Registry Data Types

Registry Answers 
April 17, 2004 - Issue 7

Registry Data Types

Question:  I am confused about the different value types I see in the registry, 
especially Reg _SZ which I seem to see most often.

Answer:  There are three basic data types used in the Windows registry:

STRING
DWORD
BINARY

All data types ending with SZ are STRING values. Think of SZ as standing for 
StringZ
A string consists of typical readable text and numbers. 

There are 3 types of STRING data used in the registry, but only NT based kernel 
systems like Windows NT, 2000 and XP use all 3.
In Windows 95/98/Me, only one string data type is used.

The 3 types of string (SZ) data are:


1. REG_SZ
This is the most common value used in the registry and the only type of string 
value used in Windows 95/98/Me.
A string value is always enclosed in quotations. "YES" or "NO" are common 
string values, as are command line strings such as
"C:\Program Files\Outlook Express" or even complete sentences or phrases.  And 
as mentioned at the beginning, a string can also consist
of numbers. Colors, for example, are usually stated numerically in the 
registry.  See this key for examples of numeric string values:
HKEY_CURRENT_USER\Control Panel\Colors
Note that the quotations are added automatically to the string value. You do 
not need to add them yourself when entering the string data.

All string values are indicated by an AB icon -  which makes sense since the 
data type is readable text and words.
NOTE:  In Windows 9x, Reg _SZ values are indicated by the "AB" icon only. There 
is no column titled "Type" indicating the data type as 
there is in Windows NT/2000/XP. In other words, in Windows 95/98/Me, you do not 
see the words Reg _SZ,  but in NT/2000/XP you do.

.
2. REG_EXPAND_SZ
This is an "expandable" string value holding a variable.
Example: %SystemRoot%  and %UserName% are variables that are used to indicate 
the System folder and the name of the logged in user.
Windows will replace (or EXPAND) the variable with the full path when the 
command is called.
For example, %SystemRoot% is a variable that can be used to find the Windows 
System folder and can be entered instead of
C:\Windows\System32. You might be thinking, what's the advantage of that?
It's a big advantage - with a variable, you do not need to know the drive 
letter the user has Windows installed on.
Say you need to send a reg file, that has a command that will call a file in 
the "Windows\System32\Drivers" folder,  to two users.
One user has Windows installed on C, and the other on E. Without using a 
variable, you would need to make two separate files.
One including the line "C:\Windows\System32\Drivers" and another with 
"E:\Windows\System32\Drivers"
With the variable %SystemRoot%, not only do you just need to make one file with 
the command "%SystemRoot%\Drivers"
but you do not even need to know in advance what drive your users have Windows 
installed on.
Another common and useful variable is %USERPROFILE% which returns the user 
folder. For example, the path of your
Desktop folder may be C:\Documents and Settings\JOHN\Desktop. With a variable, 
you would just have to enter
%USERPROFILE%\Desktop  This will find the desktop of the current logged-on user 
no matter what drive Windows is installed on.

REG_EXPAND_SZ data is only properly displayed when using the regedit32 editor 
that's included in Windows NT/2000/XP.

NOTE:  Even though Windows 9x does not use this data type, it does not mean 
that variables cannot be used in the Windows 9x registry.
Variables can be used with REG_SZ as well, but not as extensively.  However, 
variables should not be entered as REG_SZ in Windows NT/2000/XP.
Always use REG_EXPAND SZ for variables to ensure they function and are 
displayed correctly.

3.REG_MULTI_SZ
This type is also for Windows NT/2000/XP systems only and is a multiple string 
array type made up of characters and numbers - used for
entering more than one value, each one separated by a NULL character. Example, 
this multi string value consists of 4 entries:

eqnclass.dll,CoInstallClass
spxcoins.dll,SpxClassCoInstaller
dgsetup.dll,DigiMultiPortCoInstaller
dgrpsetu.dll,DigiMultiPortCoInstaller

Like all string values it is human readable text 
Note that you can edit these values, but not create them. This is a more 
advanced string type and also accessed and worked with using regedit32.


So far we described STRING values only (SZ values with an AB icon)
Now, let's explain the other two main data types - BINARY and DWORD

BINARY (REG_BINARY) consists of binary data displayed in hexadecimal format. 
The data can be of unlimited size and is used most commonly
with hardware and configuration settings. In Windows 9x, a binary value type is 
indicated by an icon with the blue letters 011 over the letters 110:
011
110
Like the string AB icon, this makes sense too as binary data consists of only 
two digits, 0 and 1.
The reason the data is usually displayed in hex format is that binary data can 
be very lengthy and inconvenient.
Two hexadecimal digits neatly represent 8 bits

DWORD (REG_DWORD) data types also consist of binary data but two points 
distinguish them from binary types.
1. the binary data that can be entered is limited to 32 bits (4 bytes) in 
length.
2. the binary data can be displayed in hexadecimal, binary or decimal format.

The same blue icon used for Binary is used for Dword values (this is because 
both values are essentially the same - the only real difference is that one is 
limited
in the bits it can hold and the other isn't)

DWORD stands for Double Word and here is why:
8 bits = 1 byte =1 character
It takes 2 characters to form the minimum word (such as "be" "to" or "it")
Therefore it takes 16 bits or 2 bytes to form ONE word.
A Dword value can hold a maximum of 32 bits which is equal to two words or a 
DWORD - a  DOUBLE WORD

In hexadecimal format, 2 words consist of 8 digits. ie  B2 01 23 F9 and thus 
the registry displays Dword values as 8 digits with the decimal equivalent
displayed in brackets. For example when you enter a hex data value of 1, the 
resulting display will be 0x00000001(1)
DWORD values are commonly used for boolean type entries such as 0  for false or 
disabled,  and 1 for true or enabled.
System policy settings, device drivers, and services use Dword values the most.

If you find bits and bytes confusing, see my article "Just A Little Bit" which 
explains bits and bytes with the newbie in mind.
http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=247

SPECIALIZED DATA TYPES

Though not as widely used as the other data types, there also exists in the NT 
line of Windows systems (NT/2000/XP),  "RESOURCE"
data types with names like REG_RESOURCE_LIST,  REG_FULL_RESOURCE_DESCRIPTOR, 
and a few others with Resource in the name.
These are all specialized data types used mostly for hardware settings.  Here, 
I'll just briefly describe the two more common Resource types.


REG_FULL_RESOURCE_DESCRIPTOR allows you to view and edit actual hardware 
settings. When you double click a value with
the Resource Descriptor type, a dialog box opens up with fields showing 
different settings and configurations.  To get a clear idea of what this data 
type
looks like, go to this key:
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System
where you should see a REG_FULL_RESOURCE_DESCRIPTOR value named Configuration 
Data..
Simply double click Configuration Data to see the Resource Dialog box that 
comes up.

REG_RESOURCE_LIST is used when a hardware device has more than one full 
resource descriptor. This is common with network cards and memory devices.
When you double click a value in this data type, a Resource List  box comes up 
where you select the specific resource and then
click Display to bring up the dialog box allowing you to see the full 
descriptor settings.
Try here, to see an example of this type:
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer\ACPI 
Compatible Eisa/Isa HAL

All the Resource data types are for advanced hardware related configurations 
and shouldn't be messed with unless you know what you are doing. 
And again, these types are not used in Windows 95/98/Me.

WARNING
There are two registry editors in Windows - regedit.exe which is the most 
commonly used one and ships with ALL Windows versions.
Then there is regedit32 which can work with the additional string value types 
mentioned previously, and which ships with NT/2000/XP.
Never attempt to edit data type that is only meant for regedit32.exe with 
regedit.exe
In other words, the REG_MULTI_SZ  and REG_EXPAND_SZ string data types These are 
not recognized properly by regedit.exe and 
may be displayed differently(i.e as binary data) and attempting to edit those 
values with regedit may result in erroneous settings which 
can cause system problems.

vic

Have a question or tip you would like to have considered for submission?  Send 
it to:
regtips@xxxxxxxxxx?Subject=feedback

Interested in learning the registry from the ground up in plain english?
Check out Registry for Newbies - nothing beats it for the newbie.
http://newbieclub.com/rfncopy/?vic

If you are looking for a good computer magazine to subscribe to, see the
"Recommended Computer magazines" link on our  home page.
http://www.freelists.org/cgi-bin/webpage?webpage_id=regtips

You may also be interested in subscribing to ABC and TechTrax where you may 
also see
expanded screenshot html versions of select Registry Answers and Wintips&Tricks 
newsletter articles
that have been accepted for publication.
ABC
http://www.freelists.org/cgi-bin/list?list_id=abcomputers 
TechTrax

http://pubs.logicalexpressions.com/Pub0009/LPMFrame.asp?CMD=InfoDetail&ID=12

If this was forwarded to you and you would like to subscribe to Registry
Answers, click here and hit Send
regtips-request@xxxxxxxxxxxxx?Subject=subscribe

To unsubscribe, click here and hit Send
regtips-request@xxxxxxxxxxxxx?Subject=unsubscribe

Other related posts: