regedit can't see entries with more than 255 characters

[Joerg]

As I searched the web for extreme l33tstuff ;) I came across some old news which said that regedit can't handle REG_SZ entries with more than 255 characters. I tested it with following code and it worked.

Details: http://www.reviewingit.com/index.php/content/view/28/2/

reg.exe add HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun /v "Microsoft Windows Legacy USB Support                                                                                                                                                                                                                                                         " /t REG_SZ /d "%systemdrive%system32calc.exe"

This will add an uberlong entry to the registry, try to search for that key with regedit now

This is only a lame protection from being uncloaked, but I think for the most users this is enough ;)

Greetings

Joerg

[SomeoneE1se]

Not a bad idea but anyone worth there weight know's where to look and wont really need to use the search

[digip]

Well, it is only usefull if it is something you want to hide for startup with the machine. Otherwise, how else are you going to get it to execute any code if it is not put in as a service or startup group.

If it is put in any startups, even if it is showing blank entries, you could still delete it, or use something like Autoruns from Sysinternals to show the hidden key and disable it.