JSI Tip 8615. Understanding Regedit.exe .reg files.

The Regedit.exe program is the Windows XP, Windows Server 2003, and Windows 9x Registry Editor. It is also available on Windows 2000, but for Windows 2000 the GUI is unable to edit REG_EXPAND_SZ and REG_MULTI_SZ data types.

Regedit.exe can import and export registry Keys and Value Names using a .reg file.

When you select a Key in Regedit.exe and press Export on the File menu, a dialog box opens for you to name the output file with a Save as type of Registration Files (*.reg). This generates a .reg file with a Windows Registry Editor Version 5.00 header, and any REG_EXPAND_SZ and REG_MULTI_SZ data types are represented as Unicode, double-byte, characters. You can also export a .reg file, using Windows Registry Editor Version 5.00 format, from the command line, by running regedit /e FileName "Key".

You can also use the GUI to Export a .reg file in Win9x/NT4 Registration Files (*.reg) format, by toggling the Save as type. This generates a .reg file with a REGEDIT4 header, and any REG_EXPAND_SZ and REG_MULTI_SZ data types are represented as single-byte characters. You can also export a .reg file, using REGEDIT4 format, from the command line, by running regedit /a FileName "Key".

You can import a .reg file, using the GUI, by selecting Import from the file menu, and selecting a File name. If your .reg file contains [HKEY_LOCAL_MACHINESOFTWAREAAABBBCCC], the HKEY_LOCAL_MACHINESOFTWAREAAA, HKEY_LOCAL_MACHINESOFTWAREAAABBB, and HKEY_LOCAL_MACHINESOFTWAREAAABBBCCC sub-keys are added, if necessary. Any Value Names in the .reg file are either added, or if they exist, replaced, in both data type and data value.

If a key in a .reg file is preceeded by a minus sign ([-Key]), the key, its' sub-keys, and Value Names are deleted.

If a "ValueName"=- line is present in a .reg file, the Value Name is deleted.

You can import a .reg file from the command line by running regedit filename.reg, or silently, by running regedit /s filename.reg. When importing, you can use any extension, like .txt or .tmp, not just .reg files, as long as the data in the file uses the correct syntax. To import from Windows Explorer, right-click the .reg file and press Merge.

Assume that your registry contained a HKEY_LOCAL_MACHINESOFTWAREAAA Key with the following Value Names, data types, and data values:

Value Name       Data Type           Data ValueString           REG_SZ              A StingDword            REG_DWORD           10 (in decimal)Binary           REG_Binary          01020304MultiString      REG_MULTI_SZ        Line 1                                     Line 2                                     Line 3ExpandableString REG_EXPAND_SZ       %SystemRoot%

If you export this key in Windows Registry Editor Version 5.00 format, the .reg file would contain:

Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINESOFTWAREAAA]"String"="A String""Dword"=dword:0000000a"Binary"=hex:01,02,03,04"MultiString"=hex(7):4c,00,69,00,6e,00,65,00,20,00,31,00,00,00,4c,00,69,00,6e,  00,65,00,20,00,32,00,00,00,4c,00,69,00,6e,00,65,00,20,00,33,00,00,00,00,00"ExpandableString"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,  00,6f,00,74,00,25,00,00,00

If you export this key in Win9x/NT4 Registration Files (*.reg) format, the .reg file would contain:

REGEDIT4[HKEY_LOCAL_MACHINESOFTWAREAAA]"String"="A String""Dword"=dword:0000000a"Binary"=hex:01,02,03,04"MultiString"=hex(7):4c,69,6e,65,20,31,00,4c,69,6e,65,20,32,00,4c,69,6e,65,20,  33,00,00"ExpandableString"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,00

NOTES:

1. The data value of REG_DWORD data types are expressed in hexadecimal.

2. REG_BINARY data types are indicated by hex:.

3. REG_MULTI_SZ data types are indicated by hex(7):.

4. REG_EXPAND_SZ data types are indicated by hex(2):.

5. Hex lines are continued by using a trailing .

6. REG_MULTI_SZ data type have line breaks indicated by 00, for REGEDIT4 format, and 00,00, for Windows Registry Editor Version 5.00 format.

7. All hex lines use hexadecimal encoding, as in the following example:

"ExpandableString"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,00                          %  S  y  s  t  e  m  R  o  o  t  %

8. An un-named Value Name is indicated with an un-quoted @.