Page 1 of 2

RawReg - reghive viewer/editor

Posted: Sat Jun 11, 2016 11:59 pm
by joby_toss
[Mod note: this is RawReg's official forum topic -- database entry is at https://www.portablefreeware.com/?id=2786]

http://reboot.pro/files/file/95-rawreg/
http://reboot.pro/topic/4684-raw-registry-editor/
RawReg allows to edit offline Windows NT registry hives.

It can be used (for example) to edit BCD hives, NTUSER, software and many other registry hives found inside Windows NT (2000, XP, Vista, 7, 8, ...)

This tool provides information about the physical offset position of each registry key on the hive file, a very handy feature if you are debugging a registry hive with the aid of an hexadecimal editor.

What can it do?

- Browse the hive structure
- Edit the data on values
- Change the title of values
- Show a map with information of data inside each bin
- Show details about physical offset of any given key

Please note that unlike any other raw registry editors, this is the only program that can really add more data onto a given registry hive and manage the bin space properly. In the past, people were limited to only change data on keys that needed to have the exact same size, there are no such restrictions here and many things can be added - post your requests and I'll see if they can be included.

This tool is available "as is". With so many things going on at the same time, it is not possible to add extra features or correct reported defects. My apologies.

What is the advantage of not using Win32 API?

- No need to load a hive into the local registry
- Overcome any security restrictions imposed by Win32 API
- Works on every Windows platform (from Windows 9x all the way up to Vista)
- No UAC restrictions regarding hive load without administrator permissions
- More features can be added in the future.
Image

Note: this tool works great with the small RegHive files created by Sandboxie.
Tested version 1.3 and it saves its settings in RawReg.ini file inside its own folder while being stealth.

Database entry: http://www.portablefreeware.com/index.php?id=2786

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 12, 2016 12:42 am
by Ennovy
joby_toss wrote: Note: this tool works great with the small RegHive files created by Sandboxie.
Tested version 1.3 and it saves its settings in RawReg.ini file inside its own folder while being stealth.

Database entry: http://www.portablefreeware.com/index.php?id=2786
Thanks for sharing, voted

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 12, 2016 7:12 am
by shnbwmn
Apart from RawReg (upvoted!), Registry Viewer (my default), and Buster's Sandbox Analyser (complex and only works with Sandboxie), are there any other programs that can open RegHives?

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 12, 2016 10:04 am
by Midas
RawReg looks like a valuable addition to any serious portablist toolbox -- especially for those of the sand-boxing persuasion... Thanks joby. 8)

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 12, 2016 11:56 am
by billon
Thank you, joby! :)

@shnbwmn: try Windows Registry Recovery

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 12, 2016 11:57 am
by joby_toss
@shnbwmn: I use MiTeC Windows Registry Recovery to view them and now RawReg to edit them.

I'm glad you guys find this useful and I'd like to say Thank you! to Mr. Nuno Brito, the author. Although the app could use some improvements, I don't know of any other tool capable to edit these hive files in offline mode.

Re: RawReg - reghive viewer/editor

Posted: Mon Jun 13, 2016 5:20 am
by Midas
If memory serves me right, Nuno Brito is also the author and chief mod of Reboot.pro. The fact that he still finds the time to release free software is no mean feat, so all the praise is well deserved. 8)

Re: RawReg - reghive viewer/editor

Posted: Mon Jun 13, 2016 7:33 am
by shnbwmn
@billon @joby_toss : Thanks!

Re: RawReg - reghive viewer/editor

Posted: Sat Jun 25, 2016 7:21 am
by JohnW
@shnbwmn mentioned Buster's Sandbox Analyser (BSA) in passing. There is no other mention of it in TPFC.
I took a look at the program and just as shnbwmn wrote, it is complex.
The instructions blow your mind!
It is stated to be portable. I suspect that it isn't for its main use, as it requires WinPCap.
Nonetheless I extracted the appropriate files and placed them in the BSA directory. It seemed to run.
I then found that it is very easy to run Utilities and/or Analysis from the main menu.
It does indeed have an easy to use RegHive explorer as well as a PE explorer, a Process explorer, a File Disassembler, a Hasher, a Hex Editor etc
You can actually export the RegHive to a Reg file.
A few other features include PDF file analysis, URL analyzer and a APK analyzer.
I was intrigued by the last mentioned but it needed Java.
Anyway- just thought it might be of passing interest.

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 26, 2016 10:10 am
by I am Baas
JohnW wrote:@shnbwmn mentioned Buster's Sandbox Analyser (BSA) in passing. There is no other mention of it in TPFC.
viewtopic.php?t=11118

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 26, 2016 11:07 am
by JohnW
I stand corrected Baas. Sorry about that!
I'll excuse myself to some extent because the Search facility in the Forum is not very intelligent.

Re: RawReg - reghive viewer/editor

Posted: Sun Jun 26, 2016 1:31 pm
by shnbwmn
JohnW wrote:... the Search facility in the Forum is not very intelligent.
viewtopic.php?p=66275#p66275

:wink:

Re: RawReg - reghive viewer/editor

Posted: Sat Feb 24, 2024 11:14 am
by juverax
One use case of rawreg:
https://stackoverflow.com/questions/140 ... by-regedit
for fixing, cleaning the actual registry hive.

Re: RawReg - reghive viewer/editor

Posted: Sat Feb 24, 2024 4:12 pm
by Midas
juverax wrote: Sat Feb 24, 2024 11:14 am One use case of rawreg:
https://stackoverflow.com/questions/14000522/
manually-delete-corrupt-registry-key-not-shown-by-regedit

for fixing, cleaning the actual registry hive.

FTR, RawReg v1.3 was last released 2011-12-06 (no changelog).

Download is at http://reboot.pro/index.php?
app=downloads&module=display&section=download&do=confirm_download&id=95
.

Requests and bug fixes

This tool is available "as is". With so many things going on at the same time, it is not possible to add extra features or correct reported defects. My apologies.
@ http://reboot.pro/files/file/95-rawreg/

Re: RawReg - reghive viewer/editor

Posted: Sat Feb 24, 2024 4:45 pm
by juverax
At Midas .... A greed, Agreed :mrgreen: :mrgreen:
I was just adding some info to the knowledge base we have on this tool !!!! :| !!!!