Convert Windows Registry GUIDs to Names You Can Read

Introduction

The Windows registry often stores files names that are used for Windows services and schedule tasks as GUIDs in the registry that points towards the real filenames but this information is hidden all over the place and I needed a bit of code to convert these values into something that users could understand and read.

I knocked up some code that seemed to do the job that returned about 5000 files names and GUID value pairs from the Windows registry in no time. But some days later, I noticed that some of the registry key value pairs for the GUIDs were not being returned and thought it must have something to do with permission. However, I was wrong and spent a whole day trying to understand what was going on.

Turns out that the Windows registry has two views for 32 bit and 64 bit values, so I managed to fix the code and decided to share it with other members here who might also be having the same problem.

Using the Code

//
RegReader.LoadClassIDs();//Will load from the registry if not already saved to  a local file
string GUID ="{12345-........};
if (RegReader.RegClasses.ContainsKey(GUID))
    {
     string FileName=RegReader.RegClasses[GUID];
    }
//

The important part to read below is the code "RegistryView.Registry32".

//
using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
using Microsoft.Win32;

namespace WinSystem
{
   public static class RegReader
    {
        public static Dictionary<string, 
        string> RegClasses = new Dictionary<string, 
        string>(StringComparer.OrdinalIgnoreCase);
        public static void LoadClassIDs()
        {
            RegClasses = new Dictionary<string, 
            string>(StringComparer.OrdinalIgnoreCase);
            if (!File.Exists("ClassGuids.txt"))
            {
                ReLoadClassIDs();
                return;
            }
            string[] RegKeys = File.ReadAllText("ClassGuids.txt").Replace
            (Environment.NewLine, "&not;").Split('&not;');
            foreach (string Key in RegKeys)
            {
                string[] Data = Key.Split(',');
                if (Data.Length == 2)
                    RegClasses.Add(Data[0], Data[1]);
            }
        }

        public static void GetRootClasses(RegistryKey Root)
        {
            foreach (string Key in Root.GetSubKeyNames())
            {
                if (Key.StartsWith("{"))
                {//Looks like a GUID
                    RegistryKey Sub = Root.OpenSubKey(Key);
                    RegistryKey SubInt = Sub.OpenSubKey
                    ("InprocServer32");//HKEY_CLASSES_ROOT\CLSID\{GUID}\InprocServer32
                    if (SubInt == null) SubInt = Sub.OpenSubKey("LocalServer32");
                    if (SubInt != null)
                    {
                        object Obj = SubInt.GetValue("");
                        if (Obj != null)
                        {
                            string Default = Obj.ToString().ToLower();
                            if (Default.EndsWith(".exe") || 
                            Default.EndsWith(".dll") || Default.EndsWith(".sys"))
                            {
                                if (!RegClasses.ContainsKey(Key))
                                    RegClasses.Add(Key.ToLower(), Default);
                            }
                        }
                    }
                    else
                    {
                        object Obj = Sub.GetValue("");
                        if (Obj != null)
                        {
                            if (!RegClasses.ContainsKey(Key))
                                RegClasses.Add(Key.ToLower(), Obj.ToString());
                        }
                    }
                }
            }
        }

        public static void ReLoadClassIDs()
        {//Some of the keys will be missing if like me 
         //you forgot to scan both 32 and 64 bit registry bases
            RegClasses = new Dictionary<string, 
            string>(StringComparer.OrdinalIgnoreCase);
            RegistryKey BaseLocal32 = RegistryKey.OpenBaseKey
            (RegistryHive.LocalMachine, RegistryView.Registry32);
            RegistryKey BaseLocal64 = RegistryKey.OpenBaseKey
            (RegistryHive.LocalMachine, RegistryView.Registry64);
            RegistryKey Root32 = BaseLocal32.OpenSubKey(@"SOFTWARE\Classes\CLSID");
            RegistryKey Root64 = BaseLocal64.OpenSubKey(@"SOFTWARE\Classes\CLSID");
            GetRootClasses(Root32);
            GetRootClasses(Root64);
            BaseLocal32 = RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry32);
            BaseLocal64 = RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry64);
            Root32 = BaseLocal32.OpenSubKey(@"CLSID");
            Root64 = BaseLocal64.OpenSubKey(@"CLSID");
            GetRootClasses(Root32);
            GetRootClasses(Root64);
            Root32 = BaseLocal32.OpenSubKey(@"AppID");
            Root64 = BaseLocal64.OpenSubKey(@"AppID");
            GetRootClasses(Root32);
            GetRootClasses(Root64);
            string RegKeys = "";
            foreach (string Key in RegClasses.Keys)
            {
                string Utf8Value = UTF8Encoding.UTF8.GetString
                (ASCIIEncoding.ASCII.GetBytes(RegClasses[Key]));
                RegKeys += Key + "," + 
                Utf8Value.Replace(",", "-") + Environment.NewLine;
            }
            File.WriteAllText("ClassGuids.txt", RegKeys);
        }
    }
}

//

Registry Permissions and Windows 10

As most developers might know, if you want to get something done in Windows then often you will end up having to hack the registry using RegEdit and sometimes, you will need to set permissions of tree nodes (Keys) within the registry or take ownership before being able to change values.

Well, the bad news is that even if you take ownership and are signed in as a system administrator, Windows 10 is now preventing you from setting new values so don't think that you are going mad because you are not alone.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend is just one example that I found.