Registry REG file full guide—the 15th full guide for using the registry
1. What is a REG file
A REG file is actually a registry script file. Double-clicking the REG file can import the data in it into the registry. Using REG files, we can directly perform any modification operations on the registry. Its operations on the registry are not restricted by the registry editor, so the functions are more powerful and flexible. In addition, since REG files can be modified with any text file editing tool (such as Notepad), after modifying the registry data, if an error occurs, it can also be changed back to the data in the REG file and then imported to achieve recovery operations. Therefore, it is safer than directly modifying it with registry editor. Therefore, mastering the use of REG files can sometimes achieve twice the result with half the effort and unexpected results.
2. Create a REG file
The creation of REG files is very simple and can be achieved through any text file editing tool. Let’s introduce the specific process by creating a REG file that can unblock the registry as an example.
Open Notepad and enter the following content in the Notepad file:
REGEDIT4
Empty line
[HKEY_CURRENT_USER＼Software＼Microsoft＼Windows＼CurrentVersion＼Policies＼System]"DisableRegistryTools"=dword : 00000000
Save this file, select the save path in the "Save As" dialog box that opens, then click the drop-down arrow in "Save Type" to select "All Files" (be sure to select this step, otherwise the saved file will automatically add the TXT extension), then enter "" in "File Name" and press the "Save" button. In the future, you can directly unblock the registry by double-clicking this.
3. Modify the REG file
When we use REG files to operate on the registry, there are two types of objects to operate: one is to operate on the primary key, and the other is to operate on the key-value items under the primary key. There are two types of operations on primary keys: adding and deleting, while operations on key-value items are divided into three types: adding, modifying and deleting. Let’s implement it one by one.
1. Operation on primary keys
(1) Add the primary key
It is very convenient to use REG files to add a primary key to the registry. You only need to directly write the primary key path to add in the form of "[ ]" in the file body.
For example: add a primary key named "Software Studio" under the HKEY_LOCAL_MACHINE ＼Software primary key, the content is as follows:
REGEDIT4
Empty line
[HKEY_LOCAL_MACHINE＼Software＼Software＼Software Studio]
(2) Delete the primary key
To use the REG file to delete a primary key in the registry, add a "-" symbol before the primary key path enclosed by the "[ ]" in the file body part. The deleted primary key operation will delete all subkeys and key-value items under the primary key together. Therefore, this is a relatively dangerous command, and you must pay attention to using it. For example, to delete the primary key we just added, the content is as follows:
REGEDIT4
Empty line
[-HKEY_LOCAL_MACHINE＼Software＼Software＼Software Studio]
2. Operation on key-value items
(1) Add key-value items
The operation of adding key-value items is like the "New" command in the registry editor. Generally speaking, the data types of key-values are divided into three types: string values, binary values and DWORD values. In the REG file, we also need to set the data type of the added key value item. If we want to add string values, the data must be enclosed with double quotes in English after the "="" sign; if the added value is a DWORD type value, the format after the "=" sign is "dword:data"; if the added value is a binary value, the "=" sign is "hex:data". When setting the default value key-value data, the key-value name before the "=" sign should be the "@" symbol and there are no double quotes.
For example, we need to set the default key value to "Studio" under the primary key of "HKEY_LOCAL_MACHINE ＼Software ＼Software ＼Software ＼Software ＼Software ＼Software ＼Software ＼Software ＼Software ＼Solution Studio ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings ＼Settings � The corresponding REG file contents are as follows:
REGEDIT4
Empty line
[HKEY_LOCAL_MACHINE＼Software＼Software＼Software Studio]
@="Studio"
"Name"="Slow and Slow"
"Age"=hex:23
"Marriage"=dword:00000000
When adding a key-value item, if the primary key path where the key value does not exist, the primary key will be automatically created while adding the key-value item. In addition, there is another noteworthy point when adding key-value items of string values. When this string value is a string value that includes the file path, the path separator is represented by a double slash to indicate that it is different from the primary key path separator in the registry. For example, we want to register "HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Windows＼CurrentVersion＼
Add the startup key-value item of an application "Screen Protection Controller.exe" in the "C:＼PROGRAM FILES＼BOOBSOFT＼Screen Protection Controller" directory to the startup group under the Run primary key. The content of the REG file is as follows:
REGEDIT4
Empty line
[HKEY_LOCAL_MACHINE＼Software＼Microsoft＼Windows＼CurrentVersion＼Run]
"scr"="C:＼＼PROGRAM ILES＼＼BOOBSOFT＼＼Screen protection controller＼＼Screen protection controller.exe"
(2) Modify key-value items
In fact, modification is very similar to adding. For existing key-value items, when we want to modify their data, we only need to assign the correct data to the corresponding key-value items. The new data will automatically overwrite the wrong old data. For example, when some malicious web pages modify your IE title bar text, the advertising text of that website is always displayed in the title bar. It is very annoying. We know that modifying the IE title bar text is through "HKEY_CURRENT_USER＼Software＼
If the "Window Title" key value data is set under the Microsoft ＼Internet Explorer ＼Main ＼” primary key, then we can change it back to the default IE title bar text through the REG file.
REGEDIT4
Empty line
[HKEY_CURRENT_USER＼Software＼Microsoft＼Internet Explorer＼Main]
"Window Title"=""
(3) Delete key-value items
It is also very convenient to use REG files to delete key-value items. Similar to deleting the primary key, it is also achieved through the "=" sign. However, this time it is not added in front, but the "-" symbol is placed after the equal sign of the key-value item. For example, while modifying the IE title bar and other settings, some malicious web pages also modify the key-value item data related to the Start menu, so that the commands "Run", "Find", "Close" and other commands in the Start menu are gone. After importing the REG file below, you can retrieve these commands in the Start menu.
REGEDIT4
Empty line
[HKEY_CURRENT_USER＼Software＼Microsoft＼Windows＼CurrentVersion＼Policies＼Explorer]
"NoRun"=-(release the "Run" command)
"NoClose"=-(Retrieve the "Set System" command)
"NoFind"=-(Retrieve the "Find" command)
4. Import the data in the REG file into the registry
Import information
When we double-click the REG file, the system will first prompt the query dialog box "Do you really want to add the information in it to the registry?". Click the "Yes" button, and the system will modify the registry according to the operations described in the REG file. After completion, it will give a prompt "The information in it has been successfully entered into the registry", and the operation of importing the information in the REG file into the registry is called "merge".
Modify the default value
Right-clicking on the REG file, there are three commands about the REG file: Merge, Print, and Edit. The "merge" operation is displayed in bold. This is also the default opening method, which is the operation performed when double-clicking. If you don't want to perform the "merge" operation when double-clicking the REG file, you can change its default opening method to "Edit". Open Explorer, click the "Folder Options" command in the "View" menu, click the "File Type" tab in the opened dialog box, and then find and select "Registered Item" in the "Registered File Type" list. From the "Open Method" below, we can also see that the default "merge" operation of the REG file is associated with the registry editor Regedit! Next, click the "Edit" button to open the "Edit File Type" dialog box, then select "Edit" in the "Operation" list, and then click the "Set as Default Value" button. When you double-click the REG file, you will open it with Notepad for editing.
Here I will tell you a unique skill. If you want the REG file to be imported without any prompts, you can select "Merge" in the dialog box shown in Figure 4, then click the "Edit" button, and enter "/s "%1"" in the command line that pops up the dialog box. This is a hidden parameter "/S" called the quiet import mode that uses the registry editor Regedit. If the "/S" parameter is added when importing the REG file, the system will no longer pop up any prompt dialog box and directly import it.
Unbanned
Sometimes after disabling the registry editor on some computers, in order to prevent some computer experts from using REG files and to remove restrictions on the registry editor, the default opening program of the REG file will be set to other irrelevant programs. Of course, you can change it back by modifying the relevant settings in the "Folder Options", but there is another more amazing way to prevent the REG file from being opened in the system's default method.
Run the registry editor and change the default value under "HKEY_CLASSES_ROOT.reg" to "txtfile". At this time, the REG file opens to the TXT text file. After changing this way, people who don’t know can’t change it back even if they modify the “registry item” settings in the “folder type”. Of course, the system has disabled the registry editor at this time, and you cannot modify it through the registry editor. However, after my research, I found that there is another way to crack this disable REG file. We can hold down the "Shift" key on the edited REG file and right-click it. At this time, the system will let you re-select the opening method. From here, you can use Regedit, the registry editor to open it, and you can import the REG file into the registry
(Source: Hot Network)