it. Seriously.

Somewhere (can't remember) I vaguely recollect using REG.EXE (from the Win98 Resource Kit) against the DAT files to "compress". There was some "method" to the madness... something about "creating" a new DAT file from the "exported" REG files? I could have SWORN I had used the method before...

(and I could be TOTALLY wrong, so don't be too harsh)

If you could elaborate some, like the role of a boot diskette perhaps, or how 'reg' can work where (command line) 'regedit' fails, that may be helpful here.

Joe.

Edited September 9, 2012 by jds

[Multibooter]

At that point I already had located 4 different compiles of RegCompact v1.0. And after today, there are now 6

Hi CharlotteTheHarlot,

1) I checked the 6th file RegCompact.exe (at the bottom of your list, with MD5 fa3f9649f5f5f74b7036a48bcf205d42) with MiTeC EXE Explorer, it has a time stamp of 1-Dec-2000 9:33:06AM, very similar to the file modification date indicated for the 5th file. The time stamp by MiTeC EXE Explorer is more helpful than the file modification date for categorizing the various versions of RegCompact.exe. MiTeC EXE Explorer displays for file #6 in the Strings tab several error messages which were localized into Italian. I would speculate that file #6 is only a modification with a hex editor of file #5, not a new compilation.

2) The Readme.txt files accompanying the file #3 (modif.date 28-Oct-2000) and file #4 (modif.date 18-Nov-2000) have 2 main differences, possibly helpful for identifying version differences:

a ) added to Readme.txt of file #4:

"Command Line Arguments

======= ==== =========

If you execute RegCompact with the /NOGUI command line argument it will automatically

compact the registry hives and reboot the system with no user interaction."

b ) removed from Readme.txt of file #4:

"Installation

============

Run the RegCompact1.0.exe installation program inside the zip archive you downloaded. It will install the program to the location you select. Please note no uninstall feature is included, as all you need to do is delete RegCompact's program folder to uninstall it."

3) I have come across a 7th version on the mule, it has MD5 3D5DF950B2DCAE3B886C4FC625A4F512, also 73728 bytes, file modification date October 04, 2001, 3:52:02 AM, and a time stamp with MiTeC of 17-Oct-2000 2:39:29 PM, i.e. the identical time stamp of your file #2. This 7th version is a derivative of the file #2, with some error messages patched with non-Western characters. The accompanying .txt file is also in non-Western characters, perhaps Russian.

4) Which version to use?

I have no idea what the impact would be of running under US Windows 9x a program patched for a different Windows localization/codepage, and would stay away from the Italian/Russian? localized versions. This would leave file #4 (modif.date 2000-11-18) as best version, as long as no download location can be found for file #5 (modif.date 2000-12-01).

RegCompact v1.0 looks like an interesting program, but I haven't tried it out yet, I am waiting for more reports about the experience other users had with it.

[CharlotteTheHarlot]

RegCompact v1.0 looks like an interesting program, but I haven't tried it out yet, I am waiting for more reports about the experience other users had with it.

Thanks for the info! And yes, I believe you are right about that Italian localized being patched, not recompiled.

I'm working up info for a new thread so we don't totally 'jack this one. If everyone wants to hold off a bit ( a day or two ) there will be a better place for this all info.

I have tested these 6 on Win9x thoroughly ( as did Foxbat above ) and will aggregate the info there. As far as which to use, I can detect no functional difference using the GUI.

P.S. Can you put version #7 somewhere and PM me a link? - Thanks.

[Foxbat]

4) Which version to use?

I have no idea what the impact would be of running under US Windows 9x a program patched for a different Windows localization/codepage, and would stay away from the Italian/Russian? localized versions.

I did not encounter any problems when I tested the Italian version under US Win98SE. The localization only effects the UI text, although I think one should use a localized version only if it is in their native tongue.

EDIT: My apologies, I did not see CharlotteTheHarlot's post #139 until my post went through.

Edited September 11, 2012 by Foxbat

[jds]

As for RegExport, alas, I've seen a few other utilities with this capability, which as I've stated above, can be done quite satisfactorily with 'regedit'. Now, if he'd written an import utility, I'd consider that a "must have".

Joe.

You can't export reg files from a backed up registry dat file with regedit AFAIK.

RegExport is a great free tool and unique in its features. Besides letting you see differences between the live registry in ram with dat files or exporting from dat backups to selectively restore something you can use it to check out if you you've got a rootkit in the startup keys (run, runonce, etc...) for example.

I am not aware of an other tool that lets you do that besides its big brother RegDat and I am nearly 100% sure that no other free tool lets you do any of that so it's definitively a must have IMO.

Hi loblo,

Regarding 9X 'regedit', it can work with backed-up DAT files as follows :

REGEDIT [/L:system] [/R:user] /E filename3 [regpath1]

where :

/L:system Specifies the location of the SYSTEM.DAT file.

/R:user Specifies the location of the USER.DAT file.

/E filename3 Specifies the file to export the registry to.

regpath1 Specifies the starting registry key to export from. (Defaults to exporting the entire registry).

Now regarding RegExport, if it does have those extra features, then I'll change my mind and agree it's a "must have". I've just downloaded it from http://home.arcor.de/h.ulbrich/regexp.zip (another download I had found was truncated, useless).

Also (maybe having better capabilities than regedit) good ol' resplendence Reglite:

http://web.archive.org/web/20051004081859/http://www.resplendence.com/reglite

http://web.archive.org/web/20051004082353/http://www.resplendence.com/downloads

jaclaz

More toys.Thanks jaclaz!

If we drift into discussing alternatives to regedit I can only praise and recommend the awesome Regmagik

with its jump to CLSID, jump to path in explorer and export of registry shortcuts, not to mention its excellent search tool, etc...

Now shareware but the last free version (3.26.4), which is the one I use, can be found easily.

Sounds very useful, thanks for the tip loblo!

I don't think it is "drifting" is more like trying to provide some alternatives that may (or completely fail to) be functional in solving the problem.

However, let's call this Off TOpic

http://web.archive.org/web/20100906235707/http://lilith.tec-man.com/hivetools/

New home:

http://www.filewut.com/spages/page.php/software/hivetools

jaclaz

Another useful looking tip, jaclaz, and (IMHO) definitely not off-topic.

At that point I already had located 4 different compiles of RegCompact v1.0. And after today, there are now 6

Hi CharlotteTheHarlot,

1) I checked the 6th file RegCompact.exe (at the bottom of your list, with MD5 fa3f9649f5f5f74b7036a48bcf205d42) with MiTeC EXE Explorer, it has a time stamp of 1-Dec-2000 9:33:06AM, very similar to the file modification date indicated for the 5th file. The time stamp by MiTeC EXE Explorer is more helpful than the file modification date for categorizing the various versions of RegCompact.exe. MiTeC EXE Explorer displays for file #6 in the Strings tab several error messages which were localized into Italian. I would speculate that file #6 is only a modification with a hex editor of file #5, not a new compilation.

You beat me to it, Multibooter!

I checked similarly and entirely agree about your conclusion. It should be possible to use a tool like the venerable BDIFF 1.01 by Morten Grouleff to get a patch that can recover the missing 2000-12-1 edition.

Anyway, I tried the Italian-patched version with the following results :

SYSTEM.DAT 12,943,672 -> 12,902,432

USER.DAT 1,830,944 -> 1,720,352

I was surprised that after some years of installing and uninstalling stuff, I had so little empty space to collapse! Looks like I'll have to do surgery if I want to reduce that registry size.

The patched program worked just fine, so there should be no fears about code pages differences or whatnot. The only thing I had to take care of, is that, like almost all registry tools I've tried, they assume that 'system.dat' and 'user.dat' both live in the %windir% directory. However, if you install W9X on a drive other than C:, you end up with 'system.dat' on C: drive (in the %winbootdir% directory) and 'user.dat' on the main W9X drive (in the %windir% directory).

Joe.

[Multibooter]

3) I have come across a 7th version on the mule, it has MD5 3D5DF950B2DCAE3B886C4FC625A4F512...This 7th version is a derivative of the file #2, with some error messages patched with non-Western characters.

I have checked files #2,3,4,6 and 7 with dencorso's VRFYPE of 24-Jun-2012 (old version) All files have the same header checksum 00000000, so in the case of RegCompact.exe VRFYPE (old version) cannot be used to identify a PE file as patched

@dencorso:

Your new version of VRFYPE of 26-Jul-2012 with the switch /0 or /z displays only "No files found!" for files #2,3,4,6 and 7. If you find the time to fiddle around with VRFYPE, could you increment the version number?

Edited September 11, 2012 by Multibooter

[loblo]

Hi loblo,

Regarding 9X 'regedit', it can work with backed-up DAT files as follows :

REGEDIT [/L:system] [/R:user] /E filename3 [regpath1]

where :

/L:system Specifies the location of the SYSTEM.DAT file.

/R:user Specifies the location of the USER.DAT file.

/E filename3 Specifies the file to export the registry to.

regpath1 Specifies the starting registry key to export from. (Defaults to exporting the entire registry).

Ah, I didn't know that, thanks!

[dencorso]

@dencorso:

Your new version of VRFYPE of 26-Jul-2012 with the switch /0 or /z displays only "No files found!" for files #2,3,4,6 and 7. If you find the time to fiddle around with VRFYPE, could you increment the version number?

Please give me links to those files, so that I'll be able to see what's happening, and then I'll gladly do it.

BTW, does it find the files with /g or /a? /a should give sort of the same output as the older version...

[Multibooter]

Hi dencorso,

Sorry for the mix up. I had copied VRFYPE (27Jul2012) to the folder containing the various files RegCompact_x.exe, and then ran VRFYPE without a file parameter <filespec>, like "*.*":

> vryfype

or >vrfype /a

This resulted in no files being listed, the same for running

> vrfype *.*

without indicating an option parameter </option>

When running VRFYPE with both parameters entered, everything was Ok:

vrfype *.* /a

Maybe in the next version of of VRFYPE you could use "/a" as default parameter if no </option> parameter was entered, and "*.*" if no <filespec> parameter was entered. BTW the parameter "/s" [for checking all sub-folders] is still on my wish list down the line, even if there is a workaround, as you suggested in , but adding such a /s switch looks like a major undertaking. VRFYPE is an excellent program, with many potential uses.

Here the screen output by VRFYPE (27Jul2012), sent to a text file vrfype.txt, when entering in a Win98SE DOS window:

>vrfype *.* /a >vrfype.txt

VrfyPE v1.0 Freeware by dencorso, 2012

.\RegCompact_2.exe => Cheksums: Header = 00000000 Real = 000132DC Zero in header!

.\RegCompact_3.exe => Cheksums: Header = 00000000 Real = 000162F4 Zero in header!

.\RegCompact_4.exe => Cheksums: Header = 00000000 Real = 0001BCD9 Zero in header!

.\RegCompact_unpacked_6.exe => Cheksums: Header = 00000000 Real = 0001887F Zero in header!

.\RegCompact_7.exe => Cheksums: Header = 00000000 Real = 00014227 Zero in header!

.\VRFYPE.EXE => Cheksums: Header = 0000431C Real = 0000431C

BTW, when ">vrfype *.* /a >vrfype.txt" is run in a WinXP command prompt window, an identical .txt file is generated, except that the last line has the file extension in small letters:

.\VRFYPE.exe => Cheksums: Header = 0000431C Real = 0000431C