Go Windows system registry knowledge completely revealed

Source: http://www.jb51.net/article/3328.htm

The Windows Registry is a set of data files that help Windows control hardware, software, user environments, and Windows interfaces. The registry is included in the Windows directory for two files System.dat and User.dat, as well as their backup system.da0 and user.da0. The registry database can be accessed through the Regedit.exe program under the Windows directory. Previously, in earlier versions of Windows (before Win95), these features were implemented by Win.ini,system.ini and other. ini files associated with the application.

In the Windows operating system family, the System.ini and Win.ini two files contain all the control functions and application information for the operating system, System.ini manage computer hardware and Win.ini manage desktops and applications. All drivers, fonts, settings, and parameters are saved in the. ini file, and any new programs are recorded in the. ini file. These records are referenced in the program code. Because of the Win.ini and System.ini file size limitations, Programmers add Auxiliary. ini files to control more applications. Microsoft Excel, for example, has an office Excel.ini file that contains options, settings, default parameters, and other information that is relevant to Excel's functioning. In System.ini and Win.ini, only the path and file name of the Excel.ini need to be noted.

In the era of DOS and win3.x, most applications used INI files (initialization files) to save some configuration information, such as setting paths, environment variables, and so on. System.ini and Win.ini control the characteristics and access methods of all windows and applications, and it works well in a small number of users and in a few application environments. As your application grows in number and complexity, you need to add more parameter entries to the. ini file.

So down, in a changing environment, everyone changes the. ini file after the application is installed in the system. However, no one has deleted the relevant settings in the. ini file after deleting the application, so the two files of System.ini and Win.ini are getting bigger and larger. Each additional content can cause system performance to become slower. And every time an application is upgraded, there is a challenge: The upgrade adds more parameter items but never removes the old settings. And there is one obvious problem, the maximum size of an. ini file is 64KB. To solve this problem, the software vendors themselves start supporting their own. ini files, and then point to specific INI files such as Win.ini and System.ini files. This way down multiple. ini files affect the system's normal access level settings. If an application's. ini file and Win.ini File settings conflict, who is the priority?

The registry was originally designed as a reference file for an application's data files, and finally expanded to include everything under all the features for 32-bit operating systems and applications. The registry is a set of files that control the appearance of the operating system and how it responds to external events. These "events" range from direct access to a hardware device to how the interface responds to specific users to how the application runs, and so on. Registry because its purpose and nature become very complex, it is designed to work specifically for 32-bit applications, the size of the file is limited to about 40MB. The use of a powerful registry database to centrally manage the system hardware facilities, software configuration and other information, so as to facilitate the management, enhance the stability of the system. One of the most intuitive examples is why different users under Windows can have their own personalization settings, such as different wallpaper, different desktops. This is done through the registry.

Thus, the registry (Registry) is the core "database" of the windows9x/me/nt/2000 operating system, hardware devices, and client applications to run and save settings; it's a huge tree-layered database. It records the user-installed software on the machine and the interrelated relationship of each program, it contains the hardware configuration of the computer, including the automatic configuration of plug-and-play devices and the existing various device descriptions, status attributes, and various status information and data.

　 I. What does the registry do?

The registry is a data file designed for all 32-bit hardware/drivers and 32-bit applications in Windows NT and WINDOWS95. 16-bit drivers do not work under Windows NT, so all devices are controlled through the registry, which is typically controlled by the BIOS. Under Win9x, the 16-bit drivers continue to work in real-mode devices, which are controlled using System.ini. 16-bit applications will work under NT or Win9x, and their programs will still refer to Win.ini and System.ini files for information and control.

Without the registry, the operating system does not obtain the necessary information to run and control the attached devices and applications and to respond correctly to the user's input.

The registry in the system is a database that records the settings and locations of 32-bit drivers. When the operating system requires access to a hardware device, it uses a driver and even the device is a BIOS-supported device. Devices that do not have BIOS support must be driver-independent from the operating system, but the operating system needs to know where to find them, file names, version numbers, other settings and information, and no registry device records, and they cannot be used.

When a user is ready to run an application, the registry provides application information to the operating system so that the application can be found, the location of the correct data file is specified, and other settings can be used.

The registry saves location information about the default data and auxiliary files, menus, button bars, window states, and other optional options. It also stores the installation information (such as the date), the user who installs the software, the software version number and the date, the serial number, and so on. Depending on the installation software, the information it includes is different.

However, in general, the registry controls all 32-bit applications and drivers, and the control method is based on the user and the computer, and does not depend on the application or driver, and each registry parameter entry controls the functionality of a user or computer. User features may include desktop skins and user directories. Therefore, computer functions and installed hardware and software are relevant, so the user is the public.

Some program features affect users, some of them are used for computers rather than for individuals, and, similarly, drivers may be user-specified, but in many cases they are common in computers.

　　 second, the structure of the registration table and the relationship between

The Windows Registry has six key keys, equivalent to a hard disk being partitioned into six partitions.

You can run Registry Editor by entering Regedit in the Run dialog box, and then clicking the OK button.

The data organization structure of the Registry registry (System.dat, User.dat, Config.pol) in the Chinese version of Windows 98.

The registry has a total of six root keys. These root keys are capitalized and prefixed with HKEY_, which is based on the symbolic variable of the keyword of the registry function of the Win32 API.

Although in the registry, six root keys appear to be in a side-by-side position, with no relation to each other. But in fact, the information stored in HKEY_CLASSES_ROOT and Hkey_current_config is part of the information stored in HKEY_LOCAL_MACHINE, and the information stored in HKEY_CURRENT_USER is only HKEY_ Part of the information that users store.

HKEY_LOCAL_MACHINE includes all the information in HKEY_CLASSES_ROOT and HKEY_CURRENT_USER. After each system boot, the system maps the information in the HKEY_CURRENT_USER, allowing the user to view and edit the information in it.

In fact, HKEY_LOCAL_MACHINE\Software\Classes is HKEY_CLASSES_ROOT, for users to easily view and edit, the system is specifically used as a root key. Similarly, hkey_current_config\sy-stem\current control is hkey_local_machine\system\current control.

The user information for the default user and the currently logged on user is saved in HKEY_USERS. The user information for the currently logged on user is saved in HKEY_CURRENT_USER.

Hkey_dyn_data saves Dynamic Data when the system is running, which reflects the current state of the system and is not the same every time it is run, even on the same machine.

According to the above analysis, the information in the registry can be divided into HKEY_LOCAL_MACHINE and HKEY_USERS two categories, these two categories of details please see the following introduction.

　　 three or six effects of large root keys

In the registry, all data is organized in a tree structure with keys and sub-keys, much like a directory structure. Each key contains a specific set of information, and the key names for each key are related to the information it contains. If the key contains a subkey, the left side of the folder that represents the key in the Registry Editor window will have a "+" sign to indicate that there is more content in the folder. If the folder is opened by the user, then this "+" will become "-".

1.hkey_users

This root key holds a list of user identities and passwords that are stored in the local computer's password list. The pre-configuration information for each user is stored in the HKEY_USERS root key. HKEY_USERS is one of the root keys that are accessed in a remote computer.

2.hkey_current_user

The root key contains the current logged-on user information that resides in the local workstation, including the user's logged in user name and the staged password (note: This password is hidden when it is entered). When the user logs on to Windows 98 o'clock, the information is copied from the corresponding item in the HKEY_USERS to HKEY_CURRENT_USER.

3.hkey_current_config

This root key holds the data that defines the current user's desktop configuration (such as the display, etc.), the last document list (MRU), and other information about the installation of the current user's English version of Windows 98.

4.hkey_classes_root

Depending on the extension of the application installed in the English version of Windows 98, the root key indicates the name of its file type.

When you first install the Chinese version of Windows 98, the RTF (Rich Text Format) file is associated with WordPad (WordPad) &127;, but word is automatically activated when you double-click an RTF file after you install Chinese Word 6.0 in a later time. The HKEY_CLASSES_ROOT, which is stored in SYSTEM.DAT, replaces the setting item in the [extensions]&127; section of the Win.ini file, which links the application to the file name extension and replaces Windows 3. A similar setting in the Reg.dat file in X.

5.hkey_local_machine

The root key holds the local computer hardware data, which is included in the SYSTEM.DAT to provide the information required by the HKEY_LOCAL_MACHINE, or in a set of keys that can be accessed on the remote computer.

Many of the subkeys in the root key are similar to those set in the System.ini file.

6.hkey_dyn_data

This root key holds the system's Dynamic Data at run time, and this data is changed each time it is displayed, so the information under this root key is not placed in the registry.

　　 Iv. Important contents of the registration form

The registry is a large database registry. To analyze the database in detail, not one or two pages can be introduced. I have spent more than half a year analyzing this database structure. Here are just a few important things to do.

A Hkey_class_root

1.hkey_class_root/paint.pricture/defaulticon Double-click the default string on the right side of the window, delete the original "key value" in the Open dialog box, and enter% 1. After restarting, open the Windows directory in "My Computer", select "Big icon", and then you see the BMP file icon is no longer a mspaint icon, but the outline of each BMP file (if not installed acdsee and so on to see the picture software).

Two HKey_Current_User

The new string value name menushowdelay=0 in 1.hkey_current_user\control Panel\Desktop increases the pop-up speed of the submenu in the Start menu.

2. Create a new string value name MinAnimate in HKEY_CURRENT_USER\Control Panel\deskt-op\windowsmeterics with a value of 1 to start the animation effect Switch window with a value of 0 to cancel the animation effect.

(c) HKEY_LOCAL_MACHINE

1.hkey_local_machine\software\microsoft\windows\currentversion\explorer\user Shell Folders Save the path to your personal folders and favorites.

2.hkey_local_machine\system\currentcontrol-set\control\keyboard Layouts saves the language used by the keyboard and various Chinese input methods.

3.hkey_local_machine\software\microsoft\windows\currentversion\uninstall Save the installed Windows application uninstall information.

4.hkey_local_machine\system\currentcontrol-set\services\class Save Control Panel-Add Hardware device-device type directory.

5.hkey_local_machine\system\current-controlset\control\update set the refresh mode. A value of 00 is set to automatic refresh, and 01 is set to Manual refresh [press F5 in Explorer].

6.hkey_local_machine\software\microsoft\win-dows\currentversion\run saves the name of the program that is run when the computer is set by the Control Panel and its icon appears to the right of the task bar. The icon is also on the right side of the task bar when the Startup folder program runs.

7.hkey_local_machine\software\microsoft\windows\currentversion\policies\ratings Save IE4.0 The password set in the Security \ Rating review in the Chinese version ( Data encryption), if you forget the password, delete the data in the ratings to solve the problem.

8.hkey_local_machine\software\microsoft\windows\currentversion\explorer\desktop\namespace Save special icons in your desktop, such as Recycle Bin, inbox, MS network and so on.

(d) HKEY_USERS

1.hkey_users\. Default\software\microsoft\internet explorer\typeurls saves the URL address list information entered in the IE4.0 browser address bar. Clearing the document menu will be emptied.

2.hkey_users\. Default\so. \mi. \wi. \current-version\ex. \menuorder\startmenu preserves program menu sorting information.

3.hkey_users\. Default\so. \microsoft\windows\current-version\explorer\runmru Save the Program list information that runs in Start \ Run .... Clearing the document menu will be emptied.

4.hkey_users\. Default\so. \microsoft\windows\current-version\explorer\recentdocs save a shortcut to the most recently used 15 documents (remove the problem of duplicate document name) and clear the document menu.

5.hkey_users\.default\software\microsoft\windows\currentversion\applets Save the record data for the Windows application.

6.hkey_users\.default\software\microsoft\windows\currentversion\run saves the name of the program that is run by the user when the computer is started and its icon appears to the right of the task bar.

　 v. Terminology relating to the registry:

①, registry: is a tree-layered database. Physically, it is System.dat and User.dat two files; Logically, it is the configuration data that the user sees in the Registry Editor.

②, HKEY: "Root Key" or "primary key", its icon is somewhat similar to the icon of a folder in Explorer. Windows98 divides the registry into six parts and is called hkey_name, which means a handle to a key.

③, Key (key): It contains the attached folder and one or more values.

④, subkey (subkey): The key (sub-key) that appears under a key (parent key).

⑤, Branch (branch): Represents a specific subkey and everything it contains. A branch can start at the top of each registry, but is typically used to describe a key and all of its contents.

⑥, Value entry (Value entry): An ordered value with a name and a value. Each key can contain any number of value entries. Each value entry consists of three parts: name, data type, data.

★ Name: Any combination of characters, numbers, symbols, and spaces that do not include backslashes. You cannot have the same name in the same key.

★ Data type: including string, binary, double word three kinds.

String (REG_SZ): As the name implies, a string of ASCII characters. such as "Hello World", is a string of words or phrases. In the registry, string values are typically used to represent the description of a file, the identity of the hardware, and so on. Usually it consists of letters and numbers. The registry always displays strings within quotation marks.

Binary (REG_BINARY): such as F03D990000BC, is a binary value with no length limit, and in Registry Editor, binary data is displayed in 16 binary mode.

Double Word (REG_DWORD): Literal understanding should be double word, DWORD value. Consisting of 1-8 hexadecimal data, we can edit it in 16 decimal or binary mode. such as D1234567.

★ Data: Value Item's specific value, it can occupy to 64KB.

⑦, Default (default): Each key includes at least one value entry, which is called the default value (default), which is always a string.

Go Windows system registry knowledge completely revealed