Windows XP - Altered the registry incorrectly

[Flintheart]

By mistake I didn't notice that the backslash was missing:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

I added this to the registry, everything works fine, POSReady worked fine after I corrected the error. I can find no sign of it in the registry, what actually happens when you add something like this to the Windows registry? 

Edited June 29, 2019 by Flintheart

[Dave-H]

I would imagine most registry entries with incorrect syntax would just be ignored.
If the format of the entry was completely wrong, it wouldn't even get entered.
If everything is working fine, I wouldn't worry about it.

Edited June 29, 2019 by Dave-H
Addition

[heinoganda]

On 6/29/2019 at 6:26 AM, Flintheart said:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

No, that can not work!

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\WPA\POSReady]
"Installed"=dword:00000001

[RainyShadow]

You can use this to delete the key:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINESYSTEMWPAPosReady]

 

[jaclaz]

Oww, comeon.

Here is a good question:

Can a key (actually a hive) "HKEY_LOCAL_MACHINESYSTEMWPAPosReady" be created in the root of Registry by importing a REG file?

OP:

On 6/29/2019 at 6:26 AM, Flintheart said:

I added this to the registry, everything works fine, POSReady worked fine after I corrected the error. I can find no sign of it in the registry, what actually happens when you add something like this to the Windows registry? 

Maybe the above can be rephrased as:

I ran this reg file:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

 it did nothing to the registry, everything works fine, POSReady worked fine after I re-ran the corrected .reg file, i.e.:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\WPA\POSReady]
"Installed"=dword:00000001

 I can find no sign of it (the original, wrong, settings) in the Registry what actually happens when you run a non-valid .reg file?

jaclaz

[RainyShadow]

3 hours ago, jaclaz said:

Oww, comeon.

Here is a good question:

Can a key (actually a hive) "HKEY_LOCAL_MACHINESYSTEMWPAPosReady" be created in the root of Registry by importing a REG file?

 

Well, we never know if there isn't some nasty bug waiting to strike :P

 

I just did a quick test with this same example. Regmon logs show a lot of regedit action, it was checking the existing user profiles and a few other places, but in the end i didn't notice anything new created.

[jaclaz]

Yep, the idea is that only some hives (not all of them) and definitely NOT root of the Registry (which BTW doesn't really exist) are editable.

You cannot create a new hive in root because essentially root does not exist, it is only a sort of mounting point for the Registry backing files.

The Registry (as seen by Windows) is a "volatile" structure "assembled" on-the-fly from a set of Registry backing files.

The correspondence between Registry backing files and Registry  (and the way it is accessed/displayed) , just in case:

https://support.microsoft.com/en-us/help/256986/windows-registry-information-for-advanced-users

More details and a nice tool here:

http://reboot.pro/topic/20848-dumpreg/

jaclaz

Edited July 1, 2019 by jaclaz