Section 4: Registry Data Types

The Big Picture: What Is on the Card?

Every value (Section 3) has a type. The type tells Windows, and every program, how to read the raw bytes stored in the data part.

Why does this matter? The bytes 31 00 30 00 could mean the text "10", or the number 3,145,777, or just two random bytes. Without a type, nobody could tell. The type is the label on the card that says "read this as text" or "read this as a number".

Every type name starts with REG_ (short for registry). The ones you will meet in daily life:

In regedit, you see the type in the Type column. When you create a new value (right-click in the right pane, choose New), you pick the type from this list.

HKCU\Software\LearningLab        (a test key like the one you will make in the lab)
 ┌───────────────┬───────────────┬─────────────────────────┐
 │ Name          │ Type          │ Data                    │
 ├───────────────┼───────────────┼─────────────────────────┤
 │ UserName      │ REG_SZ        │ Rover                   │
 │ Volume        │ REG_DWORD     │ 0x00000032 (50)         │
 │ Colors        │ REG_MULTI_SZ  │ red blue green          │
 │ Icon          │ REG_BINARY    │ 4d 5a 90 00             │
 └───────────────┴───────────────┴─────────────────────────┘

4.1 REG_SZ (String)

What it is: One piece of text. "SZ" stands for string, zero-terminated: the text ends with a special "zero" mark so the reader knows where it stops.

Details:

• Windows stores the text as Unicode (16-bit characters, called UTF-16), so it handles every language.
• It is the most common type. The (Default) value of most keys is REG_SZ.
• Even numbers are sometimes stored as text in REG_SZ, mainly by older programs (for example MouseSpeed = "1").

Typical uses: names, paths, descriptions, version text, a command line to start a program.

Example:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
   ProductName    REG_SZ    Windows 11 Home Single Language

Try it (view only):

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName

4.2 REG_DWORD (32-bit Number)

What it is: A whole number stored in 32 bits (4 bytes). "DWORD" means double word: in the old 16-bit days a "word" was 16 bits, so a double word is 32 bits.

Range: From 0 up to 4,294,967,295 (about 4.3 billion) when read as a plain positive number. Some programs treat it as a signed number, which allows negatives; the type itself does not say which.

Typical uses: the most common type for switches and small settings:

How it is shown: regedit shows the number in hexadecimal (base 16, digits 0 to 9 and A to F), with the normal decimal number in brackets:

Start    REG_DWORD    0x00000003 (3)

When you edit it, you choose Hexadecimal or Decimal as the base. Be careful: typing 10 in hex means 16, and typing 10 in decimal means 10.

Real example: The setting that says whether apps use the light theme:

HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
   AppsUseLightTheme    REG_DWORD    0x00000000 (0)     0 = dark, 1 = light

Byte order, briefly. The bytes of a DWORD are stored with the small end first (called little-endian, the usual order on PC processors). You rarely see this unless you read a .reg file or raw bytes.

4.3 REG_QWORD (64-bit Number)

What it is: A whole number stored in 64 bits (8 bytes). "QWORD" means quad word: four 16-bit words.

Range: Up to about 18.4 quintillion (18,446,744,073,709,551,615) as a plain positive number.

Why it exists: Some numbers are too big for 32 bits. Examples:

• Sizes larger than 4 GB
• Timestamps (dates and times counted in very small units)
• Large memory addresses or counters

Example:

Size    REG_QWORD    0x0000000140000000 (5368709120)     about 5 GB

It is newer and rarer than REG_DWORD. It is treated the same way: hexadecimal on screen, decimal in brackets.

4.4 REG_BINARY (Raw Bytes)

What it is: A string of raw bytes, with no meaning that Windows understands. The program that wrote it knows how to read it.

How it looks: regedit shows a hex dump: the offset on the left, then the bytes in hexadecimal, then (on the right) the same bytes as text if they happen to be readable.

0000   4D 5A 90 00 03 00 00 00      MZ......
0008   04 00 00 00 FF FF 00 00      ........

Typical uses:

Rule: do not edit by hand unless you follow trusted instructions for an exact value. One wrong byte can silently break the thing that reads it.

4.5 REG_MULTI_SZ (Multiple Strings)

What it is: A list of text items in one value. The items are stored one after the other, each ending in the zero mark, with an extra zero mark at the end of the list.

How you edit it: regedit opens a text box. Each line is one item.

DependOnService    REG_MULTI_SZ
     RpcSs
     Tcpip

This example says: "this service depends on the services RpcSs and Tcpip".

Typical uses:

• A service's dependencies (like above)
• Lists of device or driver names
• Lists of paths to search

Careful: An empty line in the middle can end the list early. Edit with care.

4.6 REG_EXPAND_SZ (Expandable String with Environment Variables)

What it is: A string that contains environment variables in percent signs, such as %SystemRoot% or %USERNAME%. An environment variable is a named piece of information Windows keeps, such as the folder where Windows is installed. When a program reads an expandable string, it expands it: it swaps each %NAME% for its current value.

Stored in the registry:   %SystemRoot%\System32\notepad.exe
After expansion:          C:\Windows\System32\notepad.exe

Why use it? Windows may be installed on C: on one PC and D: on another. If the registry stored the full path, it would break when moved. With %SystemRoot% the same text works everywhere.

Important: The program has to ask for the expansion (the Windows API has a function for it, see Section 9). A plain REG_SZ with %SystemRoot% in it will not be expanded. Using the wrong type is a classic bug.

Real example:

HKLM\SYSTEM\CurrentControlSet\Services\<service name>
   ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

Also in this family: REG_NONE means data with no defined type (it is treated as raw bytes), and there are a few rarer types for hardware resource lists and symbolic links used internally by Windows. You will almost never need to create these.

Summary