[Answered] Correct syntax for REG_EXPAND_SZ value

Discussion in 'Scripting' started by Mr.X, Oct 6, 2022.

  1. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    #1 Mr.X, Oct 6, 2022
    Last edited: Oct 6, 2022
    Question about appropriate syntax.

    I have the following subkey
    KEY_CLASSES_ROOT\batfile\shell\edit\command

    if I want to add via .reg file the following REG_EXPAND_SZ value:
    "E:\notepad++\notepad++.exe" "%1"

    then how the line is written (syntax) in the reg file?
     
  2. AveYo

    AveYo MDL Expert

    Feb 10, 2009
    1,836
    5,694
    60
    .reg files are useless / too cryptic for REG_EXPAND_SZ, as the entries must be added in hex(2) notation:
    Code:
    [HKEY_CLASSES_ROOT\batfile\shell\edit\command]
    @=hex(2):22,00,45,00,3a,00,5c,00,6e,00,6f,00,74,00,65,00,70,00,61,00,64,00,2b,\
      00,2b,00,5c,00,6e,00,6f,00,74,00,65,00,70,00,61,00,64,00,2b,00,2b,00,2e,00,\
      65,00,78,00,65,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00
    So use the GUI or reg.exe to add such entries.

    But there's no reason why you could not use a normal REG_SZ instead. Just escape " and \
    Code:
    [HKEY_CLASSES_ROOT\batfile\shell\edit\command]
    @="\"E:\\notepad++\\notepad++.exe\" \"%1\""
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    @AveYo thanks a lot buddy!

    Prior to read your comment I was fiddling with regedit and Nirsoft's FileTypesMan, I notice the same syntax
    [HKEY_CLASSES_ROOT\batfile\shell\edit\command]
    @="\"E:\\notepad++\\notepad++.exe\" \"%1\""

    Amazing LOL

    Could you explain or elaborate a bit more about why this strange syntax?
     
  4. "HKCR" is a dependency of "HKLM\SOFTWARE\Classes" in offline image so we can achieve every reg tweak we did on current installed os via offline image reg load \ reg unload too.

    I use it to integerate startisback to offline image works intact with inbox app startmenuhost removed offline :)
     
  5. AveYo

    AveYo MDL Expert

    Feb 10, 2009
    1,836
    5,694
    60
    Nothing strange about it, it's standard C strings escaping rules - " must be escaped by preceding with \ and \ by itself must be doubled.
    As for the hex(2) notation, that's just the raw unicode characters in hex (22,00 = " 45,00 = E 3a,00 = : and so forth).
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...