[jds]

loblo, on 06 September 2012 - 09:25 AM, said:

jds, on 06 September 2012 - 04:01 AM, said:

As for RegExport, alas, I've seen a few other utilities with this capability, which as I've stated above, can be done quite satisfactorily with 'regedit'. Now, if he'd written an import utility, I'd consider that a "must have".

Joe.

You can't export reg files from a backed up registry dat file with regedit AFAIK.

RegExport is a great free tool and unique in its features. Besides letting you see differences between the live registry in ram with dat files or exporting from dat backups to selectively restore something you can use it to check out if you you've got a rootkit in the startup keys (run, runonce, etc...) for example.

I am not aware of an other tool that lets you do that besides its big brother RegDat and I am nearly 100% sure that no other free tool lets you do any of that so it's definitively a must have IMO.

Hi loblo,

Regarding 9X 'regedit', it can work with backed-up DAT files as follows :
REGEDIT [/L:system] [/R:user] /E filename3 [regpath1]
where :
/L:system Specifies the location of the SYSTEM.DAT file.
/R:user Specifies the location of the USER.DAT file.
/E filename3 Specifies the file to export the registry to.
regpath1 Specifies the starting registry key to export from. (Defaults to exporting the entire registry).

Now regarding RegExport, if it does have those extra features, then I'll change my mind and agree it's a "must have". I've just downloaded it from http://home.arcor.de...rich/regexp.zip (another download I had found was truncated, useless).

jaclaz, on 06 September 2012 - 10:39 AM, said:

Also (maybe having better capabilities than regedit) good ol' resplendence Reglite:
http://web.archive.o...nce.com/reglite
http://web.archive.o...e.com/downloads

jaclaz

More toys.Thanks jaclaz!

loblo, on 06 September 2012 - 11:59 AM, said:

If we drift into discussing alternatives to regedit I can only praise and recommend the awesome Regmagik
with its jump to CLSID, jump to path in explorer and export of registry shortcuts, not to mention its excellent search tool, etc...

Now shareware but the last free version (3.26.4), which is the one I use, can be found easily.

Sounds very useful, thanks for the tip loblo!

jaclaz, on 06 September 2012 - 12:12 PM, said:

I don't think it is "drifting" is more like trying to provide some alternatives that may (or completely fail to) be functional in solving the problem.

However, let's call this Off TOpic
http://web.archive.o....com/hivetools/

New home:
http://www.filewut.c...tware/hivetools

jaclaz

Another useful looking tip, jaclaz, and (IMHO) definitely not off-topic.

Multibooter, on 10 September 2012 - 08:30 PM, said:

CharlotteTheHarlot, on 07 September 2012 - 07:15 PM, said:

At that point I already had located 4 different compiles of RegCompact v1.0. And after today, there are now 6

Hi CharlotteTheHarlot,

1) I checked the 6th file RegCompact.exe (at the bottom of your list, with MD5 fa3f9649f5f5f74b7036a48bcf205d42) with MiTeC EXE Explorer, it has a time stamp of 1-Dec-2000 9:33:06AM, very similar to the file modification date indicated for the 5th file. The time stamp by MiTeC EXE Explorer is more helpful than the file modification date for categorizing the various versions of RegCompact.exe. MiTeC EXE Explorer displays for file #6 in the Strings tab several error messages which were localized into Italian. I would speculate that file #6 is only a modification with a hex editor of file #5, not a new compilation.

You beat me to it, Multibooter!

I checked similarly and entirely agree about your conclusion. It should be possible to use a tool like the venerable BDIFF 1.01 by Morten Grouleff to get a patch that can recover the missing 2000-12-1 edition.

Anyway, I tried the Italian-patched version with the following results :
SYSTEM.DAT 12,943,672 -> 12,902,432
USER.DAT 1,830,944 -> 1,720,352

I was surprised that after some years of installing and uninstalling stuff, I had so little empty space to collapse! Looks like I'll have to do surgery if I want to reduce that registry size.

The patched program worked just fine, so there should be no fears about code pages differences or whatnot. The only thing I had to take care of, is that, like almost all registry tools I've tried, they assume that 'system.dat' and 'user.dat' both live in the %windir% directory. However, if you install W9X on a drive other than C:, you end up with 'system.dat' on C: drive (in the %winbootdir% directory) and 'user.dat' on the main W9X drive (in the %windir% directory).

Joe.

[Multibooter]

Multibooter, on 10 September 2012 - 08:30 PM, said:

3) I have come across a 7th version on the mule, it has MD5 3D5DF950B2DCAE3B886C4FC625A4F512...This 7th version is a derivative of the file #2, with some error messages patched with non-Western characters.

I have checked files #2,3,4,6 and 7 with dencorso's VRFYPE of 24-Jun-2012 (old version) http://www.msfn.org/...ost__p__1002255 All files have the same header checksum 00000000, so in the case of RegCompact.exe VRFYPE (old version) cannot be used to identify a PE file as patched

@dencorso:
Your new version of VRFYPE of 26-Jul-2012 http://www.msfn.org/...ost__p__1005197 with the switch /0 or /z displays only "No files found!" for files #2,3,4,6 and 7. If you find the time to fiddle around with VRFYPE, could you increment the version number?

This post has been edited by Multibooter: 11 September 2012 - 08:43 AM

[loblo]

jds, on 11 September 2012 - 03:07 AM, said:

Hi loblo,

Regarding 9X 'regedit', it can work with backed-up DAT files as follows :
REGEDIT [/L:system] [/R:user] /E filename3 [regpath1]
where :
/L:system Specifies the location of the SYSTEM.DAT file.
/R:user Specifies the location of the USER.DAT file.
/E filename3 Specifies the file to export the registry to.
regpath1 Specifies the starting registry key to export from. (Defaults to exporting the entire registry).

Ah, I didn't know that, thanks!

[dencorso]

Multibooter, on 11 September 2012 - 08:42 AM, said:

@dencorso:
Your new version of VRFYPE of 26-Jul-2012 http://www.msfn.org/...ost__p__1005197 with the switch /0 or /z displays only "No files found!" for files #2,3,4,6 and 7. If you find the time to fiddle around with VRFYPE, could you increment the version number?

Please give me links to those files, so that I'll be able to see what's happening, and then I'll gladly do it.
BTW, does it find the files with /g or /a? /a should give sort of the same output as the older version...

[Multibooter]

Hi dencorso,
Sorry for the mix up. I had copied VRFYPE (27Jul2012) to the folder containing the various files RegCompact_x.exe, and then ran VRFYPE without a file parameter <filespec>, like "*.*":
> vryfype
or >vrfype /a

This resulted in no files being listed, the same for running
> vrfype *.*
without indicating an option parameter </option>

When running VRFYPE with both parameters entered, everything was Ok:
vrfype *.* /a

Maybe in the next version of of VRFYPE you could use "/a" as default parameter if no </option> parameter was entered, and "*.*" if no <filespec> parameter was entered. BTW the parameter "/s" [for checking all sub-folders] is still on my wish list down the line, even if there is a workaround, as you suggested in http://www.msfn.org/...ost__p__1006128 , but adding such a /s switch looks like a major undertaking. VRFYPE is an excellent program, with many potential uses.

Here the screen output by VRFYPE (27Jul2012), sent to a text file vrfype.txt, when entering in a Win98SE DOS window:
>vrfype *.* /a >vrfype.txt


VrfyPE v1.0 Freeware by dencorso, 2012


.\RegCompact_2.exe => Cheksums: Header = 00000000 Real = 000132DC Zero in header!
.\RegCompact_3.exe => Cheksums: Header = 00000000 Real = 000162F4 Zero in header!
.\RegCompact_4.exe => Cheksums: Header = 00000000 Real = 0001BCD9 Zero in header!
.\RegCompact_unpacked_6.exe => Cheksums: Header = 00000000 Real = 0001887F Zero in header!
.\RegCompact_7.exe => Cheksums: Header = 00000000 Real = 00014227 Zero in header!
.\VRFYPE.EXE => Cheksums: Header = 0000431C Real = 0000431C

BTW, when ">vrfype *.* /a >vrfype.txt" is run in a WinXP command prompt window, an identical .txt file is generated, except that the last line has the file extension in small letters:
.\VRFYPE.exe => Cheksums: Header = 0000431C Real = 0000431C