Talk:Windows Shell Extension: Difference between revisions

From OniGalore
Jump to navigation Jump to search
mNo edit summary
mNo edit summary
Line 45: Line 45:
   Applications\NOTEPAD.EXE_.yourExt (type REG_DWORD)
   Applications\NOTEPAD.EXE_.yourExt (type REG_DWORD)
   ''other_extension''_.yourExt (type REG_DWORD)
   ''other_extension''_.yourExt (type REG_DWORD)
<!--
====Default programs====
* "In Windows 10 to add the program to the "Defaults Programs" list, the program should have the "CompanyName" in resources." - [https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/how-to-add-my-own-program-to-the-list-of-default/cd1d1305-9870-4156-9b99-fc03b40c1fc9 Nazaury]
-->




===Terms===
===Terms===
* The H in abbreviations stands for Hive.
* The H in abbreviations stands for Hive.

Revision as of 21:38, 6 May 2019

Research

General

  • HKEY_CLASSES_ROOT is a merged view of the ...\Software\Classes sub hierarchies in
    • HKLM (HKEY_LOCAL_MACHINE)
    • HKCU (HKEY_CURRENT_USER)
  • HKCU is a mirrored view of HKEY_USERS\<User-SID>
  • Adding a Key to HKEY_CLASSES_ROOT\Software\Classes will add a key in HKEY_LOCAL_MACHINE\SOFTWARE\Classes and vice versa.


Minimum requirements for new file types

  • HKEY_CLASSES_ROOT\.[yourExt]\shell\open\command
  • this command must have a Default key that is of type REG_EXPAND_SZ
    • creating this manually gives a REG_SZ type, which will not work and cannot be changed within the regedit GUI
    • REG_EXPAND_SZ type can be created with reg files and programmatically


Mind already existing alternate hierarchies

  • HKEY_CLASSES_ROOT\.[yourExt]

If not empty, this key might have data such as extfile which will point to HKEY_CLASSES_ROOT\[extfile]

The second key then looks like this in full length:

  • HKEY_CLASSES_ROOT\extfile\shell\open\command

Such structures sometimes get automatically created:

  • HKEY_CLASSES_ROOT\ext_auto_file\shell\open\command


User overrides

The following will override HKEY_LOCAL_MACHINE keys as the HKEY_CURRENT_USER has a higher priority.

So, you can also think of HKEY_LOCAL_MACHINE keys as a fallback when HKEY_CURRENT_USER are removed again.

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.yourExt
 OpenWithList
 OpenWithProgids


System overrides (backups ?)

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
 Applications\NOTEPAD.EXE_.yourExt (type REG_DWORD)
 other_extension_.yourExt (type REG_DWORD)


Terms

  • The H in abbreviations stands for Hive.