Registry::SaveKey and manuell export aren't equal

Hi guys 🙂

I've exported the winlogon key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon) in two ways - manually and using the registry plugin. I'm working on a VM.

The version of the manual export is Regedit 5 and the version of the registry plugin is written as Regedit4.

Beside the version number both exports a kind of too different - nearly all direct values of HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon are different and a lot values are missing in version REGEDIT4 and I don't know why. 🙁
The problem seems to be with the VM ... is it because of the VM itself or does the plugin has it problems with VMs? Does anybody know?

Thanks 🙂

CJ

VM should not matter. Regedit4 does not support all the data formats used in the registry IIRC.

The VM runs WinXP 64. Is it possible for the registry plugin to has problems concerning the x64 Version?

yes, you need a special flag to access 64 bit registry keys, and I'm not sure if the plugin supports that

mr anders
i how can use from registry::SaveKey in 64bit windows?
this plugin export registry keys in Ansi file and i really need to that...
i use from this codes:

${If} ${RunningX64}
SetRegView 64
${registry::SaveKey} "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MyKey" "$EXEDIR\MyKey.reg" "/G=1" $R0
${registry::Unload}
${Else}
${registry::SaveKey} "HKEY_LOCAL_MACHINE\SOFTWARE\MyKey" "$EXEDIR\MyKey.reg" "/G=1" $R0
${registry::Unload}
${EndIf} 

As usual, I don't understand your question.

In your 64-bit branch you are using SetRegView 64 indicating that you want to read from the 64-bit part of the registry but the key you are accessing is under Wow6432Node which is the root of the 32-bit registry!

Also, it is not helpful that you just use MyKey in your examples, not all registry keys are the same on 64-bit, some are mirrored in the 32-bit view!

I would suggest that you download Process Monitor from Microsoft so you can see which key you are really accessing...

mr Anders
my problem is with unicode files....

this code:

ExecWait 'regedit /e "$EXEDIR\MyKey.reg" HKEY_LOCAL_MACHINE\SOFTWARE\MyKey' 

work in x64 and x86(32bit) windows but make .reg file with unicode format and i cant edit that file...


but ${registry::SaveKey} make .reg file with ansi format and this is good,this code work on x86(32bit) windows,but not export on x64 windows for me....

i can convert unicode .reg file to ansi file but if in my .reg file was persian or arabic word,after convert to ansi format that words Broken (Corrupted)....


this is my problem and i up to two weeks try to solve that but i cant and i need yours help

i need yours help for solve problem with one of the following ways:
1- export registry in a reg file with format ansi in windows x64 and 86
2- export registry in a reg file with format unicode and fonvert that to ansi without Broken (Corrupted) persian,arabic words
3- export registry in a reg file with format unicode and one way to edit that file and remove one line without broken persian,arabic words..

really thanks

I already told you how to do #3 but you ignored me.

The other two will never work if the password is controlled by the user because they could use codepoints that don't exist a codepage.

r2du-soft

Originally Posted by Readme.txt

${registry::SaveKey}
...
/U=[0|1]
/U=0 - "REGEDIT4" ansi format (default on ansi NSIS)
/U=1 - "Windows Registry Editor Version 5.00" unicode format (default on unicode NSIS)

${registry::SaveKey} "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MyKey" "$EXEDIR\MyKey.reg" "/G=1 /U=1" $R0