Reading active/inactive status of Startup programs in registry

Question

In the software I'm currently working on, we encountered a scenario where we need to tell if a software is listed as a Startup program or not.

To tell if this program is enabled or not by the msconfig tool, I used the answer suggested by this question.

However, not all softwares use the binary value "02 00 00 00..." when enabled, we encountered one that has the value "06 00 00 00...".

To understand it further I analyzed both scenarios by reading the softwares' registry values before disabling them and then afterwards:

• The expected scenario changed from 02 00 00 00 00 00 00 00 00 00 00 00 to 03 00 00 00 17 79 BD 01 17 D9 D1 01;
• The unexpected scenario changed from 06 00 00 00 00 00 00 00 00 00 00 00 to 07 00 00 00 71 C9 33 AE 16 D9 D1 01

I'm inclined to assume that the first byte contains the correct answer. In both cases the bit 1 changed from 0 to 1. It seems that this bit contains the active/inactive value. But I'm still not quite sure.

So my question is: Can I assume that this bit contain the correct value, or does anyone have a better answer to this?

Answer 1

It seems based on your example that you just need to set the 0th bit (zero based) of the first byte. So, in essence, just add 1 to the first hex byte (or right most nibble, if that makes it easier to think about) to disable (i.e., deactivate the app during startup).

So if the first byte is: X0, X2, X4, or X6, it becomes X1, X3, X5, or X7, respectively, where X is a don't care.