Special characters are being used in the Windows Registry

Paul Black said:

It obviously works if you Export the Registry Key HKEY_CURRENT_USER\Control Panel\International

Not so obviously that my attempt succeeded.
{I changed to a convenient folder beforehand}

Code:

reg export "HKCU\Control Panel\International" "ExportedKey.reg"

or was it

Code:

reg export "HKCU\Control Panel\International\" "ExportedKey.reg"

I'll re-try later.


Denis

Try3 said:

Not so obviously that my attempt succeeded.

I meant, if I Export the Registry Key . . .

Code:

REG Export "HKEY_CURRENT_USER\Control Panel\International" "%UserProfile%\Desktop\Globe_Key.reg"

. . . it outputs the desired Registry Key correctly [ including the special characters ] at the bottom of the file.

I just can NOT Export it on its own !

Copying & pasting your code works.
Comparing your code to my previous code shows no differences.
My code continues to fail.
[It's not HKEY_CURRENT_USER vs HKCU because they both work within your pasted code]

I think I must have got up too early today.

Oh, wait. It's the capital letter on Export. I am astounded.


All the best,
Denis

Try3 said:

Copying & pasting your code works.
Comparing your code to my previous code shows no differences.
Oh, wait. It's the capital letter on Export. I am astounded.

I have just tested it using the SAME command as my previous one but a small letter e of export and it still works, how bizarre !

Nice input and output @das10.

I wonder if there are ANY other special characters within the Registry, and if there are, if they act in the same way.

Trying to look through the output for REG Export HKCU %UserProfile%\Desktop\HKCU_REG_Out.reg >nul would be a nightmare as mine produced 244,489 lines.

I even tried to search the REG file for ��� using Notepad and Notepad++, but to NO avail.

Paul Black said:

I wonder if there are ANY other special characters within the Registry, and if there are, if they act in the same way.

I haven't seen any others.
I only saw the ones we're discussing because I was following a thread that referred to the HKCU\Control Panel\International Key and my eyes strayed down.
I then searched on the strange Key and found the article I posted a link to.
I had been worried because special characters in Registry keys used to be something associated with file-less malware.

Paul Black said:

Trying to look through the output for REG Export HKCU %UserProfile%\Desktop\HKCU_REG_Out.reg >nul would be a nightmare as mine produced 244,489 lines.

I routinely export the whole of each of my Registry hives.
I can open them in Excel [2007] and use Find [on the International Key name].

It does not read the characters correctly, as you can see. Word [2007] doesn't either. This complicates doing a wider search for special characters .


All the best,
Denis

Try3 said:

I routinely export the whole of each of my Registry hives.

Me too . . .

Code:

@echo off
:: Filename: REG_Export_Hives.bat
setlocal EnableDelayedExpansion
fsutil Dirty Query %SystemDrive% > nul && goto:[RunAs]
echo CreateObject^("Shell.Application"^). ^
ShellExecute "%~0","+","","RunAs",1 > "%Temp%\+.vbs" && "%Temp%\+.vbs" & Exit
:[RunAs]

echo. & echo  Processing . . . & echo.
              for %%R in (CR CU LM U CC) do REG Export HK%%R HK_%%R.reg /Y
echo. & echo  Processing Complete.
echo. & echo ^>Press ANY key to EXIT . . . & pause >nul & Exit

Run from a designated folder. The size is approximately 400 MB.

My Registry backup plan - TenForums is in three sections
Reg Export - for each of the primary Registry keys [HKCR, HKCU, HKLM, HKCC]
Reg Save - for DEFAULT, SAM, SECURITY, SOFTWARE, SYSTEM
and
simple copying - for the NTUser.dat of the non-signed in user accounts [i.e. their own HKCU sections]

I then zip up the whole lot and it becomes about 110MB - 130MB [it's the HKLM.reg that varies most in size].


All the best,
Denis