> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/registry.md).

# Registry

The **Windows Registry** is a hierarchical database used by the Windows operating system to store configuration settings and options. It contains information, settings, and values for both system-level and user-level components, including:

* Hardware and driver configurations
* Operating system behavior
* Application settings
* User preferences
* Startup programs
* Security and policy configurations

Registry data is organized in a **tree structure** of **keys** and **values**. Keys are like folders, and values are like files containing specific data.

**Key root hives:**

| Hive                  | Description                               |
| --------------------- | ----------------------------------------- |
| `HKEY_LOCAL_MACHINE`  | System-wide settings (hardware, software) |
| `HKEY_CURRENT_USER`   | User-specific settings                    |
| `HKEY_CLASSES_ROOT`   | File type associations                    |
| `HKEY_USERS`          | All user profiles on the system           |
| `HKEY_CURRENT_CONFIG` | Current hardware profile info             |

***

#### **Official Documentation**

* Microsoft Docs: [Windows Registry for Advanced Users](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users)

***

#### **Registry Value Types (Common)**

| Type            | Description                        |
| --------------- | ---------------------------------- |
| `REG_SZ`        | String value                       |
| `REG_EXPAND_SZ` | Expandable string (e.g., `%PATH%`) |
| `REG_DWORD`     | 32-bit number                      |
| `REG_QWORD`     | 64-bit number                      |
| `REG_BINARY`    | Raw binary data                    |

***

### Common Registry Paths

#### **Startup Persistence Keys**

These are commonly used for running programs at logon:

```reg
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
```

**Explorer UI Policies (e.g., Hide Icons)**

```reg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
```

* **HideIcons** DWORD value:\
  `1` = Hide desktop icons\
  `0` = Show desktop icons

***

#### **Graphical Interface**

* Open Registry Editor:

  ```cmd
  regedit
  ```

***

#### **Command Line Registry Operations**

**Add Values**

* Add a `REG_DWORD` value:

  ```cmd
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideIcons /t REG_DWORD /d 1 /f
  ```
* Add a startup program (string value):

  ```cmd
  reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v MyApp /t REG_SZ /d "C:\Path\to\Your\Application.exe" /f
  ```

**Query Values**

* Query all values under a key:

  ```cmd
  reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  ```
* Query a specific value:

  ```cmd
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideIcons
  ```

**Delete Values**

* Delete a specific value:

  ```cmd
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideIcons /f
  ```

**Copy, Load, and Export**

* Copy a registry key:

  ```cmd
  reg copy "HKEY_LOCAL_MACHINE\SourceKey" "HKEY_LOCAL_MACHINE\DestinationKey" /s /f
  ```
* Load a registry hive:

  ```cmd
  reg load HKLM\MyHive "C:\Path\To\MyHiveFile"
  ```
* Unload a loaded hive:

  ```cmd
  reg unload HKLM\MyHive
  ```
* Export a key to a `.reg` file:

  ```cmd
  reg export "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "C:\Path\To\ExportedRegistry.reg"
  ```
* Import a `.reg` file:

  ```cmd
  reg import "C:\Path\To\ImportedRegistry.reg"
  ```