Registry Data Types
- From: "Registry Answers" <regtips@xxxxxxxxxx>
- To: "Registry Answers" <regtips@xxxxxxxxxxxxx>
- Date: Sat, 17 Apr 2004 09:13:00 -0400
Registry Answers
April 17, 2004 - Issue 7
Registry Data Types
Question: I am confused about the different value types I see in the registry,
especially Reg _SZ which I seem to see most often.
Answer: There are three basic data types used in the Windows registry:
STRING
DWORD
BINARY
All data types ending with SZ are STRING values. Think of SZ as standing for
StringZ
A string consists of typical readable text and numbers.
There are 3 types of STRING data used in the registry, but only NT based kernel
systems like Windows NT, 2000 and XP use all 3.
In Windows 95/98/Me, only one string data type is used.
The 3 types of string (SZ) data are:
1. REG_SZ
This is the most common value used in the registry and the only type of string
value used in Windows 95/98/Me.
A string value is always enclosed in quotations. "YES" or "NO" are common
string values, as are command line strings such as
"C:\Program Files\Outlook Express" or even complete sentences or phrases. And
as mentioned at the beginning, a string can also consist
of numbers. Colors, for example, are usually stated numerically in the
registry. See this key for examples of numeric string values:
HKEY_CURRENT_USER\Control Panel\Colors
Note that the quotations are added automatically to the string value. You do
not need to add them yourself when entering the string data.
All string values are indicated by an AB icon - which makes sense since the
data type is readable text and words.
NOTE: In Windows 9x, Reg _SZ values are indicated by the "AB" icon only. There
is no column titled "Type" indicating the data type as
there is in Windows NT/2000/XP. In other words, in Windows 95/98/Me, you do not
see the words Reg _SZ, but in NT/2000/XP you do.
.
2. REG_EXPAND_SZ
This is an "expandable" string value holding a variable.
Example: %SystemRoot% and %UserName% are variables that are used to indicate
the System folder and the name of the logged in user.
Windows will replace (or EXPAND) the variable with the full path when the
command is called.
For example, %SystemRoot% is a variable that can be used to find the Windows
System folder and can be entered instead of
C:\Windows\System32. You might be thinking, what's the advantage of that?
It's a big advantage - with a variable, you do not need to know the drive
letter the user has Windows installed on.
Say you need to send a reg file, that has a command that will call a file in
the "Windows\System32\Drivers" folder, to two users.
One user has Windows installed on C, and the other on E. Without using a
variable, you would need to make two separate files.
One including the line "C:\Windows\System32\Drivers" and another with
"E:\Windows\System32\Drivers"
With the variable %SystemRoot%, not only do you just need to make one file with
the command "%SystemRoot%\Drivers"
but you do not even need to know in advance what drive your users have Windows
installed on.
Another common and useful variable is %USERPROFILE% which returns the user
folder. For example, the path of your
Desktop folder may be C:\Documents and Settings\JOHN\Desktop. With a variable,
you would just have to enter
%USERPROFILE%\Desktop This will find the desktop of the current logged-on user
no matter what drive Windows is installed on.
REG_EXPAND_SZ data is only properly displayed when using the regedit32 editor
that's included in Windows NT/2000/XP.
NOTE: Even though Windows 9x does not use this data type, it does not mean
that variables cannot be used in the Windows 9x registry.
Variables can be used with REG_SZ as well, but not as extensively. However,
variables should not be entered as REG_SZ in Windows NT/2000/XP.
Always use REG_EXPAND SZ for variables to ensure they function and are
displayed correctly.
3.REG_MULTI_SZ
This type is also for Windows NT/2000/XP systems only and is a multiple string
array type made up of characters and numbers - used for
entering more than one value, each one separated by a NULL character. Example,
this multi string value consists of 4 entries:
eqnclass.dll,CoInstallClass
spxcoins.dll,SpxClassCoInstaller
dgsetup.dll,DigiMultiPortCoInstaller
dgrpsetu.dll,DigiMultiPortCoInstaller
Like all string values it is human readable text
Note that you can edit these values, but not create them. This is a more
advanced string type and also accessed and worked with using regedit32.
So far we described STRING values only (SZ values with an AB icon)
Now, let's explain the other two main data types - BINARY and DWORD
BINARY (REG_BINARY) consists of binary data displayed in hexadecimal format.
The data can be of unlimited size and is used most commonly
with hardware and configuration settings. In Windows 9x, a binary value type is
indicated by an icon with the blue letters 011 over the letters 110:
011
110
Like the string AB icon, this makes sense too as binary data consists of only
two digits, 0 and 1.
The reason the data is usually displayed in hex format is that binary data can
be very lengthy and inconvenient.
Two hexadecimal digits neatly represent 8 bits
DWORD (REG_DWORD) data types also consist of binary data but two points
distinguish them from binary types.
1. the binary data that can be entered is limited to 32 bits (4 bytes) in
length.
2. the binary data can be displayed in hexadecimal, binary or decimal format.
The same blue icon used for Binary is used for Dword values (this is because
both values are essentially the same - the only real difference is that one is
limited
in the bits it can hold and the other isn't)
DWORD stands for Double Word and here is why:
8 bits = 1 byte =1 character
It takes 2 characters to form the minimum word (such as "be" "to" or "it")
Therefore it takes 16 bits or 2 bytes to form ONE word.
A Dword value can hold a maximum of 32 bits which is equal to two words or a
DWORD - a DOUBLE WORD
In hexadecimal format, 2 words consist of 8 digits. ie B2 01 23 F9 and thus
the registry displays Dword values as 8 digits with the decimal equivalent
displayed in brackets. For example when you enter a hex data value of 1, the
resulting display will be 0x00000001(1)
DWORD values are commonly used for boolean type entries such as 0 for false or
disabled, and 1 for true or enabled.
System policy settings, device drivers, and services use Dword values the most.
If you find bits and bytes confusing, see my article "Just A Little Bit" which
explains bits and bytes with the newbie in mind.
http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=247
SPECIALIZED DATA TYPES
Though not as widely used as the other data types, there also exists in the NT
line of Windows systems (NT/2000/XP), "RESOURCE"
data types with names like REG_RESOURCE_LIST, REG_FULL_RESOURCE_DESCRIPTOR,
and a few others with Resource in the name.
These are all specialized data types used mostly for hardware settings. Here,
I'll just briefly describe the two more common Resource types.
REG_FULL_RESOURCE_DESCRIPTOR allows you to view and edit actual hardware
settings. When you double click a value with
the Resource Descriptor type, a dialog box opens up with fields showing
different settings and configurations. To get a clear idea of what this data
type
looks like, go to this key:
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System
where you should see a REG_FULL_RESOURCE_DESCRIPTOR value named Configuration
Data..
Simply double click Configuration Data to see the Resource Dialog box that
comes up.
REG_RESOURCE_LIST is used when a hardware device has more than one full
resource descriptor. This is common with network cards and memory devices.
When you double click a value in this data type, a Resource List box comes up
where you select the specific resource and then
click Display to bring up the dialog box allowing you to see the full
descriptor settings.
Try here, to see an example of this type:
HKEY_LOCAL_MACHINE\HARDWARE\RESOURCEMAP\Hardware Abstraction Layer\ACPI
Compatible Eisa/Isa HAL
All the Resource data types are for advanced hardware related configurations
and shouldn't be messed with unless you know what you are doing.
And again, these types are not used in Windows 95/98/Me.
WARNING
There are two registry editors in Windows - regedit.exe which is the most
commonly used one and ships with ALL Windows versions.
Then there is regedit32 which can work with the additional string value types
mentioned previously, and which ships with NT/2000/XP.
Never attempt to edit data type that is only meant for regedit32.exe with
regedit.exe
In other words, the REG_MULTI_SZ and REG_EXPAND_SZ string data types These are
not recognized properly by regedit.exe and
may be displayed differently(i.e as binary data) and attempting to edit those
values with regedit may result in erroneous settings which
can cause system problems.
vic
Have a question or tip you would like to have considered for submission? Send
it to:
regtips@xxxxxxxxxx?Subject=feedback
Interested in learning the registry from the ground up in plain english?
Check out Registry for Newbies - nothing beats it for the newbie.
http://newbieclub.com/rfncopy/?vic
If you are looking for a good computer magazine to subscribe to, see the
"Recommended Computer magazines" link on our home page.
//www.freelists.org/cgi-bin/webpage?webpage_id=regtips
You may also be interested in subscribing to ABC and TechTrax where you may
also see
expanded screenshot html versions of select Registry Answers and Wintips&Tricks
newsletter articles
that have been accepted for publication.
ABC
//www.freelists.org/cgi-bin/list?list_id=abcomputers
TechTrax
http://pubs.logicalexpressions.com/Pub0009/LPMFrame.asp?CMD=InfoDetail&ID=12
If this was forwarded to you and you would like to subscribe to Registry
Answers, click here and hit Send
regtips-request@xxxxxxxxxxxxx?Subject=subscribe
To unsubscribe, click here and hit Send
regtips-request@xxxxxxxxxxxxx?Subject=unsubscribe
Other related posts:
