Jump to content

Aplication execution order in 'RUN' registry


Comos

Recommended Posts

Hi everyone,

just one to ask, what is the execution order in registry setting HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ?

Is it exactly as it is listed in registry , that means alphabeticly sorted? I was dealing with curious thing that my QuickLaunch 95 tool under Win95OSR2 causes the Explorer.exe to crash after bootup.

I created in the registry new text variable and moved QuickLaunch95 execution at the end of the list and it worked fine now.

Mateus

Link to comment
Share on other sites


Useful info?

edit - found via google search:

"execution order" "Windows\CurrentVersion\Run"

It seems to me like the OP asked a slightly different question :unsure: , i.e. something like:

Set aside the other ways to have something run, WITHIN the programs listed in "Windows\CurrentVersion\Run" and LIMITED to them ONLY, in which order are the programs loaded?

which the given link also answers :), but that was seemingly partially wrongly understood :ph34r: as there are actually TWO "Windows\CurrentVersion\Run", one under HKEY_CURRENT_USER and one under HKEY_LOCAL_MACHINE and BOTH are not within the items said to run entries alphanumerically:

.....

After Logon

3) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

5) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

6) WIN.INI [Windows] Load

7) WIN.INI [Windows] Run

8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup

11) C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup

12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

13) As a Scheduled Task set to run at startup.

[[startups in groups 6 to 11 all run at the same time (more or less).

However, the groups themselves are triggered in the order shown above. In

other words, the next group can begin launching while the previous group is

still loading its startups. Due to timing issues it is impossible to say

what order these items will finish loading, thus it is impossible to

predict the exact order of execution for individual startups. For instance,

you may notice two or more system tray icons changing position with each

boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order, as

some programs take longer than others to load, and synchronous groups can

overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order in 10 and 11 by moving the items from 11 to 10. Also, you can rename the shortcuts in 10 and/or 11.

So according to the mentioned post there is no way to determine the order of items in 8) or 9) ....

as while it is possible to *somehow* give a loading order to:

10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup

11) C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup

it is not possible to give one to:

8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

If the scope is to assign a given order of loading I think that the solution is using a third party app, such as (example) oolauncher:

http://oolauncher.deskangel.com/

jaclaz

Link to comment
Share on other sites

Long story short, during bootup that registry key will be read sequentially. The items will be executed in the order that they physically exist within the registry database. That physical order is determined by the sequence they were entered in the registry.

The order that you see while looking at the RUN key through the REGEDIT GUI is only cosmetic (notice that there are sortable columns there in the GUI also). If you want to learn the true physical order that they are stored (and thus will be executed) you will want to export the RUN key and look at in a text editor.

For example, let's say you have an empty RUN key and import the following (as you are no doubt aware, REGEDIT4 precedes these commands, they're left out for brevity) ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"="Calc.exe"

"2"="Notepad.exe"

Not surprisingly, REGEDIT will show that exact order in its Window, and if you export that key the listing will show that order as well. If you restart the computer you will have a CALC and then a NOTEPAD window pop open in that order left to right.

Now let's clear those two with a script (you can just delete them manually in the GUI if you want) ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"=-

"2"=-

... And now re-enter them in opposite order ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"2"="Notepad.exe"

"1"="Calc.exe"

Now REGEDIT will not show that order (it will look exactly like the first one above), but if you export that key the listing will show the correct order with "2" preceding "1". If you restart the computer you will have a NOTEPAD and then a CALC window pop open in that order left to right. The numerical prefixes used as the data value names are not considered when the key is accessed and sequentially read during system startup.

Long story longer, they are using enumeration functions that access registry keys and values without referencing the 'names' first. They essentially map out the items until there are 'NO MORE' and then go back and run them in the order they were enumerated. Many critical Windows registry keys are read this way during bootup. The reason is because many (perhaps most) applications, drivers and services need to be ordered as they often depend on something already being executed before they can work. Think of it as being similar to the way the old AUTOEXEC.BAT or CONFIG.SYS order mattered (and boy did it matter!). So, when a key or value is used in this manner, the 'name' doesn't matter at all and instead of "1" or "2" we could have named them anything we wanted to.

Note: clearing those values first is very important if you are testing this. When an item is entered into the registry, a 'slot' is created and used. The next item gets a later 'slot'. The order these slots are created is what gets picked up during enumeration. If we didn't clear those two slots and ran the 2nd script after immediately the 1st, what would have happened is that the values using the names "1" and "2" would merely have been refreshed (overwritten with the exact same data, first the "2", then the "1", but the slots would still be in the same position as "1" and then "2").

This applies to both Win9x and NT since we are talking about standard Windows API registry functions.

EDIT: made it prettier

Edited by CharlotteTheHarlot
Link to comment
Share on other sites

Not sure if that was the right link (several provide that info) but there was a notation about "randomly" (paraphrased) for those entries and the fact that "someone" unloaded (paraphrased) them, changed the order to suit in the REG file, deleted the REG entries, then reloaded.

I had surmised that the execution would be based upon FIFO, so I have to agree with prior members' assessments of said items.

Link to comment
Share on other sites

That OOLAUNCHER look nice but only for XP.So for my Win9x I'll do the execution order the oldschool way then, export, delete entry, modify order in the reg file and import again.

Thanks for the help guys !

Link to comment
Share on other sites

One way to reverse the execution order without deleting anything would be like this. Assume this exists ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"="Calc.exe"

"2"="Notepad.exe"

... and then we run ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"="Notepad.exe"

"2"="Calc.exe"

We have reversed the order of execution of the programs even though all we really did was rewrite the values within "1" and "2". Those two slots still lie in the same position within the registry, "1" is before "2", but only what is in those fields is what was changed.

A better illustration. Assume the RUN key is empty and we just reserve several sequential locations ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"=""

"This will run 2nd"=""

"This will run 3rd"=""

"This will run 4th"=""

Even though the data fields are empty (value not set), these sequential slots exist and will be enumerated and executed in order (but nothing will happen). Now we just place whatever we like in them ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"="Calc.exe"

"This will run 2nd"="Notepad.exe"

"This will run 3rd"="Mspaint.exe"

"This will run 4th"="Wordpad.exe"

All we did was punch-in some data into the reserved (empty) locations without changing the structure. And we can 're-arrange' the values at anytime, again without actually tampering with the order of the physical 'slots' in the registry structures ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"="Mspaint.exe"

"This will run 2nd"="Wordpad.exe"

"This will run 3rd"="Notepad.exe"

"This will run 4th"="Calc.exe"

Although we are just playing with mere bytes in size here, on a larger scale this can be very advantageous because deleting things in the registry will inevitably cause 'holes' to be created necessitating a quasi-defrag later. The holes can add up and (potentially be a problem on Win9x because of the limitations of large registries in certain circumstances. On Win9x I always used RegCompact and there is NTRegOpt available for NT systems (although it's need is certainly debatable ).

EDIT: typo

Edited by CharlotteTheHarlot
Link to comment
Share on other sites

One way to reverse the execution order without deleting anything would be like this. Assume this exists ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"="Calc.exe"

"2"="Notepad.exe"

... and then we run ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"1"="Notepad.exe"

"2"="Calc.exe"

We have reversed the order of execution of the programs even though all we really did was rewrite the values within "1" and "2". Those two slots still lie in the same position within the registry, "1" is before "2", but only what is in those fields is what was changed.

A better illustration. Assume the RUN key is empty and we just reserve several sequential locations ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"=""

"This will run 2nd"=""

"This will run 3rd"=""

"This will run 4th"=""

Even though the data fields are empty (value not set), these sequential slots exist and will be enumerated and executed in order (but nothing will happen). Now we just place whatever we like in them ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"="Calc.exe"

"This will run 2nd"="Notepad.exe"

"This will run 3rd"="Mspaint.exe"

"This will run 4th"="Wordpad.exe"

All we did was punch-in some data into the reserved (empty) locations without changing the structure. And we can 're-arrange' the values at anytime, again without actually tampering with the order of the physical 'slots' in the registry structures ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"="Mspaint.exe"

"This will run 2nd"="Wordpad.exe"

"This will run 3rd"="Notepad.exe"

"This will run 4th"="Calc.exe"

Although we are just playing with mere bytes in size here, on a larger scale this can be very advantageous because deleting things in the registry will inevitably cause 'holes' to be created necessitating a quasi-defrag later. The holes can add up and (potentially be a problem on Win9x because of the limitations of large registries in certain circumstances. On Win9x I always used RegCompact and there is NTRegOpt available for NT systems (although it's need is certainly debatable ).

EDIT: typo

I had also the idea to just empty the key and correct the order, but that would be a mess when searching for something.Since I can't rename the values I rather delete it all and then modify it like your example 1,2,3,4 and so on.

Link to comment
Share on other sites

I had also the idea to just empty the key and correct the order, but that would be a mess when searching for something. Since I can't rename the values I rather delete it all and then modify it like your example 1,2,3,4 and so on.

This completely clears the key and then rewrites it ...

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"="Calc.exe"

"This will run 2nd"="Notepad.exe"

"This will run 3rd"="Mspaint.exe"

"This will run 4th"="Wordpad.exe"

But that wipes out any other things in there as well so it pays to export the key first to check if there are other things to also restore.

This method just deletes the known items and re-enters them (in new, later 'slots') ...

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"This will run 1st"=-

"This will run 2nd"=-

"This will run 3rd"=-

"This will run 4th"=-

"This will run 1st"="Calc.exe"

"This will run 2nd"="Notepad.exe"

"This will run 3rd"="Mspaint.exe"

"This will run 4th"="Wordpad.exe"

The key to understanding is that for sequential operations it can be looked at as a FIFO stack like submix8c stated (keeping the analogy simple without PUSH, POP and stack pointer manipulation). First-In, First-Out, enumeration sums it up.

You can rename the values (rename a 'slot' without disturbing its location), but only from the REGEDIT GUI. I don't know of any programmatic way, certainly there is none through REGEDIT scripting, but there might be using some commandline tool. Someone else might know.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...