Why is raw reg editing so difficult?

At the beginning when I early proposed myself to have a way to overcome the dreaded UAC limitation from Vista that kept registry hives away from the registry for users without Administration permission I already knew this would be a difficult task.

But heck, the difficulty level to make an organized framework capable of writing registry hives in the same compatible manner as Windows API is an unimaginable exercise of commitment to endure all the frustration and time spent debugging and trying to figure why some things work while others won't.

I've had some thoughts about quiting on this crazy goal and just let things as they are at the present - a mistery regarding how it works entirely.

But when I'm just about as tired as one can get after hours staring at an hex editor, a pascal compiler and a command prompt I get angry at myself for letting time pass without visible results of evolution and suddenly get enough energy to organize myself again.

Take a walk, breath deeply and grab a white clean page of paper (recycled paper that is).

I decide to write down the things that I already know about a given registry operation and then imagine how it should behave to get the results that I need.

This task is lengthy and tedious because unlike raw registry readers, a registry writer needs to have a well defined framework of functions that need to be heavily tested otherwise our results may collapse like a castle build with cards that is suddenly blown away by the wind.

One white paper page is not enough - another page starts to be written.

The writings don't make much sense so I work harder to write them with a better calligraphy and structure the main functions or goals onto separate groups to later combine them together.

I start writing new code on the compiler. It's so difficult to know exactly if I'm coding things right as sometimes there is simply no way of debugging the results until we reach the end of proposed function to be able to check the results.

I compile the code, apply the changes to a single registry key (always the same key..) and open it immediately with the hex editor. Then I try to load the modified hive onto the windows registry using the command line and reg.exe

A message saying something like "Your hive is broken but we fixed it!" quickly appears to my dispair.

Time to go back onto the hex editor where we loaded the modified hive just before it was modified by the windows reg.exe and compare the differences between a clean copy of the hive against the one modified by the custom editor.

Some bytes don't appear on the right location, where can this error be going?

Go back to the compiler, add several ShowMessage dialogs that try to output as best as possible the results of each operation, I write down to paper these results in the hope to spot any incongruence with what the natural sequence ought be.

One byte mentioning the location of a new valuelist key is not being written on the correct location and is overwriting the hive header at 0x0000 position - I deduct that no offset is being passed to this key so head back to the compiler to analyze the code and see why may this offset be set as null instead of pointing to the location of the newly created cell.

Another hour passes and my progress is short to say the least. By instinct, I think it's time to get away from the table and do something else for a few minutes. This helps me to focus better as I return and once again read my proposed goal written on paper and challenge the quality of my own code once again in the endless hope of finding our weak point where the code is failing.


Suddenly, I look on the watch and notice that it's a bit over midnight, time to get some sleep so I quit working and write down some notes for reminding myself where the work was left off in order to keep moving on the right direction and avoid losing time to understand what was done on the previous day.

----------

This is a very resumed description of my typical day while working on the registry editor - it's been like this for a whole week now and I'm quite honestly reaching a point of exhaustion due to the amount of work and focus required for making progress at such slow rate.

Yet, I am making progress.

Little by little my own raw codings do speak the same language as windows registry API. At the end of each tiresome day I can say (for the most cases) that I'm happy to have solved something that took me hours of testing. Eventually fall asleep thinking to myself: "Tomorrow I'll try to move that other step still missing, it's not far to get it working now".


In a week I have gone from the point where I superficially understood how the registry could be modified all the way to a state where all code needed to be rewritten from scratch simply because I understood this wasn't efficient enough in order to survive the upcoming complexity of more elaborate registry functions for creating new keys, modifying titles/values, etc.

Eventually I hope this effort on a good base becomes a good working structure for the next goals.

---

Today was not different from other days.

I'm happy because over the last three days I've sought to write a title to a value in the cases where the title is bigger than it will fit on the original cell using an efficient framework organization in opposition to raw writing the hive as if it was a "hack" of some sort.

Goal achieved, no time to lose because the next goal is already outlined on the white paper page..


:)

No comments:

Post a Comment