16.4 The Registry

The Windows NT Registry is a database that stores all sorts of information about your system. It includes operating system and hardware information, file extension associations, environment information, application information, and much more. In addition to being used heavily by the operating system, most Win32 applications keep registration and state information in the Registry. If you've never taken a look at it before, you really ought to run the regedit.exe (or regedt32.exe) utility included with your system and take a look at what the Registry contains. For a detailed programmer's reference to the Windows 95 Registry, you might try Ron Petrusha's Inside the Windows 95 Registry, published by O'Reilly & Associates.

Many operating system and application behaviors are controlled by Registry data; therefore, one of the most valuable tools an administrator can have at his disposal is an efficient way to update Registry data. Enter Perl's Win32::Registry package, which provides a powerful interface to the Registry. This package lets you retrieve information from the Registry, as well as add new information and modify or delete existing information.

A strong word of caution is in order before we begin. The Registry contains vital system data and you could render your system inoperable by deleting or changing Registry information. Before modifying the Registry, make certain that you have a good backup of your entire Registry. The exercises in this chapter will only read data or write to harmless areas of the Registry, but taking precautions is still a good idea. To make a backup, use the regedit utility included with your system.

16.4.1 The Registry Structure

The Registry is organized into four main subtrees of keys that contain machine and user data. Each subtree is organized into clusters of keys called hives (by analogy to the cellular structure of beehives). A hive is a collection of keys, subkeys, and values that is rooted at the subtree. For example, one of the Registry subtrees, as shown in Figure 16.1, is HKEY_LOCAL_MACHINE, which contains information about the local machine and the software installed on it. The hives under HKEY_LOCAL_MACHINE are HARDWARE, SAM, SECURITY, SOFTWARE, and SYSTEM.

Each registry key can have data items called values, or additional child keys called subkeys. Some users like to think of this in terms of a filesystem: keys are similar to directories and values are similar to files.

Figure 16.1: Sample Registry

Table 16.1 details the four main subtrees of the Registry, and a general description of what each one is used for.

Table 16.1: Sample Registry Subtrees

Registry Subtree	Description
HKEY_LOCAL_MACHINE	Contains information about the local computer, including information about the hardware and operating system
HKEY_CLASSES_ROOT	Contains OLE and file association information
HKEY_CURRENT_USER	Contains user profile information for the currently logged-on user including environment, desktop, and preference settings
HKEY_USERS	Contains all actively loaded user profiles (including HKEY_CURRENT_USER) and default user profile information

The Win32:Registry package creates an instantiated registry key object[2] for each of these subtrees, so you can open keys relative to these trees.

[2] See Chapter 18, CGI Programming, for a discussion of Perl objects.

The Registry can contain several different data types including strings, dwords (unsigned four-byte integers), unicode strings, expanding strings (e.g., environment variables that rely on the value of another environment variable), binary data, and more. Win32::Registry defines constants (in the form of subroutines) for these values. Table 16.2 gives some of the most useful constants.

Table 16.2: Win32::Registry Constants

Win32::Registry Constant	Data Type
REG_SZ	String Data
REG_DWORD	Unsigned four-byte integer
REG_MULTI_SZ	Multiple strings, delimited with NULL
REG_EXPAND_SZ	Strings that expand (e.g., based on environment variables)
REG_BINARY	Binary data (no particular format is assumed)