Features\Registry Manager

Registry Manager

---

⚙️ The Registry Manager feature provides an intuitive interface for viewing and managing Windows registry hives on a remote machine. Its graphical design closely resembles the native Windows Registry Editor, ensuring users feel immediately familiar with the environment.

---

Collected Information

• Key names
• Value names
• Value type
• Value content (string / printable representation)
• Key permissions, which are not currently displayed but are used by the interface to determine which actions are allowed on a given hive or key (for example, enumerating sub-keys, creating or editing values, or deleting keys or values).

Implemented Functions

• Navigate to a registry location using the full path (for example: HKEY_CURRENT_USER\Software) or its shortened form (for example: HKCU\Software).
• Create a new key.
• Delete a key.
• Rename a key.
• Create a new value: DWORD, QWORD, String (SZ), Multi-String (MSZ), or Binary.
• Edit the content of a value.
• Convert a value (switch its type) with automatic conversion when supported (for example: String to Binary, String to DWORD when possible, etc.).
• Rename a value.
• Delete a value.

String (SZ)

Multi Line String (MSZ)

DWORD / QWORD

Binary

Value Converter (Switch)

The value converter is an interesting feature not available in the native Windows Registry Editor. It allows converting an existing value type into another when the transformation is technically feasible. Key rules include:

• Any value type can always be converted to Binary.
• If a string or multi-string represents a valid DWORD or QWORD, it can be converted to the corresponding numeric type.
• A DWORD or QWORD can always be converted to a string or a multi-string.
• When Binary data contains identifiable strings, they are extracted and converted into a String or Multi-String. Any binary segments that do not represent valid text are ignored.
• When Binary data can represent a DWORD or QWORD, the converter attempts a numeric transformation. If the Binary source contains a QWORD but the target is a DWORD, the value is split accordingly.

Available Options

• Hide "unenumerable" keys (default: true): during key enumeration, the system checks the permissions associated with each key to determine which actions are available to the user. When this option is enabled, only hives or keys with sufficient read permissions are displayed in the registry tree, ensuring that inaccessible locations remain hidden.

---

Feature Roadmap

• Enumerate registry keys
• Enumerate registry key values (Name, Type, and Preview Data)
• Resolve registry key DACL (SDDL format) to define authorized actions
• Rename a registry key
• Rename a registry key value
• Delete a registry key
• Delete a registry key value
• Create a new registry key
• Create or modify a registry value (types: SZ, MSZ, DWORD, QWORD, Binary)
• Convert a registry value type to another (when applicable)
• Perform a registry search (for key, value, or data)
• User-defined favorite remote system locations (tied to remote machine)
• Generic list of locations of interest that can be extended and shared across all machines
• Browsing history like web browsers (tied to remote machine)

Legend

• Implemented (Latest version)
• Planned for a future release