Windows Registry fundamentals - Lesson 1

Hello everyone,

welcome to this lesson where we're going to explore the fundamentals of Windows Registry. The Microsoft Windows Registry has not changed for users that using a Windows 8, so that you can learn it without problems also that you use Windows 8. The registry in Windows operating systems has a very important role in our function. If we had a registry analyzer we could observe that all operations in Windows modify single or multiple key of registry. The registry has soul and heart of Windows, rember that for new future lessons. Well, after this little introduction, I'll say you that a registry have a hierarchical structure so represent in figure:

This figure represent other things and it's not really representing elements of registry, but the hierarchical structure is so it. The Windows Registry is as a big database, where data are stored. Data is such as: data settings, configuration files and so on. I recommend to new users of registry to work via Virtual Machine, why? Because if you damage with some modify the systems you can restore new Virtual Machine and new Windows XP or 7 or other, after various exercises on the Virtual Machine you can switch on real Microsoft Windows without a virtual world (also if I use for some operation use VirtualBox with Windows XP so if I do some damages I restore again and I try other ways. To set the points in this course we're going to see some topics of registry:

• Learn keys and fundamentals of registry and it's structure
• How we can backup a registry
• How we can create a .reg file
• How we can hacking the registry
• Configure security of Windows with the registry key and other security topics. 

The main registry keys are: 

• HKEY_CLASSES_ROOT (HKCR)
• HKEY_CURRENT_USER (HKCU)
• HKEY_LOCAL_MACHINE (HKLM)
• HKEY_USERS (HKU)
• HKEY_CURRENT_CONFIG (HKCC)

REGISTRY STRUCTURE:

The registry structure is similar at the filesystem of Windows. In the software called: REGEDIT there are different panes, the left pane that is a list of main registry keys and their subkeys. While the right pane has a differents things, it's divided into three sections. Those three section are:

1. Name
2. Type
3. Data

Now let's see them in detail. First of all, the part 'Name' this column identify a name of key or value. Let's start with an obvious assumption that each value has a name. This name is reported here. We pass to the part 'Type' the value in addition to having a name also has a type. This type could have many values, REG_SZ is one of this. REG_SZ indicates that the variable called X contains a string value. While we can find other value called REG_DWORD. The REG_DWORD value can contains a dword value (that is 32 bit variable). Instead the column 'Data' can is null or empty or could contain a data. The Data field can be contain only value with a maximum values of 32,767 bytes also that in practice can be contain a limit of 2 KB. This for now is all, I hope that is all clear.

Bye,

Tefnut.