A .reg file is what Registry Editor writes with Export and reads with
Merge. Microsoft describes the syntax only in a support article, KB 310516 (How to
add, modify, or delete registry subkeys and values by using a registration entries
(.reg) file), and names the value types in Registry value types. Details
the article leaves out are taken from Wine’s Registry Editor
(programs/regedit/regproc.c), which reads and writes the same files, and
the type numbers from Wine’s winnt.h; those details describe Wine, not
necessarily Windows.
Header and encoding
| First line | Written by (KB 310516) | Encoding (Wine) |
|---|---|---|
Windows Registry Editor Version 5.00 | Windows 2000, XP and Server 2003 | UTF-16 little-endian, starting with the bytes FF FE |
REGEDIT4 | Windows 98 and NT 4.0; also accepted by later versions | The ANSI code page |
Wine ends lines with CR LF and writes a blank line before each key. When reading it
skips lines starting with ; and allows a ; comment after a
key or value.
Keys and values
[HKEY_CURRENT_USER\Software\Example]
@="Default value"
"Name"="Text with \"quotes\" and a \\ backslash"
"Count"=dword:00000010
"Data"=hex:01,02,03,ff
"Path"=hex(2):25,00,54,00,45,00,4d,00,50,00,25,00,00,00
"Old"=-
[-HKEY_CURRENT_USER\Software\Obsolete][path]starts a key, with the full path from a root key:HKEY_LOCAL_MACHINE,HKEY_CURRENT_USER,HKEY_CLASSES_ROOT,HKEY_USERSorHKEY_CURRENT_CONFIG(Wine also knowsHKEY_DYN_DATA).[-path]deletes the key (KB 310516)."name"=datasets a value of the key above (KB 310516);@=datasets the key’s default (unnamed) value (Wine)."name"=-deletes the value (KB 310516).- In quoted strings Wine writes
\\for a backslash,\"for a double quote, and\rand\nfor carriage return and line feed. - Wine splits long
hexlists over lines: once a line reaches 77 characters it ends with,\and the next continues after two spaces.
Value types
| Number | Type | Written as | Data |
|---|---|---|---|
| 0 | REG_NONE | hex(0): | No defined value type. |
| 1 | REG_SZ | "text" | A null-terminated string; KB 310516: no type prefix needed. |
| 2 | REG_EXPAND_SZ | hex(2): | A null-terminated string with unexpanded environment variable references such as %PATH%, as hex bytes. |
| 3 | REG_BINARY | hex: | Binary data, as comma-separated hex pairs. |
| 4 | REG_DWORD | dword: | A 32-bit number, written by Wine as 8 hex digits. |
| 5 | REG_DWORD_BIG_ENDIAN | hex(5): | A 32-bit big-endian number. |
| 6 | REG_LINK | hex(6): | A null-terminated Unicode string: a symbolic link’s target path. |
| 7 | REG_MULTI_SZ | hex(7): | Null-terminated strings followed by an empty string, so the data ends with two nulls. |
| 8 | REG_RESOURCE_LIST | hex(8): | Resource list (binary). |
| 9 | REG_FULL_RESOURCE_DESCRIPTOR | hex(9): | Full resource descriptor (binary). |
| 10 | REG_RESOURCE_REQUIREMENTS_LIST | hex(a): | Resource requirements list (binary). |
| 11 | REG_QWORD | hex(b): | A 64-bit little-endian number. |
Wine writes every type other than REG_SZ, a 4-byte
REG_DWORD and REG_BINARY as hex(n):
with n in lower-case hexadecimal. In REGEDIT4 files it
converts hex(2) and hex(7) strings to the ANSI code page
rather than UTF-16.