Tutorial on Regedit!
By Krobar

Mar/2000!

Here a quick tut on how to use the windows registry editor.




The registry editor (regedit.exe) is what we use to view or edit the registry...something we do quite regularly when we checking out software that we want to change.

Regedit.exe is stored in the C:\Windows folder, and you double left click it to look in the registry (it the little green icon called regedit). You can also run Regedit by clicking the Start button, selecting Run off the menu, typing regedit, then clicking ok...or pushing the enter key on keyboard.

When you first open Regedit you will notice it looks a lot like Windows Explorer...although the key HKEY_CURRENT_USER wont be open like this picture.


The window is broken up into two "panes". The left (Key) pane contains six "branches":
  • HKEY_CLASSES_ROOT
  • HKEY_CURRENT_USER
  • HKEY_LOCAL_MACHINE
  • HKEY_USERS
  • HKEY_CURRENT_CONFIG
  • HKEY_DYN_DATA
which can be opened and their contents viewed in the right (Value) pane. Clicking on the little + (plus) sign next to any of the branches will reveal the contents (or keys) contained within each branch.

When we install a program, information about it, and from it, are stored in these branches and it often helpful to look in the registry before plowing into the program code looking for the 'crack.' New keys will be created, sometimes holding the initial install date (time limit), often holding registration info, and occasionally (even) allowing us to register the program.

Whatever. Useful information is stored there and it worth looking there.

One really good program to help us see what is added to, or changed, in our registry when we install something is Regmon. It worthwhile knowing how to use it, as tuts often mention the registry.This a good tut to give you the basics.

One of the things that we gotta be careful of when mucking around in the registry, is deleting something we shouldnt. All the important shit is stored there, right down to starting the computer, so you should always back it up before changing anything. We can either back up the whole thing, or just the key/s that we play with, and we just go over how to do it.

To do either you start by going to the top left menu button (called, hehe, registry) and clicking it. Youll see a list of menu items, and the top two are called 'Import Registry File', and 'Export Registry File'. We interested in 'Export Registry File' at this stage so click on that, and a box will appear. At the bottom left you see 'Export Range' with the options 'All' or 'Selected Branch'

So if you want to back the whole registry, select 'All", and yeah, if you want to just back up a Branch or key, select 'Selected Branch'. The branch/key selected will be the one that you have clicked on when in registry editor. It will be highlighted. Now you just type a file name in the 'File Name' text field (something so you remember what it is), then scroll to where you want to save it (maybe the folder with the program you working on), and click save.

Now you being crackers, should be able to work out how to bring back the saved key/s. I tell you anyway. You can either go to the 'Import Registry File' menu item, browse to where you saved it and click 'open', or you can go straight to where you saved it and double click it. You can also right click on it and select merge.

Another useful function is the find option. To use this you go to the 'Edit' menu, click it, then click on 'Find'. In the box that appears, type in the name of the key, or text, that you want to search for, and click 'find next'. Registry editor will search till its found (if it there). Once it stops, if you want to keep looking, push the F3 key on your keyboard, and registry editor will keep searching till its gone through the whole registry.

Now once you found what you looking for, we can have a look, make changes, or delete. For example, say you looking for this key: HKEY_CURRENT_USER\blah blah\blah blah\blah blah\1.00 and you want to get to the 1.00 to change it value. Each blah blah has a + (plus) sign next to it, which when clicked will open up the next one. When you get to the 1.00 and you left click it, its value will be displayed in the right pane. Now to change a value in the right pane, you right click (the value) and from the box that appears select modify...then make your changes. You can also right click on any key or value and select delete, or rename.

Anyway, that it for now. Hope this enough to get you started. You should be able to find the keys mentioned in any tuts, and backup/change anything you want, so plow away and good luck.