3742668
荣誉版主
积分 2013
发帖 718
注册 2006-2-18
状态 离线
|
『楼 主』:
[转贴]Reg文件格式
reg脚本也算是一种脚本吧，平时用到的可能性也比较大。
原贴地址已丢失，这是我在我的硬盘上翻出来的一篇copy。
趁着现在还在家，能贴出来的都贴出来，将来换了环境写脚本找资料也方便。-_-!
| Quote: | Reg文件格式
原作：J.Mostert
翻译：淡月儿
1 概述
注册表编辑器使用.Reg文件格式导入、导出注册表设置，支持的操作系统包括Windows3.X，Windows95/98/NT及以上。尽管注册表的作用和原理十分重要，但本文不打算介绍，你可以通过文末列出的网址，获得相关的信息。同时，Windows3.X的.Reg文件格式与Windows95以上不尽相同，本文将忽略这方面的内容，毕竟Windows3.X的注册表已经不太重要。
2 详细说明
.Reg文件是ASCII码组成的无格式纯文本，每一行以“cr/lf”结尾。
2.1 文件头
.reg文件开头是注册表编辑器的版本，Windows95/NT下版本是4，你可以使用这样的字符串：regedit4。在执行导入前，注册表编辑器将会检查版本是否正确，并在不匹配时给与提示，这也是注册表编辑器对.Reg文件做的唯一检查。一般情况下，注册表编辑器会默默忽略掉错误的文件内容不予导入注册表，更多情况下会把可能导致问题的内容导入注册表，这是微软注册表编辑器的一个缺陷。
2.2 键
键和子键被原样导出至.Reg文件，没有顺序差别。
例如：
hkey_classes_root\clsid键下面有hkey_classes_root\clsid\{21ec2020-3aea-1069-a2dd-08002b30309d}这个子键(这个键的作用是在控制面板上添加一个类声明)，它按如下格式导出：
[hkey_classes_root\clsid]
[hkey_classes_root\clsid\{21ec2020-3aea-1069-a2dd-08002b30309d}]
任何一个有效键值都必须包含完整的路径，因此必定以根键开头，根键包括：
hkey_classes_root
hkey_current_user
hkey_local_machine
hkey_users
hkey_current_config
hkey_dyn_data
键名只可以由ASCII码中的可打印字符组成(即ASCII码32至127所代表的字符)，键名不可以包含空格、反斜杠( \ )以及通配符( * 和 ? )。每一个键名下紧跟着它的键值，键值列表以空行结束，一个键的键值列表可以就是一个空行。
例如：
[key-name]
[second-key-name]
"value1"=something
"value2"=something
[third-key-name]
假如在文件中指定了一个不存在的键值，那么在导入的时候这个键连同它的根键(假如不存在的话)都将被创建。
例如：
文件中指定了hkey_users\jeroen\test\subkey这个键；
注册表中只存在hkey_users\jeroen这个键；
当导入以后，hkey_users\jeroen\test这个键会被创建。
注意，你只能添加或修改键和键值，而不能删除它们。
(译者注：事实上可以删除，方法是在键名前面加上 - 号，该键连同其子键将被删除；在指定键值为 - ，可以删除该键值。)
2.3 键值
注册表键值可以是三种数据类型：字符串(string)、二进制值(binary value)和双机器字(dword，即32位整数)。键值的名称以引号 " 包含，值紧跟在等号 = 之后。每一个键都包含至少一个字符串类型的键值，这个键值在注册表编辑器中显示为“默认值”(default)。你可以通过指定名称为 @ 的值来修改默认值。
例如：
@="this is the default value."
2.3.1 字符串
字符串可以是任意长度的，用引号 " 包含起来的由ASCII码字符组成的值。字符 " 和 \ 也可以包含在字符串中，不过需要用 \" 和 \\ 进行转义。同时，注册表编辑器可以导入导出除换行符(以及新行符，即ASCII码10所指定的字符)以外的非ACSII码字符。
当一个字符串值中包含换行符，在导出的时候会被输出成两行，但是再次导入时，只能导入第一行，第二行将被忽略。因此请牢记：不要在字符串值中包含换行符。
例如：
"foo"="bar"
"foopath"="c:\\windows\\system"
"foomessage"="this/nmessage/nactually/nconsists/nof/one/nlong/nline."
2.3.2 二进制值
在字符串和双字不适用的场合，可以使用二进制值。二进制值可以用来储存任意类型的数据，其格式为 hex:xx,yy,zz 等，其中xx、yy、zz是用16进制值表示的单字节值，二进制值可以是任意长度的。
较长的二进制值可以用C语言多行符 \ 分割成多行显示。
例如：
"bar"=hex:48,00,00,00,01,00,00,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,\
00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,\
0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,00,00,00,00,c4,ac,01,\
00
请记住，\ 符只能够应用在二进制值当中。另外，微软声明一个二进制值不可以存储超过2K的资料，这也是值得注意的。
二进制值的例子：
"foo"=hex:00,de,ca,de,12,34
2.3.2.1 特定二进制类型
除了常规的二进制值，还有若干特定类型的二进制值。我们可以这样指定：
"foobar"=hex(type):xx,xx,xx,xx,...
这些类型由 0 到 10 这些数字代表，具体如下：
0 reg_none
1 reg_sz
2 reg_expand_sz
3 reg_binary
4 reg_dword, reg_dword_little_endian
5 reg_dword_big_endian
6 reg_link
7 reg_multi_sz
8 reg_resource_list
9 reg_full_resource_descriptor
10 reg_resource_requirements_list
2.3.2.1.1 reg_none类型
默认的二进制值类型，应用在无特殊要求的场合。
2.3.2.1.2 reg_sz类型
以'\0'结尾的字符串。这是用二进制值来指定的字符串值，以下两种表达方法是一样的：
"barfoo"=hex(1):41,42,43,44,00
"barfoo"="abcd"
参见2.3.1，字符串。
2.3.2.1.3 reg_expand_sz类型
包含隐含串的字符串，一般是对环境变量的引用。当一个应用程序读到这样字符串，系统将把引用串转换为正确的环境变量值。
下面的例子表示字符串"%path%;something"，当这个值被引用的时候，"%path%"会被转化为当前系统的 path 值。
"forbaa"=hex(2):25,50,41,54,48,25,3b,53,6f,6d,65,74,68,69,6e,67,00
2.3.2.1.4 reg_dword, reg_dword_little_endian类型
小段对齐，是通常的双字数据类型，在这种格式下存储，高位字节在前，低位字节在后。
2.3.2.1.5 reg_dword_big_endian类型
大段对齐，是苹果机的双字数据类型，在这种格式下存储，低位字节在前，高位字节在后。
2.3.2.1.6 reg_link类型
Unicode符号连接。
2.3.2.1.7 reg_multi_sz
多字节字符串集，以连续两个'\0'结束，例如：
"farboo"=hex(7):41,42,43,44,00,45,46,47,48,00,00
表示"abcd"和"efgh"两个字符串。
2.3.2.1.8 reg_resource_list
设备驱动程序资源列表。
2.3.2.1.9 reg_full_resource_descriptor
微软保留数据类型，用于辅助设备驱动程序。
2.3.2.1.10 reg_resource_requirements_list
微软保留数据类型，用于辅助设备驱动程序。
2.3.3. 双字数据类型
双字数据类型，即32位整数，表示为 dword:xxxxxxxx，其中 x 是一个表示4位二进制的16进制值。
例如：
"foo"=dword:00decade
3 结语
本文简要介绍了.Reg文件的格式，由于作者水平有限，错漏之处在所难免，假如您发现了错误，请不吝赐教.
我的Email:j.mostert@oke.nl。
4 参考资料
以下是关于注册表知识的网址，希望对大家有所帮助。
(译者注：由于这些链接都是1997年4月以前的，因此不再翻译)
原文：
Thethe .reg file format
J.Mostert
1 introduction
the .reg file format is used by regedit, the program supplied with windows
3.x,
windows 95, and windows nt, to import and export settings from the
registry.
note that i will not explain what the registry is, how it works, or what
it can
be used for. there are other documents describing the registry and it's
most
interesting parts all over the net - check out some of the links at the
end of
this document. also, i will not provide you with information on regedit for
windows 3.x - i know that it exists, but not if it's format is in any way
like
the regedit of 95/nt. besides, the registry is much less interesting on
windows
3.x.
2 description
the file is formatted as plain ascii text. every line is ended with a cr/lf
combination.
2.1 header
it starts with regeditx, where x is regedit's version number - on 95/nt,
it's
4, making the string regedit4.
this is also the only part of the file actually checked by regedit when
it's
importing - if the file contains any formatting errors, regedit will not
notify
you and simply skip the settings that contain errors.
in particular, regedit will pretty much accept anything as long as it
starts
with regeditx, and ignore anything erroneous. yes, that does add up to the
microsoft stupid mistakes list.
2.2 keys
key names are exported as they are encountered, but need not be in any
order.
subkeys are explicitly named. for example, if you had the key
hkey_classes_root\clsid and it's subkey
hkey_classes_root\clsid\{21ec2020-3aea-1069-a2dd-08002b30309d} (which
represents the classid of the control panel, by the way), they would be
exported as:
[hkey_classes_root\clsid]
[hkey_classes_root\clsid\{21ec2020-3aea-1069-a2dd-08002b30309d}]
for a key name to be valid, it must start with one of the root key names:
hkey_classes_root, hkey_current_user, hkey_local_machine, hkey_users,
hkey_current_config and hkey_dyn_data.
a key name may only contain printable ascii characters (that is, characters
with values from 32 through 127) and may not contain spaces, backslashes \
or
the wildcards * and ?.
every key name is followed by it's values, starting on the line directly
following it. the list of values is terminated with an empty line, and may
be
empty itself.
for example:
[key-name]
[second-key-name]
"value1"=something
"value2"=something
[third-key-name]
if a key is specified which does not exist, it is created, along with any
parent keys that do not exist. for example, if the key
hkey_users\jeroen\test\subkey is specified, and only the key
hkey_users\jeroen
exists, the key hkey_users\jeroen\test is also created.
note that you cannot delete keys or values - you can only add them if they
don't already exist, or modify them if they do.
2.3 values
there are three kinds of values in the registry: strings, binary values,
and
dwords. they represent a collection of characters, a collection of bytes,
and a
32-bit integer, respectively.
values consist of a name, enclosed in quotes "", followed by an equal sign
= ,
followed by the value value (there's no other way to put it).
every key, even if created empty, contains at least one string value -
this is
the value shown as (default) in regedit. to set it's value, use @ as the
value
name, and omit the usual quotes around the value name.
example:
@="this is the default value."
2.3.1 strings
strings may be any size. they are represented within quotes "", and contain
normal ascii characters.
the quote " and backslash \ are also allowed in strings - however, they
must be
represented as \" and \\, respectively. also, regedit can import and
export all
non-ascii characters except for linefeed (or newline, ascii code 10).
should a
linefeed end up in a string, regedit will export this as a real newline,
splitting the string in two lines. when reimporting this string, regedit
will
only read the first line. the moral of the story: don't store linefeeds in
strings.
examples of strings:
"foo"="bar"
"foopath"="c:\\windows\\system"
"foomessage"="this/nmessage/nactually/nconsists/nof/one/nlong/nline."
2.3.2 binary values
binary values are used where strings and dwords fail. they can be used to
represent any type of data. they are represented as hex:xx,yy,zz where
xx,yy
and zz are hexadecimal representations of single bytes. they may be any
length.
lengthy binary values can be divided into multiple lines using the c line
separator \. for example:
"bar"=hex:48,00,00,00,01,00,00,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,\
00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,\
0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,0a,00,00,00,00,00,c4,ac,01,\
00
also take note that this is only allowed with binary values. in
particular, you
cannot divide strings this way. and yes, this is pretty stupid.
although i usually ignore microsoft, they recommend you shouldn't store
more
than around two kilobytes of binary data at most, and i agree with them for
once.
example of binary values:
"foo"=hex:00,de,ca,de,12,34
2.3.2.1 types of binary values
along with 'regular' binary values, there are also some special types of
data
which regedit represents as special binary values, like this:
"foobar"=hex(type):xx,xx,xx,xx,...
where type is a number ranging from zero to ten in the current versions of
windows, as follows:
type name
0 reg_none
1 reg_sz
2 reg_expand_sz
3 reg_binary
4 reg_dword, reg_dword_little_endian
5 reg_dword_big_endian
6 reg_link
7 reg_multi_sz
8 reg_resource_list
9 reg_full_resource_descriptor
10 reg_resource_requirements_list
2.3.2.1.1 reg_none
reg_none means 'no defined value type'. no, i don't know what it's good
for -
reg_binary is already a catch-all type for everything that has no type.
perhaps
it's used for values that have no contents, although i can't imagine what
that
would be good for.
2.3.2.1.2 reg_sz
a null-terminated string. this is the same as the string type, represented
as
bytes. for example, these definitions are equal:
"barfoo"=hex(1):41,42,43,44,00
and
"barfoo"="abcd"
see also 2.3.1, strings.
2.3.2.1.3 reg_expand_sz
a null-terminated string that contains unexpanded references to environment
variables. when an application reads this string from the registry, it can
let
windows replace the references with the environment variable value.
for example, the following value
"forbaa"=hex(2):25,50,41,54,48,25,3b,53,6f,6d,65,74,68,69,6e,67,00
represents the string "%path%;something". when this string is read, the
"%path%" section can be replaced with the contents of your path variable.
2.3.2.1.4 reg_dword, reg_dword_little_endian
represents a little-endian dword (the common format of windows dwords). in
little-endian format, the most significant byte of a word is the high-order
byte. see also 2.3.3, dwords.
2.3.2.1.5 reg_dword_big_endian
represents a big-endian dword (used on macintoshes, for example). as you
can
probably guess, in big-endian format, the most significant byte of a word
is
the low-order byte.
2.3.2.1.6 reg_link
represents a unicode symbolic link. no, i don't know what this is, and i
probably don't want to know either.
2.3.2.1.7 reg_multi_sz
a collection of null-terminated strings, null-terminated. for example:
"farboo"=hex(7):41,42,43,44,00,45,46,47,48,00,00
represents two strings: "abcd" and "efgh".
2.3.2.1.8 reg_resource_list
a device driver resource list. another one in the category "don't know and
don't want to know."
2.3.2.1.9 reg_full_resource_descriptor
undocumented. it's probably ment for windows itself only, as device driver
stuff.
2.3.2.1.10 reg_resource_requirements_list
undocumented. it's probably ment for windows itself only, as device driver
stuff.
2.3.3. dwords
dwords are 32-bit integers represented as dword:xxxxxxxx, where x is a
hexadecimal digit. they're pretty boring, as that's all i can tell about
them.
example of dword values:
"foo"=dword:00decade
3. the end
that's about it - the .reg format is pretty simple, but it does the job.
should you find any unclarities, mistakes or things you think are missing,
contact me by emailing to "j.mostert@oke.nl".
4. well, almost, we still need the links
oh yeah, here are the links i promised, listed in no particular order. they
were all valid on november 4th, 1997.
http://help.mindspring.com/technotes/96dec/registry1.htm
this is the registry page at technotes+, the site for a lot of tips and
tricks
about pretty much anything technical. it contains an introduction to the
registry, and how it should be used. i recommend to read this first if
you've
never even heard about this registry thing.
http://www.geocities.com/siliconvalley/pines/2857/
this is a registry page by neil mcquarry, and a nice one it is, too. it
contains a quick introduction to the registry, a brief description of .reg
files, and a detailed description of various keys of interest. recommended
if
you want to get the most of the registry.
http://www.amazon.com
this is amazons home page, "earth's biggest bookstore". try their search
function to search for "windows registry" - this will provide you with more
than enough literary references. no online information, however.
http://www.windows95.com/tips
this is the tips section of windows95.com. although it doesn't contain just
registry tips, it's really worth checking out. but then again, all of
windows95.com is worth checking out. if you have windows 95/nt, be sure to
visit it. |
|
|
|
