What difference do double quotes make in registry keys?

4

1

I just created myself an "Open PowerShell Here" context menu item by adding the "shell", "powershell" and "command" keys to the appropriate place in the Windows registry. The default value of "command" was the path to my powershell.exe by use of the backslash as an escape character, instead of enclosing the entire path in double quotes.

This resulted in a cmd windows being open with powershell executed, i.e. the window was small, black and otherwise formatted by the default Command Prompt style.
When I changed the path to have no backslashes as escape characters, but instead enclosing the entire path in double quotes, without making any other change, what so ever, a normal, bigger, blue powershell window opened, instead.

I am wondering what change do double quotes bring to the registry? How do they alter the execution in this case and why?

The keys in question are:
C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe
and
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

The first key will open a standard black Command Prompt window with PowerShell started, while the second opens the familiar blue "PowerShell" window.

Note that the key to start Powershell in a specific folder has arguments at the end, which are purposely omitted here, as these are the keys that I tested with and that give different results.

mathgenius

Posted 2015-11-13T15:36:02.230

Reputation: 189

1Please [edit] your question to include both command keys. – DavidPostill – 2015-11-13T15:42:17.350

Answers

2

You're not escaping anything in the first scenario; the new process is created with a complete command line of C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe, exactly as you put it. (Verified with Process Explorer.)

Windows stores the console style information - colors, font, window size - in HKCU\Console. When a console-mode program (i.e. one that produces its own conhost.exe instance) is run, Windows checks for a subkey of Console named the full path of the program's EXE, with environment variables in the path collapsed (see note) and with \ replaced with _. (If that fails, Windows will check for a subkey named that without the \ replacement, but Registry Editor won't let you include \ in a key name. Verified with Process Monitor.)

Note: "Collapsing" (in relation to environment variables) is just my word for the opposite of "expanding." Expanding is the process of replacing environment variables like %SystemRoot% with their values (e.g. C:\Windows in this case). It appears that Windows collapses the values into environment variables when possible before consulting the Console key, so C:\Windows gets replaced with %SystemRoot%.

Normally, Windows finds PowerShell's settings in the subkey called %SystemRoot%_System32_WindowsPowerShell_v1.0_powershell.exe. But since the program's path has extra backslashes in it - which Windows forgives but doesn't clean up, at least in this case - it doesn't find any special console settings because there's no suitable subkey. When I set my context menu item to launch C:\Windows\system32\WindowsPowerShell\v1.0\\powershell.exe (note the last \ doubled) and renamed the real subkey to %SystemRoot%_System32_WindowsPowerShell_v1.0__powershell.exe (note the last _ doubled), the launched PowerShell instance got the styling.

Aside: PowerShell instances launched by typing powershell in an existing command prompt never get the special styles because they're attached to the console of their parent, which usually has the boring default styles. That phenomenon is unrelated to the above.

Further reading: Jay Bazuzi's nice answer that mentions several places styling can come from.

Ben N

Posted 2015-11-13T15:36:02.230

Reputation: 32 973

You are a saint! Could you help me figure this out - since I have arguments at the end of the command, which I want to keep, how should I alter the corresponding HKCU\Console key to alter the style of the window that opens? Also, what do you mean by "collapsed" variables? – mathgenius – 2016-01-18T22:38:48.410

@mathgenius I don't think you need to modify Console - if you enclose the path to PowerShell in quotes and put the arguments outside the quotes, it gets the styling because the EXE itself is launched with a normal path. By "collapsed" I mean that the values of system environment variables are replaced with the environment variable itself, so C:\Windows is replaced with %SystemRoot%. – Ben N – 2016-01-18T22:46:34.927

Like I already said - this piece of information is great, as is Jay Bazuzi's answer, but I can't figure out why in my first example the ""s aren't escaped? Or for that matter when would escaping be necessary. – mathgenius – 2016-01-21T11:18:28.170

@mathgenius They aren't escaped because Registry values aren't escaped, and Explorer just doesn't seem to do escaping here. (Rule of thumb: stuff is literal unless somebody puts it through further processing.) Escaping is not necessary in this instance; to indicate what parts are the program path and what parts are the arguments, surround the program path with quotes. – Ben N – 2016-01-21T14:05:35.950