UNIT – 4
ADVANCED WINDOWS HACKING
Editing your operating systems by editing Explorer.exe, The Registry, The Registry
Editor, Description of .reg file, Command Line Registry Arguments, Other System Files,
Some Windows & DOS Tricks, Customize DOS, Clearing the CMOS without opening your
PC, The Untold Windows Tips and Tricks Manual, Exiting Windows the Cool and Quick
Way, Ban Shutdowns: A Trick to Play, Disabling Display of Drives in My Computer. Take
Over the Screen Saver, Pop a Banner each time Windows Boots, Change the Default
Locations, Secure your Desktop Icons and Settings.
______________________________________________________________________________
THE REGISTRY
What is the Registry?
The Windows Registry is a hierarchical database that contains all of the configurations and
settings used by components, services, applications, and pretty much everything in Windows.
The registry has two basic concepts to be aware of: Keys and Values. Registry Keys are objects
that are basically folders, and in the interface even look exactly like folders. Values are a bit like
the files in the folders, and they contain the actual settings.
When you open the Registry Editor for the first time, you’ll see a tree view on the left-hand pane
that contains all of the keys, with values on the right-hand side. It’s about as simple as an
interface gets.
The root-level keys that you see in the left-hand side of the screenshot are important. Each one
houses a different set of information, so depending on what you are trying to do, you’ll need to
know which section to browse down into.
The interesting thing that most people don’t know is that three of the five items on the root level
aren’t actually there… they are just linked to items further down in one of the other keys.
, HKEY_CLASSES_ROOT
Windows uses this section to manage file type associations, and it is usually abbreviated HKCR
when being referenced in documentation. This key is actually just a link to
HKLM\Software\Classes.
HKEY_CURRENT_USER
Holds the user settings for the currently logged in user, and is usually abbreviated HKCU This is
actually just a link to HKEY_USERS\<SID-FOR-CURRENT-USER>. The most important sub-
key in here is HKCU\Software, which contains user-level settings for most of your software.
HKEY_LOCAL_MACHINE
All of the system-wide settings are stored here, and it is usually abbreviated as HKLM. You’ll
mostly use the HKLM\Software key to check machine-wide settings.
HKEY_USERS
Stores all of the settings for all users on the system. You’ll typically use HKCU instead, but if
you need to check settings for another user on your computer, you can use this one.
HKEY_CURRENT_CONFIG
Stores all of the information about the current hardware configuration. This one isn’t used very
often, and it just a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.
Creating New Keys and Values
Right-clicking on any key in the left-hand side of the window will give you a set of options, most
of which are fairly straightforward and easy to understand.
You can create a new Key, which will show up as a folder on the left-hand side, or a new value,
which will show up on the right-hand side. Those values can be a little confusing, but there are
really only a couple of values that are used regularly.
String Value (REG_SZ) – This contains anything that will fit into a regular string. The vast
majority of the time, you can edit human-readable strings without breaking everything.
Binary Value (REG_BINARY) – This value contains arbitrary binary data, and you will
almost never want to attempt to edit one of these keys.
DWORD (32-bit) Value (REG_DWORD) – These are almost always used for a regular
integer value, whether just 0 or 1, or a number from 0 to 4,294,967,295.
, QWORD (64-bit) Value (REG_QWORD) – These are not used very often for registry hacking
purposes, but it’s basically a 64-bit integer value.
Multi-String Value (REG_MULTI_SZ) – These values are fairly uncommon, but it works
basically like a notepad window. You can type multi-line textual information into a field like
this.
Expandable String Value (REG_EXPAND_SZ) – These variables have a string that can
contain environment variables and is often used for system paths. So a string might be
%SystemDrive%\Windows and would expand to C:\Windows. This means that when you find a
value in the Registry that is set to this type, you can change or insert environment variables and
they will be “expanded” before the string is used.
Exporting Registry Files
You can export registry keys and all of the values contained underneath them by right-clicking
on a key and choosing Export. This is really important if you are going to be making changes to
your system.
Once you’ve got your exported registry file, you can double-click on it to enter the information
back into the registry, or you can choose Edit to take a look at the contents in Notepad.
The registry hacking file format is pretty simple – value names on the left, and actual values on
the right.
ADVANCED WINDOWS HACKING
Editing your operating systems by editing Explorer.exe, The Registry, The Registry
Editor, Description of .reg file, Command Line Registry Arguments, Other System Files,
Some Windows & DOS Tricks, Customize DOS, Clearing the CMOS without opening your
PC, The Untold Windows Tips and Tricks Manual, Exiting Windows the Cool and Quick
Way, Ban Shutdowns: A Trick to Play, Disabling Display of Drives in My Computer. Take
Over the Screen Saver, Pop a Banner each time Windows Boots, Change the Default
Locations, Secure your Desktop Icons and Settings.
______________________________________________________________________________
THE REGISTRY
What is the Registry?
The Windows Registry is a hierarchical database that contains all of the configurations and
settings used by components, services, applications, and pretty much everything in Windows.
The registry has two basic concepts to be aware of: Keys and Values. Registry Keys are objects
that are basically folders, and in the interface even look exactly like folders. Values are a bit like
the files in the folders, and they contain the actual settings.
When you open the Registry Editor for the first time, you’ll see a tree view on the left-hand pane
that contains all of the keys, with values on the right-hand side. It’s about as simple as an
interface gets.
The root-level keys that you see in the left-hand side of the screenshot are important. Each one
houses a different set of information, so depending on what you are trying to do, you’ll need to
know which section to browse down into.
The interesting thing that most people don’t know is that three of the five items on the root level
aren’t actually there… they are just linked to items further down in one of the other keys.
, HKEY_CLASSES_ROOT
Windows uses this section to manage file type associations, and it is usually abbreviated HKCR
when being referenced in documentation. This key is actually just a link to
HKLM\Software\Classes.
HKEY_CURRENT_USER
Holds the user settings for the currently logged in user, and is usually abbreviated HKCU This is
actually just a link to HKEY_USERS\<SID-FOR-CURRENT-USER>. The most important sub-
key in here is HKCU\Software, which contains user-level settings for most of your software.
HKEY_LOCAL_MACHINE
All of the system-wide settings are stored here, and it is usually abbreviated as HKLM. You’ll
mostly use the HKLM\Software key to check machine-wide settings.
HKEY_USERS
Stores all of the settings for all users on the system. You’ll typically use HKCU instead, but if
you need to check settings for another user on your computer, you can use this one.
HKEY_CURRENT_CONFIG
Stores all of the information about the current hardware configuration. This one isn’t used very
often, and it just a link to HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current.
Creating New Keys and Values
Right-clicking on any key in the left-hand side of the window will give you a set of options, most
of which are fairly straightforward and easy to understand.
You can create a new Key, which will show up as a folder on the left-hand side, or a new value,
which will show up on the right-hand side. Those values can be a little confusing, but there are
really only a couple of values that are used regularly.
String Value (REG_SZ) – This contains anything that will fit into a regular string. The vast
majority of the time, you can edit human-readable strings without breaking everything.
Binary Value (REG_BINARY) – This value contains arbitrary binary data, and you will
almost never want to attempt to edit one of these keys.
DWORD (32-bit) Value (REG_DWORD) – These are almost always used for a regular
integer value, whether just 0 or 1, or a number from 0 to 4,294,967,295.
, QWORD (64-bit) Value (REG_QWORD) – These are not used very often for registry hacking
purposes, but it’s basically a 64-bit integer value.
Multi-String Value (REG_MULTI_SZ) – These values are fairly uncommon, but it works
basically like a notepad window. You can type multi-line textual information into a field like
this.
Expandable String Value (REG_EXPAND_SZ) – These variables have a string that can
contain environment variables and is often used for system paths. So a string might be
%SystemDrive%\Windows and would expand to C:\Windows. This means that when you find a
value in the Registry that is set to this type, you can change or insert environment variables and
they will be “expanded” before the string is used.
Exporting Registry Files
You can export registry keys and all of the values contained underneath them by right-clicking
on a key and choosing Export. This is really important if you are going to be making changes to
your system.
Once you’ve got your exported registry file, you can double-click on it to enter the information
back into the registry, or you can choose Edit to take a look at the contents in Notepad.
The registry hacking file format is pretty simple – value names on the left, and actual values on
the right.
