Section 11: What Happens When You Change a Registry Value (Complete Chain)

Safety note. This section is about understanding. You do not need to change anything in the real registry to follow it. When you try it yourself (in the lab), use only the test key HKCU\Software\LearningLab, and back up first (Section 10).

The Big Picture: One Click, Seven Steps

You right-click a value in regedit, type a new number, and press OK. It takes a split second. Behind that moment, seven different parts of Windows pass the request along, like a relay race.

Here is the whole race first. Then we walk through each leg.

┌──────────────────────────────────────────────────────────────────────┐
│ 1. USER MODE: regedit.exe                                            │
│    You edit HKCU\Software\LearningLab, value Volume = 80             │
└──────────────────────────────────────────────────────────────────────┘
                                   │
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 2. Win32 API: RegSetValueEx (advapi32.dll)                           │
│    checks the arguments and the type (forwarded on to kernelbase.dll)│
└──────────────────────────────────────────────────────────────────────┘
                                   │
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 3. Native API: NtSetValueKey (in ntdll.dll)                          │
│    puts the call number in a register, runs SYSCALL                  │
└──────────────────────────────────────────────────────────────────────┘
                                   │  system call: switch to kernel mode
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 4. KERNEL MODE: Configuration Manager (CmSetValueKey)                │
│    a) checks your access right (ACL) on the key                      │
│    b) finds the key in the in-memory hive and changes the cell       │
│    c) marks that part of the hive as DIRTY                           │
│    d) writes a note into the hive's .LOG file                        │
└──────────────────────────────────────────────────────────────────────┘
                                   │  in memory first, disk later
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 5. Lazy flush (background: every few seconds, or on demand)          │
│    writes dirty parts of the hive to the hive file on disk           │
└──────────────────────────────────────────────────────────────────────┘
                                   │
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 6. Notification: waiting threads are woken                           │
│    (those that called RegNotifyChangeKeyValue on this key)           │
└──────────────────────────────────────────────────────────────────────┘
                                   │  tell the watchers
                                   ▼
┌──────────────────────────────────────────────────────────────────────┐
│ 7. USER MODE: apps and services re-read the value                    │
│    RegQueryValueEx -> new data = 80                                  │
└──────────────────────────────────────────────────────────────────────┘

Keep this picture in mind. Each topic below zooms in on one part of it.

A reminder about two "worlds". Windows has user mode (where normal programs such as regedit run, with limited power) and kernel mode (where the core of Windows runs, with full power). A program cannot touch the registry data directly. It must ask the kernel, using a system call: a controlled doorway from user mode into kernel mode. The same doorway is used for every kind of kernel request, such as opening a file (see Chapter 8).

11.1 RegEdit → Configuration Manager (Kernel) → Hive Update in Memory

What it is: The path a change takes from the program you click to the data inside the kernel.

Step by step:

What the Configuration Manager does, in order:

1. Checks the handle. The key was opened earlier, and the handle remembers which rights were granted. If regedit was not allowed to write, the call stops here with access denied (Section 6).
2. Finds the key inside the hive that is loaded in memory. Inside the hive, keys and values are stored in small records called cells, joined by pointers, like a tree of index cards.
3. Changes the value's cell (or makes a new cell if the value is new).
4. Marks that part of the hive as "dirty" (changed in memory, but not yet on disk).
5. Writes a note into the hive's log file (.LOG1 or .LOG2, Section 5), so that an interrupted write can be repaired.
6. Updates the key's last write time.
7. Returns to user mode with a success code.

          User mode                  |        Kernel mode
                                     |
  regedit ──► advapi32 ──► ntdll ────┼───►  Configuration Manager
                                  syscall          │
                                     |             ▼
                                     |      hive in RAM (marked dirty)

The hive is a memory object first. Remember Section 5: the kernel loads hive files and maps them into memory. Reads and writes happen to that memory copy. This is why the registry is fast: no disk is touched in the simple case.

What the reg command and PowerShell do. They follow the same path. reg add calls RegSetValueEx. PowerShell's Set-ItemProperty goes through the .NET Registry classes, which call the same API. All roads lead to NtSetValueKey.

Windows tip. If you want to see these calls live, a free Microsoft tool called Process Monitor (from Sysinternals) can show the registry operations (RegSetValue, RegQueryValue...) in real time. It is optional and not used in this chapter's lab.

11.2 Lazy Flush to Disk

What it is: After the change is in memory, it is not immediately written to the hive file. Windows writes it later, in the background. This is called a lazy flush ("lazy" because it does not hurry).

Why wait? Disks are slow compared with RAM. If every small change forced a disk write, Windows would slow to a crawl. Programs change registry values very often, so Windows collects the changes and writes them out together.

CHANGE 1 ─┐
CHANGE 2 ─┼─► in memory, marked dirty ─── (every few seconds) ───► hive file
CHANGE 3 ─┘                                          (one write for many changes)

The details (they may differ between Windows versions):

• A background system flusher writes the dirty parts of each hive to disk, about every few seconds (a figure around 5 seconds is often quoted).
• The log files (.LOG1 and .LOG2) hold the changes first, so that if the power fails between flushes, the next boot can replay the log and recover most changes (Section 5).
• A program that needs the change on disk now can call RegFlushKey. This forces the write and waits. It is slow, so programs use it rarely (the kernel itself uses it for very important data).
• At shutdown, restart and sign-out, the hives are flushed and unloaded properly.

The risk. Changes made in the last few seconds before a power cut may be lost, or may be recovered from the log. This is part of why a forced power-off is dangerous (Section 10.1).

What a lazy flush means for you. After you change a value, you can usually keep working. You do not need to "save". There is no Save button in regedit because the change is applied the moment you press OK.

11.3 Notification to Listening Components (RegNotifyChangeKeyValue)

What it is: Changing the value in memory is not enough. The programs that depend on the value need to know it changed. Windows provides a notification system for this.

How a program asks to be told. A program that wants to react to changes calls:

RegNotifyChangeKeyValue(key_handle, watch_subtree, filter, event, async)

(The kernel-level version is NtNotifyChangeKey.) In plain words, it says: "Tell me when something changes in this key". The parameters pick:

What happens after the change. When the Configuration Manager finishes the update (11.1), it looks at the list of watchers of that key (and its parent keys). For each watcher it signals the event. A thread that was sleeping, waiting for this event, wakes up.

Configuration Manager: "Volume was changed"
      │
      ├──► signals the event of Program A (it watches this key)
      ├──► signals the event of Service B (it watches the parent key)
      └──► nobody else is watching; done

Important detail: The notification says that something changed, not what the new value is. The program must go and read the key again (11.4).

Who uses it?

Notifications are one-shot. After an event fires, the program must call the function again to keep watching. Programs that forget will only see the first change.

11.4 When a Restart/Logoff Is Required vs Immediate Effect

What it is: Not every change takes effect at once. The result depends on when the program reads the value.

Three kinds of behaviour:

Value changed in registry
        │
        ├── program watches it? ───────── yes ──► re-reads now         (IMMEDIATE)
        │
        ├── program reads it only at start ──────► change seen at the
        │                                          program's next start
        │
        └── loaded by Windows at logon/boot ─────► change seen after
                                                   sign-out or restart

Examples to remember:

Why a restart is sometimes the only safe way. Some data is read before anything can watch it, for example the boot settings in HKLM\SYSTEM that the boot loader reads (Section 5.4). Changing them while Windows is running changes the file, but nothing re-reads it until the next boot.

Fast ways to apply a change (when appropriate):

Troubleshooting the idea "I changed it but nothing happened".

1. Did you change the right key? (HKCU vs HKLM; 32-bit vs 64-bit view, Section 7.)
2. Does a policy override it? (Section 8.)
3. Does the program read it only at startup? Restart the program.
4. Is it virtualized (Section 7)? The program may be reading the VirtualStore copy.
5. Did you use the right type (a number stored as text may be ignored)?
6. Does the change need a sign-out or restart?

Summary