Virtual Registry - Text Format

Virtual Registry - Text Format

Text format for the virtual registry is similar to regedit .reg format, however it supports macro expansion for string registry values names and value data.

The format looks like:

isolation_mode FULL_SUBKEY_NAME

   Value=VALUE_NAME
   VALUE_TYPE=VALUE_DATA

OR

   Value=VALUE_NAME
   VALUE_TYPE~MACRO_VALUE_DATA

isolation_mode - Can be one of Thinstall's isolation modes, as specified by "isolation_full", "isolation_merged", or "isolation_writecopy".

VALUE_TYPE - Specifies one the value data registry type. This should be one of the following:

REG_SZ, REG_EXPAND_SZ, REG_BINARY, REG_DWORD, REG_DWORD_BIG_ENDIAN, REG_LINK, REG_MULTI_SZ,

REG_RESOURCE_LIST, REG_FULL_RESOURCE_DESCRIPTOR, REG_RESOURCE_REQUIREMENTS_LIST

If you need to represent a non-published registry type, alternatively you can specify a decimal (base 10) number. For example:

453=#00

VALUE_DATA - Specifies value data. Data is represented differently depending on if the data type is a string or non-string type.

String Types (REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ) - Values are represent as escaped string values. A Unicode text file must be used to represent non-ansi characters. Thinstall uses unicode text files by default. The '#' , newline character, tab character, carriage return, end-of-file, and NULL characters must be escaped if they exist in the original string.

Escaped characters begin with '#' and are followed by 2 hex characters to represent the ANSI value for the character. Non-ansi Unicode characters do not need to be escaped but can only exist in unicode text files.

Examples:

REG_SZ=Both#00

This represents a 5 character string value, the 5th character being a NULL (0) character.

REG_MULIT_SZ=String1#00String2#00#00

This represents a multi-string value which contains a list of 2 values "String1" and "String2"

REG_DWORD=#27#c6#00#02

This represents a 4 byte binary value.

For binary values, data is stored as a string of escaped bytes. For DWORD values, data is stored in native intel order (little endian) so no special processing needs to be performed for binary data.

MACRO_VALUE_DATA - Specifies value data which should be macro-expanded prior to use by the application.
   For example, the value %AppData% will be expanded at runtime to the location of the user's Application Data directory.
   If value data is not macro-expanded, the application would recieve the literal string "%AppData%" when queries this registry value.
   Macro-expanded data is only supported for string value types (REG_SZ, REG_EXPAND_SZ, and REG_MULTI_SZ)

Examples:

REG_SZ~%AppData%

Represents the value of the "Application Data" folder on the host PC where Thinstall is running. The length of this registry value will change depending on what machine it runs on.

REG_SZ~#23AppData#23

Represents the value of the actual value "%AppData%". This value will always be the literal string "%AppData%" regardless of the current shell folder location.

isolation_full HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{047a9a40-657e-11d3-8d5b-00104b35e7ef}\InprocServer32
Value=ThreadingModel
REG_SZ=Both#00
Value=
REG_SZ~%SystemSystem%\mscoree.dll#00