Multiple Backslashes in File Paths.
This one was inspired by a problem seen here and IMHO is very much worth checking for in your own registry. I suggest a careful audit of your exported registry in a text editor to accomplish this. You need to pay attention to the convention that a text editor uses for searching particular characters. For example, PFE32 ( Programmer's File Editor ) itself uses the backslash character as a control code which makes searching for backslashes double the fun.
Escaping REGEDIT
Backslashes (
\ ) are historically used to demark directories in DOS are obviously also used in the registry to demark keys and in string values for file paths plus other things. The backslashes used in file paths are exported to registry text files doubled up (
\\ ). This is so that when they are re-imported into REGEDIT they get interpreted correctly. It can be very confusing since the same character serves two purposes, but is understandable if you just think of (
\\ ) as not really being two backslashes, but in actuality an "escape" character followed by a backslash, which means to REGEDIT ( or any other program using the same convention ) that when it sees an "escape" to enter the following character literally. This escape function is active for data being entered as strings which are signified by surrounding quotes. Both "quotes" and "backslashes" that are to be used within a string should be preceded with an "escape character". Therefore (
\" ) simply means escape quote and (
\\ ) means escape backslash. What happens literally is that when REGEDIT is importing or exporting the registry, and it encounters a quote ( " ) it slips into "string mode" and stays there until it sees the next non-escaped quote ( " ). All the quotes and backslashes that it encounters in between those two bookends get escaped when exporting, and require escapes when importing.
The main rule to remember is that when processing registry values through the REGEDIT interface via dialog boxes, you need to always enter them exactly as intended with single backslahes, but NO doubles. When editing an ASCII or Unicode registry text file you DO need to double them up and also pay careful attention to quotes since that is the single most powerful delimiter character and is treated in pairs ( open and close ). Everything in between the pair is a text string that requires careful escaping of its own quotes and backslashes. Note that within the open and close quotes that there is no requirement for an even number of quotes, but they must be escaped correctly.
Here is an actual example string taken from that referenced link above ...
@="\"C:\\Windows\\Printdir.bat\" \"%1\"" ... what gets fed into REGEDIT from a REG script
@="\"C:\\Windows\\Printdir.bat\" \"%1\"" ... escaped quote chars shown in red, backslashes in blue
"C:\Windows\Printdir.bat" "%1" ............. this is what is actually inserted in the registry
Be Careful with Text Editors
Quotes can cause havoc with text editors that provide colors and highlighting through syntax recognition, especially when browsing registry text files. The algorithm that identifies strings is rarely as smart as REGEDIT and merely counts the quotes up and highlights them according to pairing. So in the case of an open and close quote that contains an odd number of quotes within it, the editor syntax highlighting breaks down and it gets ugly ( at least until another case of odd number of quotes is encountered ). The point here is that any out-of-sync syntax highlighting you see does NOT necessarily indicate an error in the data strings. This will roughly approximate how they go out of sync, but keep in mind that there are no errors here at all ...
|----------------------------------------------|
" String Value with \" 1 ...interior ...quotes " Here is some following data.
" String Value with \" 2 \" interior ...quotes " Here is some following data.
" String Value with \" 3 \" interior \" quotes " Here is some following data.
Bogus REGEDIT Backslashes
If everything is done properly within REGEDIT you will never see a case of a file path within a string utilizing double ( or more ) backslashes. But things can go awry via several avenues.
The most common way to mess this up is in the situation of entering string data directly into a REGEDIT dialog box using the escaped formatting designed a REG text file. As mentioned above, this is incorrect! When entering string data into a dialog box it is NOT escaped, it requires the single backslash for paths. This error happens when someone finds a registry patch ( meant for a REG text file ) on the Internet and they jump into REGEDIT and paste it in.
Here is the problem: now you will have doubled backslashes and backslashed quotes that are sitting in the registry and when a program reads that registry value, the registry API supplies the contents literally as doubled backslashes and backslashed quotes and the program most likely will throw up an error ( if you're lucky ) or do nothing at all. The error that you encounter might be of absolutely no value to debugging either. It could say
File Not Found or
Path Not Found or almost anything else, and none of these will likely send you into REGEDIT to delete a single extra character.
Another error method occurs because of setup programs that have mistakes in their programming or perhaps in an associated INF file. This is something I find all the time as I'll show a few actual examples below.
Finding Errors
So it makes pretty good sense to periodically search for four consecutive backslashes
\\\\ in a registry export, or two
\\ if you are using the FIND function in REGEDIT. I'm doing the former here.
However there is a very
important caveat ... remember that many times it is perfectly normal for multiple backslashes to appear in the registry in data values. For example in UNC path URLs like
"uNCName"="\\\\ComputerName\\etc ( this is literally
\\ComputerName\etc ). These are commonly used in the PnP section for USB and other devices, for example
"SymbolicLink"="\\\\?\\. These
must be skipped over when you search for anomalies ( except if for some strange reason it had 6 or 8 backslashes for example ). Anyway, the trick is to zero in on actual paths into the file system because these can have immediate consequences to a program that reads that data.
After completing an audit on a WinXP machine here are actual errors I found. I suspect others will also see these or similar entries. Note that I case-corrected everything here for better legibility but it has no consequence to registry operation as these are case insensitive ...
;;; Java ( Web Start Launcher )
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26a24ae4-039d-4ca4-87b4-2f83216030ff}]
"DisplayIcon"="C:\\Program Files\\Java\\Jre6\\\\Bin\\Javaws.exe"
;;; Real Player
[HKEY_LOCAL_MACHINE\Software\Classes\Software\RealNetworks\RealMediaSDK\6.0\Preferences\ExternalResourcesDirectory]
@="C:\\Program Files\\Common Files\\Real\\Plugins\\\\ExtResources"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RealPlayer 6.0]
"UninstallString"="C:\\Program Files\\Common Files\\Real\\Update\\\\Rnuninst.exe RealNetworks|RealPlayer|6.0"
;;; Shockwave Flash
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shockwave]
"QuietUninstallString"="RunDll32 Advpack.dll,LaunchInfSection C:\\Windows\\\\Inf\\\\Swdir.inf,DefaultUninstall,5"
;;; seen on WinXP from unknown installer, WbemSnmp.log currently is blank!
[HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Providers\Logging\WbemSnmp]
"File"="C:\\Windows\\System32\\Wbem\\Logs\\\\WbemSnmp.log"
;;; VBA ( Visual Basic for Applications ) installs with certain suites like Corel
[HKEY_LOCAL_MACHINE\Software\Classes\AWfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\ELMfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFAfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFLfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFTfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFXfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\OPCfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\STFfile\DefaultIcon]
@="C:\\Windows\\Installer\\\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
NOTES: Many of these look like they will effectively disable those commands from ever executing, so they are errors of consequence. Both the Real Player and Flash Player screwups look like their UNINSTALLER cannot ever execute. That empty WBEM log file is almost certainly a consequence of that messed up registry entry. That set of keys from VBA means no icon will ever show for those filetypes ( thanks to its overly complicated MSI installer procedure ). All of these are manufacturer mistakes, their programmers messed it up in the installer most likely.
Fortunately it is easily fixed. Here is the simple "correcter" I ran to clean these up ...
;;; correcter
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26a24ae4-039d-4ca4-87b4-2f83216030ff}]
"DisplayIcon"="C:\\Program Files\\Java\\Jre6\\Bin\\Javaws.exe"
[HKEY_LOCAL_MACHINE\Software\Classes\Software\RealNetworks\REalMediaSDK\6.0\Preferences\ExternalResourcesDirectory]
@="C:\\Program Files\\Common Files\\Real\\Plugins\\ExtResources"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RealPlayer 6.0]
"UninstallString"="C:\\Program Files\\Common Files\\Real\\Update\\Rnuninst.exe RealNetworks|RealPlayer|6.0"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Shockwave]
"QuietUninstallString"="RunDll32 Advpack.dll,LaunchInfSection C:\\Windows\\Inf\\Swdir.inf,DefaultUninstall,5"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Providers\Logging\WbemSnmp]
"File"="C:\\Windows\\System32\\Wbem\\Logs\\WbemSnmp.log"
[HKEY_LOCAL_MACHINE\Software\Classes\AWfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\ELMfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFAfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFLfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFTfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\FFXfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\OPCfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
[HKEY_LOCAL_MACHINE\Software\Classes\STFfile\DefaultIcon]
@="C:\\Windows\\Installer\\{db81779e-7cc5-4630-bcfc-754004956444}\\Misc.exe,6"
+++ Originally Posted on 2013-03-14
This post has been edited by CharlotteTheHarlot: 14 March 2013 - 08:00 PM