Home ยป How to merge Windows registry hives directly without converting them to an intermediate text based file? [closed]

How to merge Windows registry hives directly without converting them to an intermediate text based file? [closed]

Solutons:


You can merge these hives by loading them into a temporary key in the registry itself and copying one hive over the other using the reg command.

Considering the nature of the question, please note that I am not liable for any damages that may arise as a result of the use of this answer. For more information, see the Stack Exchange Network Terms of Service.

I actually tested these commands myself on a Windows 7 machine using dummy data, without changing any existing data in the registry, so they should work. I am making the assumption that the registry hive files are supplied to you; if they aren’t, you’ll probably need to obtain them by booting into a Linux live CD and retrieving the files from computers’ hard drives. I couldn’t export them on a live system through reg save on an elevated command prompt, getting little more than Access is denied errors.

If the hives are supplied as more than one file per computer, and they need to be operated upon as a single unit, you’ll need to load and merge them in the registry using the same techniques discussed henceforth, on the keys corresponding to the computer from which the hive files are derived, before copying computer B’s complete hives onto computer A’s. Otherwise, you can merge each hive individually using the following procedure.

  • Assume that hive HA is stored in file Ha.hiv and hive HB is stored in file Hb.hiv. Begin by creating a key HKLMTemp using Registry Editor, then load HA and HB into this temporary key on either computer using these commands in an elevated command prompt:

    reg load HKLMTempHa Ha.hiv
    reg load HKLMTempHb Hb.hiv
    
  • Copy the contents of HB into HA, overwriting any existing keys and values:

    reg copy HKLMTempHb HKLMTempHa /s /f
    
  • Unload the registry hive files using Registry Editor by selecting the Ha key, choosing Unload Hive under the File menu, and repeating the same for Hb. You can then delete the temporary key HKLMTemp. (reg unload won’t work; I tried it myself and got Access is denied, but I was able to do it through Registry Editor.)

  • The merged hive HA‘ is now stored in Ha.hiv.

For more information on the reg command, see http://technet.microsoft.com/en-us/library/cc732643.aspx.

Registry operations are actually part of at least the base Windows libraries, if not the NT kernel itself.

The only official method of merging keys into hives on a binary level lies there. Microsoft to my knowledge has not released to the public how this works. Any such documentation I believe is the result of reverse engineering.

And it’s really stupid to rely on the binary level format of the registry to accomplish something that can be done without knowing the implementation details, since Microsoft may amend or completely change the format at any time, since it has exclusive control of the format.

There is probably many third party tools that manipulate the registry. I would not rely on them except in a desperate situation (i.e. changing local Admin password if you have no other recourse to get into a system), experimentation, or if you know your software is 100% tied to a specific Windows version – simply because of the fact you do not know what Microsoft will do with the proprietary format in the future. Microsoft provides the implementation-agnostic registry APIs for a reason.

Related Solutions

Why not use “which”? What to use then?

Here is all you never thought you would ever not want to know about it: Summary To get the pathname of an executable in a Bourne-like shell script (there are a few caveats; see below): ls=$(command -v ls) To find out if a given command exists: if command -v...

Split string into Array of Arrays [closed]

If I got correct what you want to receive as a result, then this code would make what you want: extension Array { func chunked(into size: Int) -> [[Element]] { return stride(from: 0, to: self.count, by: size).map { Array(self[$0 ..< Swift.min($0 + size,...

Retrieving n rows per group

Let's start with the basic scenario. If I want to get some number of rows out of a table, I have two main options: ranking functions; or TOP. First, let's consider the whole set from Production.TransactionHistory for a particular ProductID: SELECT...

Don’t understand how my mum’s Gmail account was hacked

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone...

What is /storage/emulated/0/?

/storage/emulated/0/Download is the actual path to the files. /sdcard/Download is a symlink to the actual path of /storage/emulated/0/Download However, the actual files are located in the filesystem in /data/media, which is then mounted to /storage/emulated/0...

How can I pass a command line argument into a shell script?

The shell command and any arguments to that command appear as numbered shell variables: $0 has the string value of the command itself, something like script, ./script, /home/user/bin/script or whatever. Any arguments appear as "$1", "$2", "$3" and so on. The...

What is pointer to string in C?

argv is an array of pointers pointing to zero terminated c-strings. I painted the following pretty picture to help you visualize something about the pointers. And here is a code example that shows you how an operating system would pass arguments to your...

How do mobile carriers know video resolution over HTTPS connections?

This is an active area of research. I happen to have done some work in this area, so I'll share what I can about the basic idea (this work was with industry partners and I can't share the secret details ๐Ÿ™‚ ). The tl;dr is that it's often possible to identify an...

How do I change the name of my Android device?

To change the hostname (device name) you have to use the terminal (as root): For Eclair (2.1): echo MYNAME > /proc/sys/kernel/hostname For Froyo (2.2): (works also on most 2.3) setprop net.hostname MYNAME Then restart your wi-fi. To see the change, type...

How does reverse SSH tunneling work?

I love explaining this kind of thing through visualization. ๐Ÿ™‚ Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part...

Difference between database vs user vs schema

In Oracle, users and schemas are essentially the same thing. You can consider that a user is the account you use to connect to a database, and a schema is the set of objects (tables, views, etc.) that belong to that account. See this post on Stack Overflow:...

What’s the output of this code written in java?

//if you're using Eclipse, press ctrl-shift-f to "beautify" your code and make it easier to read int arr[] = new int[3]; //create a new array containing 3 elements for (int i = 0; i < 3; i++) { arr[i] = i;//assign each successive value of i to an entry in...

How safe are password managers like LastPass?

We should distinguish between offline password managers (like Password Safe) and online password managers (like LastPass). Offline password managers carry relatively little risk. It is true that the saved passwords are a single point of failure. But then, your...

Can anyone tell me why this program go to infinite times?

while (i <= 2) { while (i > 0) { a = a + b; i--; <- out the inner while loop when i = 0 } printf("%d", a); i++; <- at here, the i==0 each time, so infinity loop } Because your nested loop always restores the value of i to 0, And 0 <= 2 is always...

How to conditionally do something if a command succeeded or failed

How to conditionally do something if a command succeeded or failed That's exactly what bash's if statement does: if command ; then echo "Command succeeded" else echo "Command failed" fi Adding information from comments: you don't need to use the [ ... ] syntax...

How to turn JSON array into Postgres array?

Postgres 9.4 or newer Obviously inspired by this post, Postgres 9.4 added the missing function(s): Thanks to Laurence Rowe for the patch and Andrew Dunstan for committing! json_array_elements_text(json) jsonb_array_elements_text(jsonb) To unnest the JSON array....