Windows Registry File Format

Overview

Windows Registry files (.reg) are text-based configuration files that contain registry entries for the Windows operating system. They allow administrators and users to export, import, and modify registry settings in a human-readable format.

Technical Specifications

• Format Type: Plain text configuration file
• File Extension: .reg
• MIME Type: text/plain
• Encoding: Usually UTF-16 LE with BOM, but can be ANSI
• Line Endings: Windows-style CRLF (\r\n)
• Character Set: Unicode or ANSI

File Structure

Registry files follow a specific syntax:

• Version header line
• Blank line separator
• Registry key paths in square brackets
• Value entries with name=data format
• Comments preceded by semicolons

History and Development

• Windows 95: Introduction of Registry Editor and .reg files
• Windows NT: Enhanced registry structure and support
• Windows 2000: Improved import/export functionality
• Windows XP+: Unicode support and enhanced features
• Windows 10/11: Modern registry management tools

Registry File Syntax

Basic Structure

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\MyApplication]
"StringValue"="Hello World"
"DwordValue"=dword:00000001
"BinaryValue"=hex:01,02,03,04
"DefaultValue"=@

[HKEY_LOCAL_MACHINE\SOFTWARE\Example]
@="Default Value"
"MultiString"=hex(7):48,00,65,00,6c,00,6c,00,6f,00,00,00,57,00,6f,00,72,00,6c,00,64,00,00,00,00,00

; This is a comment
; Delete a value by setting it to "-"
"DeleteMe"=-

; Delete an entire key
[-HKEY_CURRENT_USER\Software\UnwantedKey]

Data Types

; String (REG_SZ)
"StringExample"="Text value"

; DWORD (REG_DWORD) - 32-bit integer
"DwordExample"=dword:000003e8

; Binary (REG_BINARY)
"BinaryExample"=hex:de,ad,be,ef

; Multi-String (REG_MULTI_SZ)
"MultiStringExample"=hex(7):46,00,69,00,72,00,73,00,74,00,00,00,53,00,65,00,63,00,6f,00,6e,00,64,00,00,00,00,00

; Expandable String (REG_EXPAND_SZ)
"ExpandableExample"=hex(2):25,00,50,00,41,00,54,00,48,00,25,00,00,00

; QWORD (REG_QWORD) - 64-bit integer
"QwordExample"=hex(b):e8,03,00,00,00,00,00,00

; Default value
@="Default Key Value"

Common Use Cases

• System configuration backup and restore
• Software deployment and configuration
• Group Policy implementation
• Application settings migration
• System hardening and security policies
• Batch registry modifications

Code Examples

PowerShell Registry Operations

# Export registry key to file
reg export "HKCU\Software\MyApp" "C:\backup\myapp.reg"

# Import registry file
reg import "C:\config\settings.reg"

# PowerShell native commands
Get-ItemProperty -Path "HKCU:\Software\MyApp"
Set-ItemProperty -Path "HKCU:\Software\MyApp" -Name "Setting" -Value "NewValue"

# Create new registry key
New-Item -Path "HKCU:\Software\NewApp" -Force
New-ItemProperty -Path "HKCU:\Software\NewApp" -Name "Version" -Value "1.0" -PropertyType String

# Export with PowerShell
Get-ChildItem -Path "HKCU:\Software\MyApp" -Recurse | 
    Export-Clixml -Path "C:\backup\registry_backup.xml"

Batch File Registry Management

@echo off
REM Export current user software settings
reg export "HKEY_CURRENT_USER\Software" "%USERPROFILE%\Desktop\user_software.reg"

REM Import predefined settings
reg import "\\server\share\default_settings.reg"

REM Add registry value
reg add "HKCU\Software\MyApp" /v "InstallDate" /t REG_SZ /d "%DATE%" /f

REM Delete registry value
reg delete "HKCU\Software\MyApp" /v "TempSetting" /f

REM Query registry value
reg query "HKCU\Software\MyApp" /v "Version"

C# Registry Manipulation

using Microsoft.Win32;
using System;
using System.IO;

class RegistryManager
{
    public static void ExportToRegFile(string keyPath, string filePath)
    {
        using (var key = Registry.CurrentUser.OpenSubKey(keyPath))
        {
            if (key == null) return;
            
            using (var writer = new StreamWriter(filePath, false, System.Text.Encoding.Unicode))
            {
                writer.WriteLine("Windows Registry Editor Version 5.00");
                writer.WriteLine();
                
                ExportKey(key, $"HKEY_CURRENT_USER\\{keyPath}", writer);
            }
        }
    }
    
    private static void ExportKey(RegistryKey key, string keyPath, StreamWriter writer)
    {
        writer.WriteLine($"[{keyPath}]");
        
        // Export values
        foreach (string valueName in key.GetValueNames())
        {
            var value = key.GetValue(valueName);
            var kind = key.GetValueKind(valueName);
            
            string line = FormatRegistryValue(valueName, value, kind);
            writer.WriteLine(line);
        }
        
        writer.WriteLine();
        
        // Export subkeys recursively
        foreach (string subKeyName in key.GetSubKeyNames())
        {
            using (var subKey = key.OpenSubKey(subKeyName))
            {
                ExportKey(subKey, $"{keyPath}\\{subKeyName}", writer);
            }
        }
    }
    
    private static string FormatRegistryValue(string name, object value, RegistryValueKind kind)
    {
        string valueName = string.IsNullOrEmpty(name) ? "@" : $"\"{name}\"";
        
        switch (kind)
        {
            case RegistryValueKind.String:
                return $"{valueName}=\"{value}\"";
            case RegistryValueKind.DWord:
                return $"{valueName}=dword:{((int)value):x8}";
            case RegistryValueKind.Binary:
                var bytes = (byte[])value;
                var hex = BitConverter.ToString(bytes).Replace("-", ",").ToLower();
                return $"{valueName}=hex:{hex}";
            default:
                return $"; Unsupported type: {kind}";
        }
    }
}

Python Registry File Generator

import winreg
import struct

class RegistryFileGenerator:
    def __init__(self):
        self.content = ["Windows Registry Editor Version 5.00", ""]
    
    def add_string_value(self, key_path, value_name, value_data):
        self.content.append(f"[{key_path}]")
        if value_name:
            self.content.append(f'"{value_name}"="{value_data}"')
        else:
            self.content.append(f'@="{value_data}"')
        self.content.append("")
    
    def add_dword_value(self, key_path, value_name, value_data):
        self.content.append(f"[{key_path}]")
        self.content.append(f'"{value_name}"=dword:{value_data:08x}')
        self.content.append("")
    
    def add_binary_value(self, key_path, value_name, value_data):
        hex_string = ",".join(f"{b:02x}" for b in value_data)
        self.content.append(f"[{key_path}]")
        self.content.append(f'"{value_name}"=hex:{hex_string}')
        self.content.append("")
    
    def delete_key(self, key_path):
        self.content.append(f"[-{key_path}]")
        self.content.append("")
    
    def delete_value(self, key_path, value_name):
        self.content.append(f"[{key_path}]")
        self.content.append(f'"{value_name}"=-')
        self.content.append("")
    
    def save(self, filename):
        with open(filename, 'w', encoding='utf-16le') as f:
            f.write('\ufeff')  # BOM
            f.write('\r\n'.join(self.content))

# Usage example
generator = RegistryFileGenerator()
generator.add_string_value("HKEY_CURRENT_USER\\Software\\MyApp", "Version", "1.0.0")
generator.add_dword_value("HKEY_CURRENT_USER\\Software\\MyApp", "BuildNumber", 1234)
generator.save("myapp_config.reg")

Registry File Validation

Syntax Checker

import re

def validate_reg_file(filename):
    """Validate registry file syntax."""
    errors = []
    
    with open(filename, 'r', encoding='utf-16le') as f:
        lines = f.readlines()
    
    # Check header
    if not lines[0].strip().startswith("Windows Registry Editor"):
        errors.append("Missing or invalid header")
    
    # Validate syntax
    for i, line in enumerate(lines, 1):
        line = line.strip()
        
        if not line or line.startswith(';'):
            continue
            
        # Check key format
        if line.startswith('[') and line.endswith(']'):
            key_pattern = r'^\[([-]?)(HKEY_[^\\]+)(\\.*)?]$'
            if not re.match(key_pattern, line):
                errors.append(f"Line {i}: Invalid key format")
        
        # Check value format
        elif '=' in line:
            value_pattern = r'^(".*?"|@)=(.*?)$'
            if not re.match(value_pattern, line):
                errors.append(f"Line {i}: Invalid value format")
    
    return errors

# Usage
errors = validate_reg_file("config.reg")
if errors:
    for error in errors:
        print(f"Error: {error}")
else:
    print("Registry file is valid")

Security Considerations

• Registry modifications can affect system stability
• Validate file contents before importing
• Use proper access controls for registry files
• Be cautious with administrative privilege requirements
• Consider digital signing for trusted registry files
• Backup registry before making changes

Best Practices

• Always backup the registry before importing files
• Test registry changes in non-production environments
• Use descriptive comments in registry files
• Organize registry modifications logically
• Validate syntax before deployment
• Use version control for registry file management
• Document all registry changes thoroughly

Deployment Scenarios

Group Policy Integration

REM Deploy via login script
if exist "\\server\share\user_settings.reg" (
    reg import "\\server\share\user_settings.reg"
)

REM Machine-specific settings
reg import "\\server\share\machine_settings.reg"

Software Installation

; NSIS Installer script
Section "Registry Settings"
    ; Import registry file during installation
    ExecWait 'reg import "$INSTDIR\config.reg"'
SectionEnd

Section "Uninstall"
    ; Remove registry entries
    DeleteRegKey HKCU "Software\MyApplication"
SectionEnd

Troubleshooting Common Issues

• Encoding problems (use UTF-16 LE with BOM)
• Permission errors (run as administrator)
• Syntax errors (validate format)
• Key path issues (check HKEY names)
• Value type mismatches (verify data types)
• Import failures (check file integrity)