Talk:Windows Shell Extension

From OniGalore
Revision as of 21:33, 6 May 2019 by Paradox-01 (talk | contribs)
Jump to navigation Jump to search

Research

General

  • HKEY_CLASSES_ROOT is a merged view of the ...\Software\Classes sub hierarchies in
    • HKLM (HKEY_LOCAL_MACHINE)
    • HKCU (HKEY_CURRENT_USER)
  • HKCU is a mirrored view of HKEY_USERS\<User-SID>
  • Adding a Key to HKEY_CLASSES_ROOT\Software\Classes will add a key in HKEY_LOCAL_MACHINE\SOFTWARE\Classes and vice versa.


Minimum requirements for new file types

  • HKEY_CLASSES_ROOT\.[yourExt]\shell\open\command
  • this command must have a Default key that is of type REG_EXPAND_SZ
    • creating this manually gives a REG_SZ type, which will not work and cannot be changed within the regedit GUI
    • REG_EXPAND_SZ type can be created with reg files and programmatically


Mind already existing alternate hierarchies

  • HKEY_CLASSES_ROOT\.[yourExt]

If not empty, this key might have data such as extfile which will point to HKEY_CLASSES_ROOT\[extfile]

The second key then looks like this in full length:

  • HKEY_CLASSES_ROOT\extfile\shell\open\command

Such structures sometimes get automatically created:

  • HKEY_CLASSES_ROOT\ext_auto_file\shell\open\command


User overrides

The following will override HKEY_LOCAL_MACHINE keys as the HKEY_CURRENT_USER has a higher priority.

So, you can also think of HKEY_LOCAL_MACHINE keys as a fallback when HKEY_CURRENT_USER are removed again.

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.yourExt
 OpenWithList
 OpenWithProgids


System overrides (backups ?)

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
 Applications\NOTEPAD.EXE_.yourExt (type REG_DWORD)
 other_extension_.yourExt (type REG_DWORD)


Terms

  • The H in abbreviations stands for Hive.