Jump to content

Windows XP - Altered the registry incorrectly


Flintheart

Recommended Posts

By mistake I didn't notice that the backslash was missing:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

I added this to the registry, everything works fine, POSReady worked fine after I corrected the error. I can find no sign of it in the registry, what actually happens when you add something like this to the Windows registry? 

Edited by Flintheart
Link to comment
Share on other sites


I would imagine most registry entries with incorrect syntax would just be ignored.
If the format of the entry was completely wrong, it wouldn't even get entered.
If everything is working fine, I wouldn't worry about it.
:dubbio:

Edited by Dave-H
Addition
Link to comment
Share on other sites

On 6/29/2019 at 6:26 AM, Flintheart said:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

No, that can not work!

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\WPA\POSReady]
"Installed"=dword:00000001

:yes:

Link to comment
Share on other sites

Oww, comeon.

Here is a good question:

Can a key (actually a hive) "HKEY_LOCAL_MACHINESYSTEMWPAPosReady" be created in the root of Registry by importing a REG file?

OP:

On 6/29/2019 at 6:26 AM, Flintheart said:

I added this to the registry, everything works fine, POSReady worked fine after I corrected the error. I can find no sign of it in the registry, what actually happens when you add something like this to the Windows registry? 

Maybe the above can be rephrased as:

I ran this reg file:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMWPAPosReady]
"Installed"=dword:00000001

 it did nothing to the registry, everything works fine, POSReady worked fine after I re-ran the corrected .reg file, i.e.:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\WPA\POSReady]
"Installed"=dword:00000001

 I can find no sign of it (the original, wrong, settings) in the Registry what actually happens when you run a non-valid .reg file?

jaclaz

Link to comment
Share on other sites

3 hours ago, jaclaz said:

Oww, comeon.

Here is a good question:

Can a key (actually a hive) "HKEY_LOCAL_MACHINESYSTEMWPAPosReady" be created in the root of Registry by importing a REG file?

 

Well, we never know if there isn't some nasty bug waiting to strike :P

 

I just did a quick test with this same example. Regmon logs show a lot of regedit action, it was checking the existing user profiles and a few other places, but in the end i didn't notice anything new created.

Link to comment
Share on other sites

Yep, the idea is that only some hives (not all of them) and definitely NOT root of the Registry (which BTW doesn't really exist) are editable.

You cannot create a new hive in root because essentially root does not exist, it is only a sort of mounting point for the Registry backing files.

The Registry (as seen by Windows) is a "volatile" structure "assembled" on-the-fly from a set of Registry backing files.

The correspondence between Registry backing files and Registry  (and the way it is accessed/displayed) , just in case:

https://support.microsoft.com/en-us/help/256986/windows-registry-information-for-advanced-users

More details and a nice tool here:

http://reboot.pro/topic/20848-dumpreg/

jaclaz

Edited by jaclaz
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...