Basic things about Registry Files
This article describes *.reg files, its syntax and structure. I will only talk about the registry types that are most important for tweaking and are supported by Registry Tweaker.
File Format
First, let's start with file format. With Windows 2000 came new file version 5, which is saved in UNICODE format and takes twice the size of ANSI format. For those who are not familiar with UNICODE and ANSI, here is explanation of those two terms.
ANSI (American National Standards Institute ) is an organization that standardizes various areas, both public and private. It has standardized many areas of computing, but for us standard computer character set is important. This standard is called ASCII. It contains 256 different symbols that computer can use and it's limited. The solution is UNICODE standard, which allows 65.536 symbols. Why do we need that? Take Japanese language as example. It contains thousands of symbols, so ASCII is out of the question. If you use Windows 95/95/ME than you can only use ANSI standard. Windows NT/2000/XP supports both of them. Read more about formats here.
OK, now you know what the difference between ANSI and UNICODE is. It is time to apply this to reg files. If you use Windows 95/98/ME/NT you are exporting your files in ANSI format and if you are Windows 2000/XP user you can export it in UNICODE format (default), but you can also save it in ANSI format. If you use Windows 2000/XP I would recommend you to export in UNICODE because it is faster. If you do not care about that and if you are using standard characters plus you need to save hard disk space use ANSI format. File is smaller for 50%. If you have UNICODE format you can convert it to ANSI with a simple command. Go to CMD and type: type [unicode file name] > [text file name]
OK, so now you have some knowledge about file formats and it's difference. Now let's check out the syntax of the reg files.
Syntax
Here is a simple reg file. Please note, that I put line numbers to guide you to different parts of reg file during the discussion. As you can see it is exported as version 5.0, which is stored in UNICODE standard. Please note, that you will not see visual difference between ANSI and UNICODE file.
01: Windows Registry Editor Version 5.00
02:
03: [HKEY_LOCAL_MACHINE\SOFTWARE\Example]
04: "DwordExample1"=dword:00000000
05: "DwordExample2"=dword:00000001
06: "BinaryExample"=hex:00,00,00,00,0f,04,00,00,d2,04,00,00,bb,05,00,00,d0,06,00,00
07: "StringExample"="This is a test string."
08: "ExpStringExample"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74
09: "MultiStringExample"=hex(7):47,00,3a,00,5c,00,76,00,69,00,64,00,65,00,6f,00,00,00,00,00
10: ;This is a comment
Windows Registry Editor Version 5.00**
[HKEY_LOCAL_MACHINE\SOFTWARE\Example]
"DwordExample1"=dword:00000000
"DwordExample2"=dword:00000001
"BinaryExample"=hex:00,00,00,00,0f,04,00,00,d2,04,00,00,bb,05,00,00,d0,06,00,00
"StringExample"="This is a test string."
"ExpStringExample"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74
"MultiStringExample"=hex(7):47,00,3a,00,5c,00,76,00,69,00,64,00,65,00,6f,00,00,00,00,00
;This is a comment
If you save this data above to reg file and run it, these parameters will be written to registry under path specified under KEY line: [HKEY_LOCAL_MACHINE\SOFTWARE\Example]. Hive is HKEY_LOCAL_MACHINE, and key path \SOFTWARE\Example. There are stored those values under different registry type. You should see something like this:
Please note that this is only example it is nothing functional. If you have applied this to your registry, delete whole Example key in regedit.
OK, let's take a look at the syntax.
FILE HEADER (line 1) Windows Registry Editor Version 5.00
If you saved reg file in UNICODE format than you have the line as shown above. But if you exported reg file under ANSI standard you'll see the line like this REGEDIT4
REGISTRY PATH (line 3)
[HKEY_LOCAL_MACHINE\SOFTWARE\Example] This is path line, which is constructed from hive and key path (like directory path). This line points windows where to write specified values bellow. It is always written in square brackets [] and \ between keys and hives. The syntax is: [hive\key1\key2\key3...]
DWORD registry type (line 4 and 5)
DWORD is a data represented by a number that is 4 bytes long (a 32-bit integer). Many parameters for device drivers and services are this type and are displayed in Registry Editor in binary, hexadecimal, or decimal format. The syntax is: "valuename"=dword:00000000
"DwordExample1"=dword:00000000
Each value name is entered between ""; in 4th line value is DwordExample1. Then follows equals sign (=).
After = sign we have parameters which are specific for each registry type. In first 4th there is parameter which is significant for REG_DWORD registry values. It's dword:. In reg files, DWORD values are shown in hexadecimal format.This representation is always 8 characters long. Example: if a decimal value is 500, then hexadecimal value is 1f4 and the value in reg file is represented as 000001f4. If we look at upper example where hexadecimal format is 00000000, decimal value is 0. If you want to know more about decimal and hexadecimal formats and how convert between them check this out.
In line 5, another DWORD example is shown, this time as value 1.
"DwordExample2"=dword:00000001
BINARY registry type
In line 6, another registry type is shown, REG_BINARY. It's raw binary data. Most hardware component information is stored as binary data and is displayed in Registry Editor in hexadecimal format. The syntax is: "valuename"=hex:00,00,00
"BinaryExample"=hex:00,00,00,00,0f,04,00,00,d2,04,00,00,bb,05,00,00,d0,06,00,00
Again, value name is entered in "" followed by =. Then there is parameter which represents binary registry type. It's hex:. Symbols (Characters) are coded in hex type. Each symbol is separated by comma (,). Here is a list of printable symbols represented in hex. Note that 00 means null character, or nothing if you like.
| Hex | Char | Hex | Char | Hex | Char |
| 20 | Space | 40 | @ | 60 | ` |
| 21 | ! | 41 | A | 61 | a |
| 22 | " | 42 | B | 62 | b |
| 23 | # | 43 | C | 63 | c |
| 24 | $ | 44 | D | 64 | d |
| 25 | % | 45 | E | 65 | e |
| 26 | & | 46 | F | 66 | f |
| 27 | ' | 47 | G | 67 | g |
| 28 | ( | 48 | H | 68 | h |
| 29 | ) | 49 | I | 69 | i |
| 2A | * | 4A | J | 6A | j |
| 2B | + | 4B | K | 6B | k |
| 2C | , | 4C | L | 6C | l |
| 2D | - | 4D | M | 6D | m |
| 2E | . | 4E | N | 6E | n |
| 2F | / | 4F | O | 6F | o |
| 30 | 0 | 50 | P | 70 | p |
| 31 | 1 | 51 | Q | 71 | q |
| 32 | 2 | 52 | R | 72 | r |
| 33 | 3 | 53 | S | 73 | s |
| 34 | 4 | 54 | T | 74 | t |
| 35 | 5 | 55 | U | 75 | u |
| 36 | 6/td> | 56 | V | 76 | v |
| 37 | 7 | 57 | W | 77 | w |
| 38 | 8 | 58 | X | 78 | x |
| 39 | 9 | 59 | Y | 79 | y |
| 3A | : | 5A | Z | 7A | z |
| 3B | ; | 5B | [ | 7B | { |
| 3C | < | 5C | \ | 7C | | |
| 3D | = | 5D | ] | 7D | } |
| 3E | > | 5E | ^ | 7E | ~ |
| 3F | ? | 5F | _ | 7F | DEL |
STRING registry type
In line 7, simpliest type, STRING is shown. It's a fixed-length text string. The syntax is: "valuename"="some text"
"StringExample"="This is a test string."
I think you do not need any explanaition.
EXPAND STRING registry type
Expandable string (line 8) is variable string, which can hold system variables. That means the string is not fixed and it's value depends on system setup, like system folder path, program files path, etc. The parameter, which is distinctive for Expand String is hex(2):.
The syntax is: "valuename"=hex(2):00,00,00
"ExpStringExample"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74
Again, this type is written in hexadecimal format, separated with ,. There is only one registry type left, which is relevant in registry tweaking.
MULTI STRING registry type
This type hold a list of strings. The syntax is: "valuename"=hex(7):00,00,00
"MultiStringExample"=hex(7):47,00,3a,00,5c,00,76,00,69,00,64,00,65,00,6f,00,00,00,00,00
00 is a null character.
COMMENTS in reg files
If you want to use comments in your reg files, use ;. Comments are not written in registry and are just there to help you understand the tweak or registry change if you want. Look at the line 10. There you see: ;This is a comment
In summary, each type has its own significant parameter:
| REG_SZ | ="" |
| REG_DWORD | =dword: |
| REG_BINARY | =hex: |
| REG_EXPAND_SZ | =hex(2): |
| REG_MULTI_SZ | =hex(7): |
| COMMENT | ;some text |
Final Words
Here I have shown you basic instructions and information on relevant registry types, its syntax and usage. If you have more questions, join us on the Registry Tweaker forum. I will review and add more stuff in the future.