Windows注册表(regedit.exe)

一、注册表结构：

注册表是存储Windows的变量以及运行在Windows中的应用程序和服务的重要数据的层级数据库。数据呈现如下图所示的树状结构。

Key的名字大小写不敏感，但不能包含反斜杠(\)，Value的名字和数据中可以包含反斜杠。

Key的名字显示为英文，不会本地化成其他语言，但是values可能会本地化。

注册表root key包含以下几项：

HKEY_CLASSES_ROOT	The HKEY_CLASSES_ROOT (HKCR) key contains file name extension associations and COM class registration information such as ProgIDs, CLSIDs, and IIDs. It is primarily intended for compatibility with the registry in 16-bit Windows.
HKEY_CURRENT_USER	The HKEY_CURRENT_USER subtree contains the user profile for the user who is currently logged on to the computer. The user profile includes environment variables, personal program groups, desktop settings, network connections, printers, and application preferences. The data in the user profile is similar to the data stored in the Win.ini file in Windows 3.x.
HKEY_LOCAL_MACHINE	The HKEY_LOCAL_MACHINE subtree contains information about the local computer system, including hardware and operating system data, such as bus type, system memory, device drivers, and startup control parameters.
HKEY_USERS	Registry entries subordinate to this key define the default user configuration for new users on the local computer and the user configuration for the current user.
HKEY_CURRENT_CONFIG	Contains information about the current hardware profile of the local computer system.

二、注册表根键详解：

（一）HKEY_CLASSES_ROOT：

实际上HKCR下的注册表整合了两个部分，HKEY_LOCAL_MACHINE\Software\Classes 和HKEY_CURRENT_USER\Software\Classes，整合规则如下：

•The merged view includes all subkeys of the HKEY_CURRENT_USER\Software\Classes key.
•The merged view includes all immediate subkeys of the HKEY_LOCAL_MACHINE\Software\Classes key that do not duplicate the subkeys of HKEY_CURRENT_USER\Software\Classes.
•At the end of this topic is a list of subkeys that are found in both HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes. The immediate subkeys of these keys from the HKEY_LOCAL_MACHINE tree are included in the merged view only if they are not duplicates of immediate subkeys from the HKEY_CURRENT_USER tree. The merged view does not include the HKEY_LOCAL_MACHINE contents of duplicate subkeys.

（二）HKEY_CURRENT_USER：

实际上HKCU并不包含任何数据，只是存储了指向HKEY_USERS\Security ID (SID) of current user subkey的指针。

（三）HKEY_LOCAL_MACHINE:

hardware key:存储了系统扫描到的关于计算机硬件的数据，每次系统启动时重新建立。它包含了关于设备，软件驱动以及和设备相关的其他资源的信息。

HKLM\SOFTWARE：存储了应用于计算机所有用户的程序变量。

（四）HKEY_USERS：

此根键下的注册表信息定义了本地计算机新用户的默认用户配置，以及当前用户的用户配置。

（五）HKEY_CURRENT_CONFIG：

实际上HKCC不包含任何数据，它只是存储了指向HKLM\SOFTWAREHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current subkey的指针。

参考资料：

http://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx

http://technet.microsoft.com/en-us/library/a1377b7d-277f-47ba-adde-96ee781be5b3