Confused on translating old registry commands

I'm confused.

It appears to me that hive_load,HKU is replaced by RegHiveLoad,Tmp_software,%RegSoftware% and writes to HKLM\Software. But in Win8PE_SE config.script, for example, I see:

Code: [Select]

RegHiveLoad,Tmp_Default,%RegDefault%
RegWrite,HKLM,0x4,Tmp_Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced,Hidden,1

Does that value wind up in HKLM\Software or HKCU\Software? Is the HKLM superfluous?

Thanks, I'll take a look at it.

Hi JonF,

I am sure you already know RegCPE,
If required on some cases,  reminding "Reg ReConvert"
available
Gena\Utils\"Reg ReConvert"
Win7PESE\Utils\"Reg ReConvert"

 

hello,
@ first: sorry for my english, i'm from germany

my question: why don't working the command RegWriteBinEx and RegWrite since last update? Is there another in exchange?

Thanks

turbobaby

Hi turbobaby,

As being The Man behind the idea of "RegWriteBinEx" command on wb,
 which was added to wb with ignorance of its bugs (at this point I am not behind ;) ),
   as a result, this command (and a set of others) never used on any Projects at TheOven 

Welcome turbobaby,

There is no problem with RegWrite, normally

RegHiveLoad,Tmp_Default,%RegDefault%     (or with Tmp_Software,%RegSoftware%,   Tmp_System,%RegSystem%)
RegWrite,HKLM,0x1,Tmp_Default\
RegHiveUnLoad,Tmp_Default

can i use this code?

Hive_Load,Default
RegWrite,HKLM,0x2,%reg%\Software\Microsoft\Windows\CurrentVersion\RunOnce,WLan,"WLanStarts.au3"
Hive_Unload,Default

It is better to open a new topic for your questions, It is locked now.

can i use this code?

No, you can use this

Code: [Select]

RegHiveLoad,Tmp_Default,%RegDefault%
RegWrite,HKLM,0x2,Tmp_Default\Software\Microsoft\Windows\CurrentVersion\RunOnce,WLAN,WLanStarts.au3
RegHiveUnLoad,Tmp_Default

FWIW, here are a couple of regex's for translating old stuff. From Notepad++ but should work in lots of editors.

Find:
  (?:i)reg_add,(\dx\d,)("?)%reg%(.+)

Replace:
  RegWrite,HKLM,\1\2Tmp_Software\3 or

  RegWrite,HKLM,\1\2Tmp_Default\3 or

  RegWrite,HKLM,\1\2Tmp_System\3

Obviously, if you don't care what label you use for the currently loaded hive, you can use just one replace regex and do it all in one swell foop.

Hi JonF,

without labels, using name Tmp would be better, but not nice to figure out things on plugin at very first look

you can also make such replacement with labels,
just check "Reg ReConvert" , its interface gives you the path for your Find/Replace routine,
what it does for .reg files is same what you want to do, only with minor touchs you can also 

this will give you advantage of using standart label names,
 which leads the advantage of loading/unloadings hives only once at begining/end on complicated plugins, gaining speed. 


Edit:
Here are some examples for conversions that would be useful:
(+ please check Chris Reply 1 above first  )

*

Code: [Select]

Hive_Load,Default
reg_add,0x1,"%reg%\Control Panel\Desktop\WindowMetrics",CaptionHeight,-315
Hive_Unload,Default

---->

Code: [Select]

RegHiveLoad,Tmp_Default,%RegDefault%
RegWrite,HKLM,0x1,"Tmp_Default\Control Panel\Desktop\WindowMetrics",CaptionHeight,-315
RegHiveUnLoad,Tmp_Default

*

Code: [Select]

hive_load,HKCU
reg_add,0x4,%reg%\Console,ColorTable00,0
hive_unload

---->

Code: [Select]

RegHiveLoad,Tmp_Default,%RegDefault%
RegWrite,HKLM,0x4,Tmp_Default\Console,ColorTable00,0
RegHiveUnLoad,Tmp_Default

*

Code: [Select]

Hive_Load,HKU
reg_add,0x2,%reg%\Classes\Folder\shell\treesize,,"TreeSize Free"
Hive_Unload,HKU

---->

Code: [Select]

RegHiveLoad,Tmp_Software,%RegSoftware%
RegWrite,HKLM,0x2,Tmp_Software\Classes\Folder\shell\treesize,,"TreeSize Free"
RegHiveUnLoad,Tmp_Software

*

Code: [Select]

Hive_Load,HKLM
reg_add,0x1,%reg%\ControlSet001\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318},Class,MEDIA
Hive_Unload,HKLM

---->

Code: [Select]

RegHiveLoad,Tmp_System,%RegSystem%
RegWrite,HKLM,0x1,Tmp_System\ControlSet001\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318},Class,MEDIA
RegHiveUnLoad,Tmp_System

+++
depricated method was not only causing slow process,
 but also causing confusions using different names,
  ( as in example using different name for same task Hive_Load,Default hive_load,HKCU )

now we have simple names that cause no confusion and fastest possible within builder limits.

Shortly:
We have mostly 3 hives to load with names %RegDefault% %RegSoftware% %RegSystem%
We have standart names for them Tmp_Default Tmp_Software Tmp_System

Even now, one can load all 3 at once and unload all 3 in the end, writing whatever one wants to registry

Code: [Select]

RegHiveLoad,Tmp_Default,%RegDefault%
RegHiveLoad,Tmp_Software,%RegSoftware%
RegHiveLoad,Tmp_System,%RegSystem%
....
...
...
RegHiveUnLoad,Tmp_Default
RegHiveUnLoad,Tmp_Software
RegHiveUnLoad,Tmp_System

****
Also, All projects have 2 essential plugins
Utils\"RegCPE"
Utils\"Reg ReConvert"
to help conversions 

The first two examples (the Default and HKCU ones) in Lancelot's post still have the reg_add lines.

TIA,
BobxT

Reg_Write has always been a very strange winbuilder command. The second parameter has always seemed to me to be on the wrong command. It would seem more logical to put it on the RegHiveLoad command so it controls which registry key the hive is loaded into. To me this would be more logical:

RegHiveLoad,Tmp_System,HKLM,%RegSystem%
RegWrite,0x1,Tmp_System\ControlSet001\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318},Class,MEDIA
RegHiveUnLoad,Tmp_System

Hi paraglider,

I assume 'RegWrite' would also have to have the additional parameter as well.

RegWrite,HKLM,0x1,Tmp_System\ControlSet001\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318},Class,MEDIA

Or maybe without the need of another parameter, so it would be

RegWrite,0x1,HKLM\Tmp_System\ControlSet001\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318},Class,MEDIA

Regards,
Galapo.

I've fixed Lancelot's post above now. Should be less confusing.

Regards,
Galapo.

Reg_Write has always been a very strange winbuilder command. The second parameter has always seemed to me to be on the wrong command. It would seem more logical to put it on the RegHiveLoad command so it controls which registry key the hive is loaded into. To me this would be more logical:

I not really understand why you think this 

If I look to reg cmdline
Reg Add HKLM\Software\Test /v TestKey /t REG_SZ /d "Hello this is a test"
or similar in Autoit without switch
RegWrite("HKLM\Software\Test", "TestKey", "REG_SZ", "Hello this is a test")

And for loading the hive
Reg Load HKLM\Tmp_System E:\xxx\Windows\System32\Config\System (or Reg Load HKU\Tmp_System E:\xxx\Windows\System32\Config\System)

For me the logical and easier syntax would be this one

Code: [Select]

RegHiveLoad,HKLM\Tmp_Software,%RegSoftware%
RegWrite,HKLM\Tmp_Software\Test,TestKey,REG_SZ,"Hello this is a test"
RegHiveUnLoad,HKLM\Tmp_Software

With the type (REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ, REG_DWORD, REG_QWORD and REG_BINARY but not 0x) after the Value.
and force loading hive in HKLM without the choice and indicate it, why not!

Some differences, but for me the existing syntax is not so bad, except for binary data (with bad choices RegWriteBin, RegWriteBinEx to avoid).

In any cases, the scripts will be easier to read for all now  , without mixing RegWrite, Reg_Add
and with standart names %RegDefault%, %RegSoftware%, %RegSystem% and Tmp_Default, Tmp_Software, Tmp_System.

Thanks very much.

Regards,
BobxT

Hi Galapo,

Thanks for the correction, but another is needed.

Double quotes are missing from the RegWrite lines..

Regards,
BobxT

I am not sure what you mean with "Double Quotes",
If I understand correctly:
"Double Quotes" only needed (better to put) when there is <space>
ex:
"Hello this is a test"

Hello_this_is_a_test

RegCPE puts these kind of quotes only when there is <space>, and not when there is not <space>

*
If I understand incorrectly:
Still there maybe something I miss on examples missing from my eyes (being in very rush),
 if so let us know to fix (Galapo if so please fix  )

Sorry, I fixed the quotes (standardised) without posting that I had.

Regards,
Galapo.