Pages

Thursday, September 5, 2019

Windows Registry Type Frequency Counts

How many Windows Registry Types are there and what are their counts? 

Here's a Windows Registry Types frequency counts for a typical old Win7 machine with Office installed.




































These are all the windows registry types that appear in .reg file; 


"value"
alias hex(1)
Default or blankString value data with escape characters
hex
alias hex(3)
REG_BINARYBinary data (any arbitrary data)
dword
alias hex(4)
REG_DWORDA 32-bit unsigned integer coded in little-endian format
hex(0)REG_NONENo type (the stored value, if any)
hex(1)REG_SZA string value, normally stored and exposed in UTF-16LE (when using the Unicode version of Win32 API functions), usually terminated by a NUL character
hex(2)EXPAND_SZAn “expandable” string value that can contain environment variables, normally stored and exposed in UTF-16LE, usually terminated by a NUL character
hex(3)REG_BINARYBinary data (any arbitrary data) including variable byte encoded UTF8 values
hex(4)REG_DWORD_LITTLE_ENDIAN
equivalent to
 REG_DWORD 
A 32-bit unsigned integer coded in little-endian format
hex(5)REG_DWORD_BIG_ENDIANA 32-bit unsigned integer coded in big-endian format
hex(6)REG_LINKA symbolic link (UNICODE) to another Registry key, specifying a root key and the path to the target key
hex(7)REG_MULTI_SZA multi-string value, which is an ordered list of non-empty strings, normally stored and exposed in UTF-16LE, each one terminated by a NUL character, the list being normally terminated by a second NUL character.
hex(8)REG_RESOURCE_LISTA resource list
hex(9)REG_FULL_RESOURCE_DESCRIPTORA resource descriptor
hex(a)REG_RESOURCE_REQUIREMENTS_LISTA resource requirements list
hex(b)REG_QWORD_LITTLE_ENDIAN
equivalent to
 REG_QWORD 
A 64-bit integer little-endian (introduced in Windows XP)




Sources:
https://support.microsoft.com/en-ca/help/310516

No comments:

Post a Comment