Jump to content

regedit can't see entries with more than 255 characters


Joerg
 Share

Recommended Posts

As I searched the web for extreme l33tstuff ;) I came across some old news which said that regedit can't handle REG_SZ entries with more than 255 characters. I tested it with following code and it worked.

Details: http://www.reviewingit.com/index.php/content/view/28/2/

reg.exe add HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun /v "Microsoft Windows Legacy USB Support                                                                                                                                                                                                                                                         " /t REG_SZ /d "%systemdrive%system32calc.exe"

This will add an uberlong entry to the registry, try to search for that key with regedit now

This is only a lame protection from being uncloaked, but I think for the most users this is enough ;)

Greetings

Joerg

Link to comment
Share on other sites

Well, it is only usefull if it is something you want to hide for startup with the machine. Otherwise, how else are you going to get it to execute any code if it is not put in as a service or startup group.

If it is put in any startups, even if it is showing blank entries, you could still delete it, or use something like Autoruns from Sysinternals to show the hidden key and disable it.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...