[Tigzy]

Hello

Something is pulling my hairs off...

I use NTREG (library) to modify hives in an offline context (such as live CD, OTLPE f.i)
When I play around with all that is in the %sys32%/config directory (HKLM hives basically) the changes are taken correctly, but when I play with HKCU (%userprofile% / NTUSER.dat) , at reboot I got a messaebox "Some registry entries have been restored from a copy" and I got a brand new desktop. (I guess due to the restoration at factory of the profile)

Is there somewhere a copy of the user hives where the system can read to compare with the current one?
Someone as already got something like this?

EDIT: Seems my hive is really corrupted... :cry:

"Solved"

[Buster_BSA]

Where is available the NTREG library?

[a_d_13]

http://pogostick.net/~pnh/ntpasswd/

Thanks,
--AD

[Dmitry Varshavsky]

Tigzy, try using well-working documented API
http://msdn.microsoft.com/en-us/library ... s.85).aspx

[Buster_BSA]

Tigzy, try using well-working documented API
http://msdn.microsoft.com/en-us/library ... s.85).aspx

Based in that library someone created a command-line tool:

http://erwan.labalec.fr/other/offlinereg.zip

[Tigzy]

Very good indeed... don't know there was a Microsoft API for this :(
Now my dev is done, and I really don't want to recode all this shit :D

Thank you anyway

EDIT:

Well, this is a not-native dll (not present by default in all windows), so I would have to embed it.
I prefer native code instead. ;)

[Vrtule]

Yes, the library is part of WDK. However, it should not import many functions.

You can also google "Windows NT Registry File Format".