http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspxOne of the best public document which talks about Registry internals is by Mark Russinovich and I will recommend same before you go ahead with this article. http://www.microsoft.com/technet/archive/winntas/tips/winntmag/inreg.mspx?mfr=true Make sure beforeen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#2713374Sat, 05 Jan 2008 21:28:39 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:2713374Geek Lectures - Things geeks should know about » Blog Archive » Internal structures of the Windows Registry<p>PingBack from <a rel="nofollow" target="_new" href="http://geeklectures.info/2008/01/05/internal-structures-of-the-windows-registry/">http://geeklectures.info/2008/01/05/internal-structures-of-the-windows-registry/</a></p> http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#2713515Sat, 05 Jan 2008 22:25:32 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:2713515Blog do Anderson Thiago (a.k.a Anderson T)<p>Neste artigo, Ganand fala um pouco sobre a estrutura de registro do Windows tomando como base o artigo</p> http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#3126021Fri, 19 Sep 2008 12:30:39 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3126021PeterN<p>Hi Gaurav ,</p> <p>Great article thanks.</p> <p>Do you know what the difference is between the BlockAddress and the BinAddress values. From looking at them it seems to me that the BinAddress is either 5 or 1 more than the BlockAddress and the BlockAddress seems to be the address of the hbin.</p> <p>I'd be very interested if you could shed some light on this. Thanks.</p> http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#3215077Thu, 19 Mar 2009 11:53:04 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3215077kelly<p>Dear Gaurav:</p> <p>Thanks a lot for your article.</p> <p>I'm looking for some advice as to what I might be doing wrong. </p> <p>0: kd&gt; !reg hivelist</p> <p>-------------------------------------------------------------------------------------------------------------</p> <p>| HiveAddr |Stable Length|Stable Map|Volatile Length|Volatile Map|MappedViews|PinnedViews|U(Cnt)| BaseBlock | FileName </p> <p>-------------------------------------------------------------------------------------------------------------</p> <p>| e28b59b8 | &nbsp; &nbsp; &nbsp;1b000 &nbsp;| e28b5a18 | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp; &nbsp;| &nbsp;00000000 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;7 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e28c3000 &nbsp;| \Microsoft\Windows\UsrClass.dat</p> <p>| e28ea008 | &nbsp; &nbsp; 426000 &nbsp;| e28bd000 | &nbsp; &nbsp; &nbsp; 3000 &nbsp; &nbsp;| &nbsp;e28ea144 &nbsp;| &nbsp; &nbsp; &nbsp;167 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e28b0000 &nbsp;| ttings\Administrator\ntuser.dat</p> <p>| e276fb60 | &nbsp; &nbsp; &nbsp; 1000 &nbsp;| e276fbc0 | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp; &nbsp;| &nbsp;00000000 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;1 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e27de000 &nbsp;| \Microsoft\Windows\UsrClass.dat</p> <p>| e287eb60 | &nbsp; &nbsp; &nbsp;38000 &nbsp;| e287ebc0 | &nbsp; &nbsp; &nbsp; 1000 &nbsp; &nbsp;| &nbsp;e287ec9c &nbsp;| &nbsp; &nbsp; &nbsp; 15 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e27d3000 &nbsp;| ettings\LocalService\ntuser.dat</p> <p>| e2318b60 | &nbsp; &nbsp; &nbsp; 1000 &nbsp;| e2318bc0 | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp; &nbsp;| &nbsp;00000000 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;1 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e2319000 &nbsp;| \Microsoft\Windows\UsrClass.dat</p> <p>| e2310b60 | &nbsp; &nbsp; &nbsp;37000 &nbsp;| e2310bc0 | &nbsp; &nbsp; &nbsp; 1000 &nbsp; &nbsp;| &nbsp;e2310c9c &nbsp;| &nbsp; &nbsp; &nbsp; 14 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e2312000 &nbsp;| tings\NetworkService\ntuser.dat</p> <p>| e1dd3638 | &nbsp; &nbsp;1492000 &nbsp;| e1dea000 | &nbsp; &nbsp; &nbsp; 7000 &nbsp; &nbsp;| &nbsp;e1dd3774 &nbsp;| &nbsp; &nbsp; &nbsp;256 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;6 &nbsp;| &nbsp; &nbsp; 0| e1dd6000 &nbsp;| emRoot\System32\Config\SOFTWARE</p> <p>| e1dc3b60 | &nbsp; &nbsp; &nbsp;3b000 &nbsp;| e1dc3bc0 | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp; &nbsp;| &nbsp;00000000 &nbsp;| &nbsp; &nbsp; &nbsp; 15 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e1dcb000 &nbsp;| temRoot\System32\Config\DEFAULT</p> <p>| e1dc5008 | &nbsp; &nbsp; &nbsp; c000 &nbsp;| e1dc5068 | &nbsp; &nbsp; &nbsp; 1000 &nbsp; &nbsp;| &nbsp;e1dc5144 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;4 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e1dc6000 &nbsp;| emRoot\System32\Config\SECURITY</p> <p>| e1dc7b60 | &nbsp; &nbsp; &nbsp; 6000 &nbsp;| e1dc7bc0 | &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp; &nbsp;| &nbsp;00000000 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;2 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e1dcd000 &nbsp;| \SystemRoot\System32\Config\SAM</p> <p>| e13a9840 | &nbsp; &nbsp; &nbsp; e000 &nbsp;| e13a98a0 | &nbsp; &nbsp; &nbsp; 4000 &nbsp; &nbsp;| &nbsp;e13a997c &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e13ac000 &nbsp;| &lt;NONAME&gt;</p> <p>| e1024758 | &nbsp; &nbsp; 365000 &nbsp;| e1038000 | &nbsp; &nbsp; &nbsp;22000 &nbsp; &nbsp;| &nbsp;e1024894 &nbsp;| &nbsp; &nbsp; &nbsp;164 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e1037000 &nbsp;| SYSTEM</p> <p>| e102f008 | &nbsp; &nbsp; &nbsp; 1000 &nbsp;| e102f068 | &nbsp; &nbsp; &nbsp; 1000 &nbsp; &nbsp;| &nbsp;e102f144 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; &nbsp; &nbsp;0 &nbsp;| &nbsp; &nbsp; 0| e1030000 &nbsp;| &lt;NONAME&gt;</p> <p>-------------------------------------------------------------------------------------------------------------</p> <p>0: kd&gt; dt nt!hhive e1024758</p> <p>Symbol nt!hhive not found.</p> <p>0: kd&gt; dt nt!cmhive e1024758</p> <p>Symbol nt!cmhive not found.</p> <p>Please help me. My email is snowy_1207@163.com.</p> <p>Thanks a lot.</p> http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#3244466Fri, 22 May 2009 13:16:35 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3244466Artur Carvalho<p>you're missing the _</p> <p>dt nt!_hhive</p> <p>you could search for it using dt nt!*hive</p> <p>in my machine i get</p> <p>ntkrpamp!_CMHIVE</p> <p>ntkrpamp!_HHIVE</p> <p>i use a dual core processor</p> <p>hope this helps</p> http://blogs.technet.com/ganand/archive/2008/01/05/internal-structures-of-the-windows-registry.aspx#3258968Fri, 26 Jun 2009 16:05:54 GMTd5e57398-b9ef-4490-9955-07cbb4e4a80d:3258968SP<p>I am looking to access HKEY_CLass_root from kernel.. Howz that possible...</p>