ChocJunkie
23rd November 2009 16:04 UTC

Registry::SaveKey and manuell export aren't equal
Hi guys :)

I've exported the winlogon key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon) in two ways - manually and using the registry plugin. I'm working on a VM.

The version of the manual export is Regedit 5 and the version of the registry plugin is written as Regedit4.

Beside the version number both exports a kind of too different - nearly all direct values of HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon are different and a lot values are missing in version REGEDIT4 and I don't know why. :(
The problem seems to be with the VM ... is it because of the VM itself or does the plugin has it problems with VMs? Does anybody know?

Thanks :)

CJ

Anders
23rd November 2009 16:14 UTC

VM should not matter. Regedit4 does not support all the data formats used in the registry IIRC.

ChocJunkie
24th November 2009 07:17 UTC

The VM runs WinXP 64. Is it possible for the registry plugin to has problems concerning the x64 Version?

Anders
24th November 2009 09:54 UTC

yes, you need a special flag to access 64 bit registry keys, and I'm not sure if the plugin supports that