Saturday, July 30, 2016

Windows Registry Value Types Distribution


Not well publicized, but here's is a Windows Registry Value Types Distribution numbers and graph for an Windows 7 Ultimate registry developer machine. To understand the registry in a detail look at registry at http://www.techsupportalert.com/content/deeper-windows-registry.htm or search this blog with "Registry"

Exported DataType Registry Data Type Counts
"value" REG_SZ 1417270
dword: REG_DWORD 531122
hex: REG_BINARY 347749
hex(2): REG_EXPAND_SZ 28945
hex(7): REG_MULTI_SZ 24957
hex(b): REG_QWORD 4561
hex(0): REG_NONE 1271
hex(8): REG_RESOURCE_LIST 259
hex(a): REG_RESOURCE_REQUIREMENTS_LIST 244
hex(9): REG_FULL_RESOURCE_DESCRIPTOR 31
hex(6): REG_LINK 0
Type Frequency 2356409



All the registry types are translated listed as follows;


"value" alias hex(1)Default or blankString value data with escape characters
hex alias hex(3)REG_BINARY Binary data (any arbitrary data)
dword alias hex(4)
REG_DWORD / REG_DWORD_LITTLE_ENDIAN
A 32-bit unsigned integer coded in little-endian format
hex(0)REG_NONENo type (the stored value, if any)
hex(1)REG_SZA string value, normally stored and exposed in UTF-16LE (when using the Unicode version of Win32 API functions), usually terminated by a NUL character
hex(2)REG_EXPAND_SZAn “expandable” string value that can contain environment variables, normally stored and exposed in UTF-16LE, usually terminated by a NUL character
hex(3)REG_BINARYBinary data (any arbitrary data) including variable byte encoded UTF8 values
hex(4)
REG_DWORD_LITTLE_ENDIAN equivalent to REG_DWORD 
A 32-bit unsigned integer coded in little-endian format
hex(5)REG_DWORD_BIG_ENDIANA 32-bit unsigned integer coded in big-endian format
hex(6)REG_LINKA symbolic link (UNICODE) to another Registry key, specifying a root key and the path to the target key
hex(7)REG_MULTI_SZA multi-string value, which is an ordered list of non-empty strings, normally stored and exposed in UTF-16LE, each one terminated by a NUL character, the list being normally terminated by a second NUL character.
hex(8)REG_RESOURCE_LISTA resource list
hex(9)REG_FULL_RESOURCE_DESCRIPTORA resource descriptor
hex(a)REG_RESOURCE_REQUIREMENTS_LISTA resource requirements list
hex(b)REG_QWORD_LITTLE_ENDIAN equivalent to REG_QWORD 
A 64-bit integer little-endian (introduced in Windows XP)



No comments:

Post a Comment