I am trying two different tools to edit and remove all nodes from a Windows registry hive:
chntpw
which was essentially designed to edit password (SAM) files, but now has an interactive shell to edit registry files.hivex
which is more up-to-date and primarily intended for general purpose registry editing.
Just to have an idea about differences between these programs, I took my BCD file (which is used by the Windows Boot Manager), and used both of these programs to delete all the nodes.
As expected, the resulting files have the same size but are not identical. When I opened each with either hivex
or chntpw
, both editors show 0 nodes for both files.
However, when I open hivex
's file, a file which supposedly has 0 nodes, I see leftover data from its previous state.
Conversely, chntpw
's result does not have any residual data from the nodes.
Now, I am currently educating myself about the registry file format, so I must ask:
If I were to use one, which one should I choose? I obviously want to simulate the behavior of Microsoft's parser/writer most realistically (I want to be able to fool those). So does the leftover data has any significance; would the Windows Boot Manager give any errors if I use hivex
to create a faux BCD file?
PS: The question is independent of my primary purpose, which I hope was made clear: I want to fix/create the BCD (Boot Config Data) file without using the official Windows installer. So if you have any advices in that direction, feel free to give.
regedit
is out of question.