Saturday, May 20, 2017

Registry data types are just labels

If you poke around the Registry Editor enough, you might find some values of the Data column that say something like "invalid DWORD (32-bit) value." This happens when the data held in that value is not the right length for the supposed data type. DWORDs should be 4 bytes long, but there's nothing stopping them from being anything else. The function responsible for setting values, RegSetValueEx, takes a data length and pointer to the data. To view and edit these entries of unusual length, double-click them in the Registry Editor to open the binary data editing window.

No comments:

Post a Comment