Windows Registry file edited with two different tools, different results

Question

I am trying two different tools to edit and remove all nodes from a Windows registry hive:

• chntpw which was essentially designed to edit password (SAM) files, but now has an interactive shell to edit registry files.

• hivex which is more up-to-date and primarily intended for general purpose registry editing.

Just to have an idea about differences between these programs, I took my BCD file (which is used by the Windows Boot Manager), and used both of these programs to delete all the nodes.

As expected, the resulting files have the same size but are not identical. When I opened each with either hivex or chntpw, both editors show 0 nodes for both files.

However, when I open hivex's file, a file which supposedly has 0 nodes, I see leftover data from its previous state.

Conversely, chntpw's result does not have any residual data from the nodes.

Now, I am currently educating myself about the registry file format, so I must ask:

If I were to use one, which one should I choose? I obviously want to simulate the behavior of Microsoft's parser/writer most realistically (I want to be able to fool those). So does the leftover data has any significance; would the Windows Boot Manager give any errors if I use hivex to create a faux BCD file?

PS: The question is independent of my primary purpose, which I hope was made clear: I want to fix/create the BCD (Boot Config Data) file without using the official Windows installer. So if you have any advices in that direction, feel free to give.

Answer 1

Hivex is explicitly designed not to remove old data from the file. This is an important goal because the registry hive format is undocumented and no one except MSFT really understand how it works, and we don't want to destroy data in the process of making changes.

Note this does not mean that hivex can't delete nodes. You can delete nodes through the API and those nodes won't be seen by regular Windows registry calls, but no data is scrubbed/removed/truncated from the underlying file.

If you want an empty hive file, I suggest starting with an empty hive file. There is an empty hive file in the hivex source code (called 'minimal') which you can use.