COMPONENTS Hive

Discussion in 'Windows 8' started by KNARZ, Oct 10, 2013.

  1. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    867
    451
    30
    #1 KNARZ, Oct 10, 2013
    Last edited by a moderator: Apr 20, 2017
    I have several questions about the structure of the COMPONENTS Hive.

    In case you don't know what I'm talking about:
    Code:
    HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components
    Can someone explain me what some prefixes and Values are within some Windows-Component?

    Prefix:
    !i%componentid%
    !p%componentid%
    !s%componentid%
    !f means file

    I guess !c means something like the included/containing component(s).

    Values:
    CF ?? - most of the time it's 12 / 0xC
    Difference between appid and identity (one of them is present)

    S256 I guess is a hash.


    I appreciate any help.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    867
    451
    30
    Just curious: does someone know a more internal Windows Board? where I may can ask my questions?!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Myrrh

    Myrrh MDL Expert

    Nov 26, 2008
    1,388
    491
    60
    #3 Myrrh, Oct 11, 2013
    Last edited: Oct 12, 2013
    Once you get past the wanna-be pirates and leeches, this board has got some of the best expertise I've found anywhere.

    I do not see HKLM\COMPONENTS in my registry at all. How are you seeing it?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. hb860

    hb860 MDL Addicted

    May 7, 2010
    990
    1,776
    30
    I do not have that subkey too
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    7,377
    22,956
    240
    #5 abbodi1406, Oct 12, 2013
    Last edited by a moderator: Apr 20, 2017
    you have to load the hive from path:
    Code:
    %systemroot%\System32\config\COMPONENTS
     
  6. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    867
    451
    30
    #6 KNARZ, Oct 14, 2013
    Last edited by a moderator: Apr 20, 2017
    (OP)
    I'm sorry I looked within my Win8 VM and took Win7 as reference. It could be possible that COMPONENTS isn't loaded regular within Win8. In Win7 it seems it always is loaded by default.

    Select/Highlight HKLM and than select "Load Structure" (hopefully translated right) and go to
    Code:
    %systemroot%\System32\config\COMPONENTS
    to load the hive.

    I admit here are very talented guys (Bob65536, kost, Daz and many more) but unfortunatly thoose guys (at least two of them) abandon this forum. My tries to get more in touch with SPP and some other stuff are become all dead end. Missunderstandings, no time / busy and so on are obviously more present than ever... - completly comprehensible

    Myrrh is damn right... and I know my question aren't regular ones but I try to proof some (very) interessting points. I'm not a coder/programmer/debugger (unfortunatly) and it frustrades me that I can't go any further without help from others. (I don't have the skills) I need some more inside information to get on going...
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. b0g8n

    b0g8n MDL Novice

    Dec 11, 2013
    1
    0
    0
    #7 b0g8n, Dec 11, 2013
    Last edited: Dec 11, 2013
    Under Windows 8.1 Enterprise, this subkey seems to exist (found during a RegShot comparison sourceforge.net/projects/regshot/ ) but it was not visible with RegEdit nor RegEd32...
    Are those subkeys volatile??

    It also seems to be a different presentation of the data stored into HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
    ...not sure!
     
  8. buyerninety

    buyerninety MDL Novice

    Oct 24, 2013
    10
    1
    0
    Passing references made to;
    HKLM\COMPONENTS
    (in e.g.Vista, Win7, WinPE X64... )
    msfn.org/board/topic/150610-7customizer-components-xml/?view=findpost&p=990698
    msfn.org/board/topic/49103-alternative-to-cmdow-hid/?view=findpost&p=736778
    msfn.org/board/topic/98193-constant-error-messages/?view=findpost&p=665591
    msfn.org/board/topic/114372-sigma-tel-driver-blocking-vista-sp1-update/?view=findpost&p=750248