-10

Help! I'm going to get fired if I can't figure out how to do this by tomorrow.

Microsoft Windows stores its registry databases (known as "registry hives" there's actually a backstory to the origin of this name, but I digress) in a proprietary binary format.

Answer this correctly or you lose your job:

  1. Let H-sub-A be the registry hive of Computer A, and let H-sub-B be the registry hive of Computer B.

  2. Create a registry hive H-sub-A-prime (in the native binary format) that contains all of the registry keys and values in both H-sub-A and H-sub-B. If there is overlap, let the value from H-sub-B overwrite the value in H-sub-A.

  3. Sure, you can import a text-based patch file (e.g., "FOO.REG") to modify the registry, but can you merge two registry hives in their native binary format?

Answers that involve exporting the registry to a text file (e.g., "FOO.REG") will receive no credit. You may only use software included with Microsoft Windows (any version) and / or third-party tools that are free of charge.

5
  • Dear downvoter who left neither a comment nor an answer: if you're going to burn your own karma, you might as well leave an explanation.
    – Registrar
    Oct 11, 2012 at 0:24
  • 3
    -1 Question shows no research effort, and also seems fairly contrived (thus not likely to be useful to the SuperUser audience). And FYI @Registrar, downvoting questions does not expend reputation, unlike downvoting answers.
    – Indrek
    Oct 11, 2012 at 0:44
  • 2
    I sort of wonder who the op annoyed to get such an ultimatum
    – Journeyman Geek
    Oct 11, 2012 at 4:17
  • 4
    To the OP: This looks like an attempt to create an excuse to eliminate employees from your company by making it appear that it is your fault if you get "fired", rather than accepting the negative publicity that could result from layoffs. While I am not a lawyer, you may want to file a "wrongful termination" lawsuit against your employer if you do end up getting fired. Good luck.
    – bwDraco
    Oct 11, 2012 at 4:26
  • 3
    "... no credit ..."? A contrived homework/exam question, for sure.
    – kreemoweet
    Oct 11, 2012 at 5:38

2 Answers 2

11

You can merge these hives by loading them into a temporary key in the registry itself and copying one hive over the other using the reg command.

Considering the nature of the question, please note that I am not liable for any damages that may arise as a result of the use of this answer. For more information, see the Stack Exchange Network Terms of Service.

I actually tested these commands myself on a Windows 7 machine using dummy data, without changing any existing data in the registry, so they should work. I am making the assumption that the registry hive files are supplied to you; if they aren't, you'll probably need to obtain them by booting into a Linux live CD and retrieving the files from computers' hard drives. I couldn't export them on a live system through reg save on an elevated command prompt, getting little more than Access is denied errors.

If the hives are supplied as more than one file per computer, and they need to be operated upon as a single unit, you'll need to load and merge them in the registry using the same techniques discussed henceforth, on the keys corresponding to the computer from which the hive files are derived, before copying computer B's complete hives onto computer A's. Otherwise, you can merge each hive individually using the following procedure.

  • Assume that hive HA is stored in file Ha.hiv and hive HB is stored in file Hb.hiv. Begin by creating a key HKLM\Temp using Registry Editor, then load HA and HB into this temporary key on either computer using these commands in an elevated command prompt:

    reg load HKLM\Temp\Ha Ha.hiv
    reg load HKLM\Temp\Hb Hb.hiv
    
  • Copy the contents of HB into HA, overwriting any existing keys and values:

    reg copy HKLM\Temp\Hb HKLM\Temp\Ha /s /f
    
  • Unload the registry hive files using Registry Editor by selecting the Ha key, choosing Unload Hive under the File menu, and repeating the same for Hb. You can then delete the temporary key HKLM\Temp. (reg unload won't work; I tried it myself and got Access is denied, but I was able to do it through Registry Editor.)

  • The merged hive HA' is now stored in Ha.hiv.

For more information on the reg command, see http://technet.microsoft.com/en-us/library/cc732643.aspx.

1

Registry operations are actually part of at least the base Windows libraries, if not the NT kernel itself.

The only official method of merging keys into hives on a binary level lies there. Microsoft to my knowledge has not released to the public how this works. Any such documentation I believe is the result of reverse engineering.

And it's really stupid to rely on the binary level format of the registry to accomplish something that can be done without knowing the implementation details, since Microsoft may amend or completely change the format at any time, since it has exclusive control of the format.

There is probably many third party tools that manipulate the registry. I would not rely on them except in a desperate situation (i.e. changing local Admin password if you have no other recourse to get into a system), experimentation, or if you know your software is 100% tied to a specific Windows version - simply because of the fact you do not know what Microsoft will do with the proprietary format in the future. Microsoft provides the implementation-agnostic registry APIs for a reason.

1
  • Technically the registry is implemented in the "Cm" (configuration manager) branch of the executive. All supported registry operations are available through the RegXxx APIs. These are base Windows APIs. A simple program or PowerShell script could iterate through the two keys and perform the requested "merge". That should work fine for the keys and values. There may be a problem, though, with security descriptors, as non-well-known security IDs from system B will not have obvious mappings in A's security domain. If the two systems are in the same security domain this is a non-issue. Mar 6, 2018 at 15:32

Not the answer you're looking for? Browse other questions tagged .