Mozilla Profile registry.dat File Format

This document describes the file format of the loved/hated registry.dat file.

Overview

The registry file begins with a file header, followed by a tree. The tree consist of keys, each may containing one or more sub-keys. Each key may also contain entries. Both entries and keys have names. Entries also have values associated.

The registry file is in an optimized binary format. Consequently this document may be confusing on the first or second read. Byte-by-byte analysis of a sample file is provided. You are recommendated to print out the sample file analysis and consult it when you read this document.

File Header

The file header begins with with a 32-bit constant (0x76644441L) which identifies the file as a Registry.

The next two fields, major_version and minor_version signifies the file version. major_version is for incompatible changes and must be the same. minor_vesion is for backward-compatible changes.

The next field, next_avail, establishes where the next new node can be inserted. If a node has been deleted, this field points to that node. Otherwise this field points to one byte after the end of the file.

The last field, root_node, points to the location of the root node (node /).

Nodes

Each node has an associated name. The node and its name may or may not be stored together. In a clean registry, name is typically stored right before the node.

A node may follow two structures. If the node is a key, then its structure is as followed:

If the node is an entry, then its structure is:

A node begins with the field location. The value points to the offset of that field for verifictaion purpose.

The next field is name_location. The value points to where the node name is stored. Next is name_length which stores the length of the node name (including the null terminating charactor).

The next field, type, determines if the node is a key or an entry. The value is compared against an integer mask, which may be:

The next field is left which points to the next sibling node. The value is 0 if there is no next node at the same level.

The last field, parent, points to the location of the parent node. The value is 0 if there is no parent.

For a key node, subkey points to the location of the first sub-key, and entry points to the first entry of the key.

For an entry node, value_location points to the location of the entry value and the two duplicate value_length fields specify the byte-length of the value.

Sample file

At the end of this document is portions of an actual registry file. The sample has the following structure:

(o)-+ /
   (o)-+ Users
   (o)-+ Common
      (o)-+ Profiles
         [] CurrentProfile: default
         [] AutoStartWithLast: 0
         (o)-+ default
   (o)-+ Version Registry
   (o)-+ Private Arenas