Windows Registry API Reference

Registry

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry to store configuration settings.

Understanding and interacting with the registry is crucial for system administration, application development, and troubleshooting. This section provides a comprehensive reference to the APIs available for managing the Windows Registry.

Key Concepts

Hives: The root keys of the registry (e.g., HKEY_CLASSES_ROOT, HKEY_CURRENT_USER).
Keys: Folders in the registry hierarchy.
Values: Data entries associated with keys, each having a name, type, and data.
Value Types: Different data formats (e.g., REG_SZ for strings, REG_DWORD for 32-bit integers).

Core Registry Functions

The following functions are fundamental for interacting with the registry:

Function	Description
`RegOpenKeyEx`	Opens an existing key in the registry or creates a new key.
`RegCreateKeyEx`	Creates a new key or opens an existing one.
`RegQueryValueEx`	Retrieves the type and data for a specified value under a registry key.
`RegSetValueEx`	Sets the data and parameters for a specified value under a registry key.
`RegEnumKeyEx`	Enumerates the subkeys of a specified registry key.
`RegEnumValue`	Enumerates the values of a specified registry key.
`RegDeleteKey`	Deletes a subkey and its all descendants.
`RegDeleteValue`	Deletes a specified value from a registry key.
`RegCloseKey`	Closes a handle to an open registry key.

Working with Registry Data Types

Understanding and correctly specifying registry value types is crucial. Common types include:

REG_SZ: A null-terminated string.
REG_EXPAND_SZ: A null-terminated string that contains unexpanded references to environment variables (e.g., %SystemRoot%).
REG_DWORD: A 32-bit unsigned integer.
REG_QWORD: A 64-bit unsigned integer.
REG_BINARY: Binary data in any form.
REG_MULTI_SZ: An array of null-terminated strings, terminated by two null characters.

Example Usage (C++)

The following C++ snippet demonstrates how to read a string value from the registry:


#include <windows.h>
#include <iostream>

int main() {
    HKEY hKey;
    WCHAR keyPath[] = L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
    WCHAR valueName[] = L"ProductName";
    DWORD type = REG_SZ;
    WCHAR buffer[256];
    DWORD bufferSize = sizeof(buffer);

    LONG result = RegOpenKeyExW(
        HKEY_LOCAL_MACHINE,
        keyPath,
        0,
        KEY_READ,
        &hKey
    );

    if (result == ERROR_SUCCESS) {
        result = RegQueryValueExW(
            hKey,
            valueName,
            NULL,
            &type,
            (LPBYTE)buffer,
            &bufferSize
        );

        if (result == ERROR_SUCCESS) {
            std::wcout << L"Value of " << valueName << L": " << buffer << std::endl;
        } else {
            std::wcerr << L"Failed to query registry value. Error code: " << result << std::endl;
        }
        RegCloseKey(hKey);
    } else {
        std::wcerr << L"Failed to open registry key. Error code: " << result << std::endl;
    }

    return 0;
}

Security Considerations