Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying two different tools to edit and remove all nodes from a Windows registry hive:

  • chntpw which was essentially designed to edit password (SAM) files, but now has an interactive shell to edit registry files.

  • hivex which is more up-to-date and primarily intended for general purpose registry editing.

Just to have an idea about differences between these programs, I took my BCD file (which is used by the Windows Boot Manager), and used both of these programs to delete all the nodes.

As expected, the resulting files have the same size but are not identical. When I opened each with either hivex or chntpw, both editors show 0 nodes for both files.

However, when I open hivex's file, a file which supposedly has 0 nodes, I see leftover data from its previous state.

Conversely, chntpw's result does not have any residual data from the nodes.

Now, I am currently educating myself about the registry file format, so I must ask:

If I were to use one, which one should I choose? I obviously want to simulate the behavior of Microsoft's parser/writer most realistically (I want to be able to fool those). So does the leftover data has any significance; would the Windows Boot Manager give any errors if I use hivex to create a faux BCD file?

PS: The question is independent of my primary purpose, which I hope was made clear: I want to fix/create the BCD (Boot Config Data) file without using the official Windows installer. So if you have any advices in that direction, feel free to give.

share|improve this question

closed as unclear what you're asking by Ƭᴇcʜιᴇ007, Dave, Mokubai, Dave M, nhinkle May 1 at 4:42

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
the "best" tool for editing an MS registry is MS' registry editing tools. ;) As-is this question is actually hard to determine: Do you want to know WHY they produce different results, or do you actually want to figure out how to edit the BCD? –  Ƭᴇcʜιᴇ007 Mar 21 at 19:25
    
I want to know why, and if it has any effects regarding my purpose. Also, I intend to use one of the tools' library to create a standalone program which fixes BCD files, so using regedit is out of question. –  nrs Mar 21 at 19:43
    
Only the authors of the program can answer why the output is different –  Ramhound Mar 21 at 19:59
    
Right, but maybe somebody who understands the format better than me may explain whether this is a problem or not. –  nrs Mar 21 at 20:12
    
Why not just use bcdedit? –  nhinkle May 1 at 4:43

1 Answer 1

up vote 2 down vote accepted

Hivex is explicitly designed not to remove old data from the file. This is an important goal because the registry hive format is undocumented and no one except MSFT really understand how it works, and we don't want to destroy data in the process of making changes.

Note this does not mean that hivex can't delete nodes. You can delete nodes through the API and those nodes won't be seen by regular Windows registry calls, but no data is scrubbed/removed/truncated from the underlying file.

If you want an empty hive file, I suggest starting with an empty hive file. There is an empty hive file in the hivex source code (called 'minimal') which you can use.

share|improve this answer
    
Excellent, thanks a lot! –  nrs Mar 22 at 9:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.