Reposted from [Blog Garden: The first happiness ever]
1 Introduction
Most of us usually use the regedit registry editor to modify the registry, but this manual operation is time-consuming and laborious. When we want to uniformly modify the registry for multiple PCs, we will complain. And in some cases, if the Registry Editor is disabled, this method will also fail. Therefore, it is recommended that you use the REG file to quickly complete the registry modification.
A REG file is actually a registry script file, and the regedit registry editor can use REG files to import and export registry subkeys and values. Double-click the REG file to import the data into the registry. We can use the REG file to directly modify the registry without being restricted by the registry editor being disabled. As opposed to importing, you can use the regedit registry editor to export the specified items in the registry to a REG file for easy backup. REG files can be distributed to multiple PCs for batch registry modification.
REG files can be modified with any text file editing tool, and it can achieve twice the result with half the effort and unexpected effects after mastering it proficiently.
2. Create a REG file
The process of creating a REG file is very simple and can be done with any text file tool. Before creating, remember to remove the hidden extension subitem of known file types in "Folder Options", so that you can actually modify the extension of the file.
Let's take Notepad as an example, open the Notepad program, select "Save As", the file name is "try.reg", the save type is "All Files", and then save. Then an empty REG file is obtained. Double-click to execute the file, and a prompt box will pop up, prompting whether to modify the registry.
3. REG syntax
3.1 Basic syntax
The basic syntax format of the contents of the reg file is as follows:
RegistryEditorVersion
空行
[RegistryPath1]
“DataItemName1”=”DataType1:DataValue1”
“DataItemName2”=”DataType2:DataValue2”
空行
[RegistryPath2]
“DataItemName1”=”DataType1:DataValue1”
“DataItemName2”=”DataType2:DataValue2”
空行
- RegstryEditorVersion is the version number of Windows Registry Editor. In Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows 7, the value is "Windows Registry Editor Version 5.00". In Windows 98 and Windows NT 4.0, the value is "REGEDIT4".
- Empty lines are used to separate multiple key paths, and each key path can have multiple subkey and value items.
- RegistryPath is simply the key path, enclosed in square brackets with backslashes separating each hierarchy, for example:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6]
REG supports recursive creation of new keys (subkeys), as long as you add the keys you want to create in the RegistryPath file.
The registry consists of keys (or "keys"), subkeys (or "subkeys") and value items, as shown in the following figure:
- The hierarchical structure expanded on the left is the key path, which can be understood as a directory. A key is a directory in a branch, and a subkey is a subdirectory in this directory. A subkey is also a key, because there can be subdirectories under a subdirectory. Table of contents.
The "name-type-data" on the right is the value item, which can be understood as a file. A key (subkey) can have one or more value items with different names. If the name of a value item is empty, then The value item is the default value item of the key, "\Device\PointerClass0" in the above figure is the name of the value item, "REG_SZ" is the value type, and its value is "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mouclass "
DataItemName is the name of the value item. If the value item does not exist in the registry, it will be created; if it exists, its value will be overwritten. Note that the name of the value item is enclosed in double quotes.
- DataType and DataValue are the value of the value item, where DataType is the type of value, and DataValue is the specific value. DataType and DataItemName are connected with "=". The value of REG_SZ type does not need to indicate the DataType value type, only needs to be enclosed in double quotation marks , such as "DataItemName1"="TCPIP"; other types do not need to be enclosed in double quotation marks, but need to add the value type, and the value type and the specific value are separated by a colon, such as "DataItemName2"=hex(2):73,00 ,79,00,73,00,74,00,"DataItemName3"=dword:00000006.
There are five commonly used data types in the registry:
| display type | type of data | illustrate |
|---|---|---|
| REG_BINARY | binary | Binary value, displayed in hexadecimal |
| REG_DWORD | double word | A 32-bit binary value displayed as a hexadecimal value of 8 or as a decimal value of 10 |
| REG_NO | string | text string |
| REG_EXPAND_SZ | expandable string | |
| REG_MULL_SZ | multi-string | string with multiple text values |
3.2 Delete operation syntax
If you want to delete a key (subkey), you only need to add the character "-" at the head of RegistryPath, for example, use the following statement to delete TCPIP6, REG supports recursive deletion.
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6]
If you want to delete a value item, you only need to add the character "-" after the equal sign behind the DataItemName. as follows:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\TCPIP6]
“valueitem”=-
3.3 Rename operation syntax
To rename a key (subkey) or value item, delete it first, then create a new key (subkey) or value item with the new name.
4. Supplementary knowledge
The registry has five branches, the following are the names and functions of the five branches:
| name | effect |
|---|---|
| HKEY_CLASSES_ROOT | Stores a detailed list of document types recognized by Windows, and associated programs |
| HKEY_CURRENT_USER | Store information set by the current user |
| HKEY_LOCAL_MACHINE | Includes information about the hardware and software installed on the computer |
| HKEY_USERS | Contains information about the user who uses the computer |
| HKEY_CURRENT_CONFIG | Contains information about the current hardware configuration of the computer |