22 replies to this topic

[was_jaclaz]

Notwithstanding the n times in which I tried to "convince" our resident programmers that the Windows Registry is a filesystem, and that thus a filesystem driver was the "right" way to access it, nothing was done about it.

Now, there are sources for the driver available :
http://czwsoft.dyndns.org/regfs.html
http://czwsoft.dyndn.../regfs_imp.html

Registry Filesystem
A filesystem interface to the Windows registry

The registry interface is very similar to the filesystem interface in that they are both hierarchical databases that have data-less nodes (keys/directories) and data leaves (key values/files). Unforutnately, the registry is accessed through an entirely different API than files are, which can be a pain in portable software, especially those designed to edit and transfer configuration, expecting the data to be stored in files (like it is on most other OSes).Regfs provides a filesystem interface to the registry, allowing programs that aren't aware of the registry to access it anyway.

Even though the interfaces are similar, there are differences between the registry and a standard filesystem that may not be reconcilable; Regfs is NOT designed to be a general-purpose filesystem, as there are important features that cannot be implemented and interfaces differences that may be difficult to work-around at best. (See the known issues) Instead, regfs should be used to access and store basic configuration information in a unified place for all apps-- even those that don't normally use the registry. In any case, RegFS is an interesting as a NT filesystem interface wrapper.

Would it be too much to ask any of the programmers with a DDK to compile it, in order to try it?

Also very worth of note:
http://czwsoft.dyndns.org/sdedit.html

SD Edit
Security Descriptor Editor

Since the first release of Windows NT, security descriptors have been used to control authorization for system resources in a unified way. Security descriptors can be applied to every file, key, process, thread, event, mutex, semaphore, desktop, job, section, Active Directory object, and many other object types that exist on a NT system.

The original security descriptor editor that shipped with NT 3.1 was barely functional. Even the new editor introduced in Windows 2000 has limitations.

SD Edit is designed to expose the full functionality of security descriptors by presenting them in a direct form and by giving you full control over the details. It presents the elements of a security descriptor in a more direct form than the shell editor, and so requires you to better understand how they work at a low level.

jaclaz

[Brito]

The registry is fuzzy, this driver will hide some of these features to make it acessible.

For example, a registry key is an object that can both contain data and also contain links to it's sub-keys.

On a typical file system logic you'd want to have folders and files, not both mixed together..

[was_jaclaz]

The registry is fuzzy, this driver will hide some of these features to make it acessible.

For example, a registry key is an object that can both contain data and also contain links to it's sub-keys.

On a typical file system logic you'd want to have folders and files, not both mixed together..

You sure?

Have you compiled and tested the driver?

Or are you using your mouth fingers without checking that a proper connection with your brain has been established?

I guess you have TX set as 4800-8-N-1 and RX set at 115200-7-E-2.....

FYI :
http://pasotech.alte...icoli/regfs.htm











jaclaz

[Lancelot]

thanks jaclaz

interesting, i will test with my fingers at my new home

[Brito]

You sure?

Not really sure, it's been a while since the last time I dwelved into these things but this just feels wrong.

Come on.. besides the limitations already mentioned by the author, how do you create a new data value? How is the value type defined?

Which then makes me wonder how does one define the type of cell that a folder should have other than default?

And what happens when you copy over files to the mounted hive?

Will they be automatically sorted as DWORD, HEX (each variant) or strings?

If the file has more than 64Kb will it be truncated or split onto several smaller files?

-----------

These are some of the questions that roam my head without compiling or running the driver. Some feedback regarding how to solve these questions would surely be welcome!

[was_jaclaz]

These are some of the questions that roam my head without compiling or running the driver. Some feedback regarding how to solve these questions would surely be welcome!

In the time that it took you to wonder about those questions you could have built the damn thing and have a look directly at the existing and missing features.

Let's see how many more "programmers" will post something critical or speculative here while avoiding the only thing that I (hopefully in a gentle and kind manner) tried to ask as a favour.

jaclaz

[paraglider]

The driver is already compiled in the download. Why do you keep asking people to compile it?The install instructions are also not correct. To install:

sc create type= kernel start= demand

That does not make sense. Where is the name of the driver?

[paraglider]

Tried 3 different ddks. Finally found one it compiles with - w2003 sp1. Regardless neither the included or the one I compiled installs.

I get a:

sc create service failed 487 error reported from sc ( attempt to access invalid address ).

[OldskoolOrion]

We tried this driver on a test-machine at work, and it's exactly like the author states : only usable for non-intensive adding of keys/values when you can live with the shortcommings of missing functionality.

For more intensive work it's hellish slow and when the registry is bulked and huge due to.. well.. no maintenance etc etc, it never failed to BSOD the machine.

While the idea is fun: I can't see the driver practically deployed anywhere for a serious job, even when further developped for the sole fact that thru the API is far more faster.

I respect the "study"-value alot tho

[paraglider]

An inf file to install the driver should also be provided.

[Brito]

In the time that it took you to wonder about those questions you could have built the damn thing and have a look directly at the existing and missing features.

Let's see how many more "programmers" will post something critical or speculative here while avoiding the only thing that I (hopefully in a gentle and kind manner) tried to ask as a favour

Sorry, didn't want to become an annoying critic. Will try to provide feedback more positive to this discussion.

[was_jaclaz]

Thanks to the very clear page by Carlo Pasolini:

http://pasotech.alte...icoli/regfs.htm

I managed to build it and install it.

Find the build attached.

You need the ddk "1830_usa_ddk.iso" to build it:
http://www.microsoft...dk/default.mspx
http://download.micr...830_usa_ddk.iso

Open a build environment (XP Free Build Environment) navigate to the dirtectory where you unzipped the archive and run

build nt51

To install the service:

sc create Regdrive binPath= D:\Regfs\regfs.sys type= kernel start= demand DisplayName= "Registry File System Driver"

(change binpath= value to what applies to you)

To start it:

sc start Regdrive

Once started the R: drive letter is immediately available, you need to kill and restart Explorer to have it in Explorer.

To stop it:

sc stop Regdrive

To delete it:

sc delete Regdrive

Now what is missing is the equivalent to what VDK.EXE is for VDK.SYS, an install/configuration utility (and the ability to change drive letter and to mount an off-line Registry).

Judging from the help and support I got till now, this will never happen.


jaclaz

Attached Files

•  regfs.7z   13.74KB   39 downloads

[paraglider]

I did finally manage to install it. Don't really see what you gain. Viewing values appears to only work with notepad and really only works with string values - multistring values don't show correctly. Forget it for binary / dword etc value. Other editors like notepad++ don't work.

To use it you need to write a viewer program. What benefit do you get over using regedit directly?


Look as though the drive letter is hardcoded in the source in entry.c:

UNICODE_STRING LinkDestName;
//RtlInitUnicodeString(&LinkDestName, L"\\Device\\Regfs\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft");
//RtlInitUnicodeString(&LinkDestName, L"\\Device\\Regfs\\REGISTRY\\MACHINE\\SOFTWARE");
RtlInitUnicodeString(&LinkDestName, L"\\Device\\Regfs\\REGISTRY");
RtlInitUnicodeString(&LinkName, L"\\DosDevices\\R:");
IoCreateSymbolicLink(&LinkName, &LinkDestName);

[MichaelZ]

Don't really see what you gain.

Jaclaz's idea to have a different mechanism to write registry values in WinBuilder is not bad. The existing one works very well but is not really very fast. Too bad that the file system driver is even slower.

Many Greetings
MichaelZ

[was_jaclaz]

Jaclaz's idea to have a different mechanism to write registry values in WinBuilder is not bad.

Just for the record, it's not my idea, it is not necessarily related to Winbuilder, and it is not even an idea: it's a plot, a conspiracy against the Registry, the BCD store and, more generally the stupid way in which MS implemented the Registry format without giving decent apps to access it and documentation about the format used.

The whole plot is to have an alternative for OFFLINE registry access, something like RAWREG:
http://www.boot-land...?showtopic=4684
(left in a partially working status/unfinished)
but more similar to the Paul Lee's viewer:
http://paullee.ru/regstry.html

The thing started a long way ago:
http://www.boot-land...?showtopic=1839

A Registry (offline) mounted as a filesystem to a drive letter would allow to use, for example, batch files on the contents, adding or replacing keys, and the like.
I find that speed is not the main problem.



jaclaz

[MedEvil]

Anyone ever thought of rather misusing what M$ offers, instead of reinventing the wheel?

I can see no reason, why it shouldn't be possible to have two Registries.

I think all that would be required is to patch the hardcoded path/address.

Unfortunately, that won't work with registering of dll and services. But importing of reg files should be fine.
Thinking of it. WB style registry operations probably also won't work, unless the API calls are replaced by costum routines.




PS: For all those who wanna know, how the registry commands work.
Don't know about Delphi, but usually one can read up stuff like that, in the sourcecode of the used library.

[paraglider]

The regfs driver is still using the native Zw registry access api's - its not accessing the hives directly. The normal windows registry api's in advapi32 are just a thin layer on top of the native registry api's to make them easier to use and to be accessable from user mode.

Also does not seem to be any documented way in the native api to load a remote registry hive. It must however be possible as advapi32 does it.Other problem with the native api is that documentation for it is very poor.

[Grumpy Old Techie]

There are plenty of reg tools out there... some freeware, some not.

A lot of people rave on Powershell, which has some damn useful tricks up it's sleeve.

Some of the simplest but most usable are the command line tools provided by Microsoft,
beleive it or not. Most can be scripted.

Regini for example, comes in several versions, most of which can grep for keys and values, edit
them, write whole new keys, branch based on value, etc....

Be suprised what you can get up to with the right version of Regini.

Regards,

Grumps.

[Chris Smith]

Greetings, Boot-Land forum.

I'm the author of Regfs and SD Edit, and I just found this link to my website and wanted to respond, hoping that the thread hasn't become too old.

I always wanted to get into filesystem drivers, and thought this would be a fun project. It's not really finished (as you can tell by the hard coded paths and lack of installer and beta label).

The registry just stores blobs of data internally, with a 32 bit length. All data types, including DWORD, string, multi string, etc, are all stored as opaque blobs. This is also the way they are accessed through the native API, which Regfs uses. The "type" is just an extra ULONG associated with each value. It can be any value; the registry engine doesn't care and doesn't do anything with it except store it. Neither does Regfs.

However, the Win32 Reg* functions in advapi32.dll DO use the type to change the way the data is processed. Strings are always converted to UCS-2 Unicode before being stored, and are read as null-terminated even if they really aren't (with some caveats) There may be other things, too.

The filesystem interface doesn't really have a metadata for this (instead, file types are part of the name, e.g. exe or txt). Regfs does expose the type through extended attributes, which is a clean interface, but almost no programs support. NTBackup does, and you can save keys and restore them elsewhere with types preserved (not that I would recommend this). I did have plans to have an option to overload the file name extension to map to registry value types, but haven't implemented it yet.

If you don't specify a value type (via EAs) when creating a new file, you get DefaultKeyValueType = 0, REG_NONE.

Yes, the setup command is incorrect. I had it fixed in the unreleased working version...

sc create regfs type= kernel start= demand binpath= regfs.sys

I've been using WDK 6000 to build the working version, which includes the IFS.

Values are not limited to 64k (one of my tests is a several MB paint image), but values can only be written all at once so the driver has to buffer the entire value with pool memory. Large values (<1 MB) are not recommended.

OldskoolOrion, you mentioned a case where it was slow and/or was crashing? Can you give me steps to reproduce? It may be unusable, but I don't want it to be slow or unstable

Remote registry is implemented entirely in user mode, between advapi32.dll and the remote registry service. Regfs can only access the native kernel APIs.

In any case, thanks for the feedback!

[was_jaclaz]

I'm the author of Regfs and SD Edit, and I just found this link to my website and wanted to respond, hoping that the thread hasn't become too old.

You joking, right?

Your Registry filesystem driver, once it will be able to mount an "offline" Registry and when the small quirks still in it will be finished/polished will be the best discovery (after icecream and KON-BOOT)!

Keep up the good work!

Go Chris GO!



jaclaz

[Icecube]

I just discovered that Cygwin (a collection of tools which provide a Linux look and feel environment for Windows) offers read only access to the Windows registry via a filesystem.

# Location of the read only Windows Registry.
$ ls -l /proc/registry
total 0
dr-x------ 5773 SYSTEM         SYSTEM   0 Jan 18 22:06 HKEY_CLASSES_ROOT/
dr-xr-x---    4 Administrators SYSTEM   0 Jul 14  2009 HKEY_CURRENT_CONFIG/
dr-xr-x---   15 Administrators SYSTEM   0 Jan 18 21:47 HKEY_CURRENT_USER/
dr-xr-xr--   10 Administrators SYSTEM   0 Jan 18 20:19 HKEY_LOCAL_MACHINE/
dr-xr-xr-x    1 user           mkpasswd 0 Jan 18 22:57 HKEY_PERFORMANCE_DATA/
dr-xr-xr--    8 Administrators SYSTEM   0 Jan 18 21:53 HKEY_USERS/

# List key of programs that startup automatically.
$ ls -l /proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
total 0
-r--r----- 1 Administrators root 59 Jan 18 21:53 Adobe ARM
-r--r----- 1 Administrators root 37 Jan 18 21:53 Apoint
-r--r----- 1 Administrators root 78 Jan 18 21:53 APSDaemon
-r--r----- 1 Administrators root 72 Jan 18 21:53 BCSSync
-r--r----- 1 Administrators root 63 Jan 18 21:53 Communicator
-r--r----- 1 Administrators root 30 Jan 18 21:53 HotKeysCmds
-r--r----- 1 Administrators root 33 Jan 18 21:53 IgfxTray
-r--r----- 1 Administrators root 43 Jan 18 21:53 iTunesHelper
-r--r----- 1 Administrators root 75 Jan 18 21:53 McAfeeUpdaterUI
-r--r----- 1 Administrators root 66 Jan 18 21:53 MessagingSys
-r--r----- 1 Administrators root 33 Jan 18 21:53 Persistence
-r--r----- 1 Administrators root 70 Jan 18 21:53 ShStatEXE
-r--r----- 1 Administrators root 61 Jan 18 21:53 SunJavaUpdateSched
-r--r----- 1 Administrators root 44 Jan 18 21:53 SynTPEnh
-r--r----- 1 Administrators root 36 Jan 18 21:53 SysTrayApp

# Read iTunesHelper key.
$ cat /proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/iTunesHelper
"C:\Program Files\iTunes\iTunesHelper.exe"

# Read Java updater key.
$ cat /proc/registry/HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/SunJavaUpdateSched
"C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Blackcrack]

could this insight not for ReactOS be interesting ?

best regards

Blacky

[betrand]

Good post Icecube (Cygwin access to registry). Might try it at some point.

Blacky, good also. I have just discovered NTobj in ROS Explorer.

 

Readonly, though.

 

Cheers.