News for hackers. Stuff that matters.
Re:Registry Explorer: Replacement for the Windows Built-In R... by vsto on Sunday July 25, 2021 @03:11AM (#27947386)
Although they don't contain a registry editor, the Windows Sysinternals tools from Microsoft have some great ones like Process Explorer (task manager replacement), Process monitor (shows all real-time Registry activity as well), ZoomIt (great for screen drawing during presentations) and so on. Written by Azure's CTO way before the cloud existed :)

https://docs.microsoft.com/en-us/sysinternals/downloads/

Re:Registry Explorer: Replacement for the Windows Built-In R... by roblabla on Sunday July 25, 2021 @09:27AM (#27949018)
Instead of process explorer, I highly recommend people to use Process Hacker[0]. It's open source, contains a lot of information missing from process explorer, and has a much cleaner user interface.

Another great one is WinObjEx64[1], which allows exploring the NT namespace.

[0]: https://github.com/processhacker/processhacker

[1]: https://github.com/hfiref0x/WinObjEx64

Re:Registry Explorer: Replacement for the Windows Built-In R... by vsto on Sunday July 25, 2021 @10:07AM (#27949262)
I like that Process Hacker has broader set of features, but what I am missing compared to Process Explorer is the the ability to quickly identify the process by using the "sniper" and the integration with VirusTotal. I wish there was a single tool with all the bells and whistles :) Maybe I should start contributing to FOSS.
Re:Registry Explorer: Replacement for the Windows Built-In R... by roblabla on Sunday July 25, 2021 @11:28AM (#27949847)
ProcessHacker has both VirusTotal integration and the sniper feature, at least in the nightly builds (Called Process Hacker 3). I highly recommend using the nightly builds, they are packed with amazing features.
Re:Registry Explorer: Replacement for the Windows Built-In R... by elpescado on Sunday July 25, 2021 @06:41AM (#27948185)
I just don't get it. Not using Electron, no Angular, not using any latest web technologies, not cloud-native, no social network features... WTF was this guy thinking?

/s

Re:Registry Explorer: Replacement for the Windows Built-In R... by notRobot on Saturday July 24, 2021 @07:21PM (#27945226)
Similar: Policy Plus: Group Policy Editor, but better! https://github.com/Fleex255/PolicyPlus
Re:Registry Explorer: Replacement for the Windows Built-In R... by montecarl on Saturday July 24, 2021 @08:02PM (#27945455)
When clicking that link in Chrome I get a "The site ahead contains harmful programs" warning page with a bright red background.

"Attackers on github.com might attempt to trick you into installing programs that harm your browsing experience (for example, by changing your homepage or showing extra ads on sites you visit)."

How strange... I don't get it for other github pages.

Re:Registry Explorer: Replacement for the Windows Built-In R... by userbinator on Saturday July 24, 2021 @08:32PM (#27945582)
From that page:

N.B. A few antivirus programs incorrectly flag Policy Plus as malware. Policy Plus is a powerful tool and so may cause problems if used recklessly, but it is not malicious.

No so much different than "hacking tools" or similar being detected as "malware". In other words, just another example of the paranoia typical of the authoritarianism that is so common in the software industry today.

Re:Registry Explorer: Replacement for the Windows Built-In R... by ASalazarMX on Sunday July 25, 2021 @12:55PM (#27950759)
> In other words, just another example of the paranoia typical of the authoritarianism that is so common in the software industry today

I don't think it's authoritarian, just that the more positives your antivirus detects that others don't, the better you can sell it. Something like Process Hacker should have never been detected as malware, as it can't harm others, but it ups those numbers.

Re:Registry Explorer: Replacement for the Windows Built-In R... by zinekeller on Sunday July 25, 2021 @02:13AM (#27947133)
Same here. Surprisingly, Microsoft* just allowed it, no problem. Edit: Also, Google doesn't trigger on https://github.com/Fleex255/PolicyPlus/ (note the trailing slash) but reacts to https://github.com/Fleex255/PolicyPlus (no trailing slash). Weird.

VirusTotal summary page says that it is detected by five different engines: https://www.virustotal.com/gui/file/dca4ecd769253d3b4a165a5b...

* Both Edge SmartScreen and Defender.

Re:Registry Explorer: Replacement for the Windows Built-In R... by throwawaysea on Saturday July 24, 2021 @11:18PM (#27946419)
I get the same on Firefox as well, and this is the first time I've seen such a warning ever. I definitely don't get it for other github projects.
Re:Registry Explorer: Replacement for the Windows Built-In R... by franga2000 on Sunday July 25, 2021 @08:12AM (#27948595)
The same happens sometimes when trying to download netcat and almost always when downloading any of the SysInternals password recovery tools. Cybercriminals use these tools in attacks and so they must be malicious! You know, like bank robbers use hammers and cars...
Re:Registry Explorer: Replacement for the Windows Built-In R... by iudqnolq on Sunday July 25, 2021 @02:07AM (#27947109)
If chrome uses something like the public safe browsing blAPI malware checking is done with hashes of full urls
Re:Registry Explorer: Replacement for the Windows Built-In R... by dataflow on Saturday July 24, 2021 @11:04PM (#27946358)
Is this the first app of its kind in the world? I literally don't know of a single other app that can edit group policy besides gpedit.
Re:Registry Explorer: Replacement for the Windows Built-In R... by bloqs on Sunday July 25, 2021 @12:55AM (#27946834)
I guess you could be right. As a relatively new admin i find it so odd how software that improves administration for windows isnt more common
Re:Registry Explorer: Replacement for the Windows Built-In R... by franga2000 on Sunday July 25, 2021 @08:27AM (#27948661)
I'm always amazed by just how much community tooling is developed for Windows. From PowerToys to SysInternals, those two package managers, TerraCopy, etc. All things that improve on what Windows ships with because Microsoft refuses to put any effort into doing it themselves and it's not open source so you can't exactly open a pull request and do it for them.

I guess that kind of approach quickly hits an API ceiling when it comes to administration tools. A lot of them need pretty low-level access to things that MS doesn't provide good APIs for and few people want to develop a product on top of entirely unsupported reverse-engineered APIs.

Re:Registry Explorer: Replacement for the Windows Built-In R... by judge2020 on Sunday July 25, 2021 @01:48AM (#27947005)
The two problems I see are that the program could have bugs that the original gpedit doesn’t, and how most enterprises wouldn’t dare trust third-party software to manage group policy on their internal network.
Re:Registry Explorer: Replacement for the Windows Built-In R... by userbinator on Sunday July 25, 2021 @02:43AM (#27947265)
As far as I know, all gpedit does is act as a special-purpose registry editor anyway.
Re:Registry Explorer: Replacement for the Windows Built-In R... by dataflow on Sunday July 25, 2021 @02:45AM (#27947277)
Not quite. It modifies more than just the registry.
Re:Registry Explorer: Replacement for the Windows Built-In R... by tinus_hn on Sunday July 25, 2021 @04:56AM (#27947775)
No, there’s steps in between to make it combine with the domain policy.
Re:Registry Explorer: Replacement for the Windows Built-In R... by atatatat on Saturday July 24, 2021 @11:24PM (#27946439)
Windows hasn't historically been considered abandonware.
Re:Registry Explorer: Replacement for the Windows Built-In R... by dataflow on Saturday July 24, 2021 @11:29PM (#27946455)
Huh? Who said anything about abandonware?
Re:Registry Explorer: Replacement for the Windows Built-In R... by xaduha on Saturday July 24, 2021 @09:25PM (#27945859)
I was about to post it too, fiddling with registry directly where things are scattered all over the place should be last resort when there are better tools out there.
Re:Registry Explorer: Replacement for the Windows Built-In R... by canistel on Sunday July 25, 2021 @01:28AM (#27946944)
A closed source but free alternative is https://www.oo-software.com/en/ooregeditor. Full-featured and reliable from my experience.
Re:Registry Explorer: Replacement for the Windows Built-In R... by qwertox on Sunday July 25, 2021 @05:15AM (#27947852)
Another closed source with a free and a paid pro version is https://www.resplendence.com/registrar

I'm just mentioning it because it can perform regex searches and open .reg files for editing. This does come in handy when you create backups of the registry and later want to search some keys in that backup, copy some sub-keys from there into the current registry.

There was a time when I was fiddling a lot with the registry (I think while developing some DCOM stuff) and this helped me a lot with keeping the system somewhat clean.

Re:Registry Explorer: Replacement for the Windows Built-In R... by quyleanh on Saturday July 24, 2021 @08:44PM (#27945646)
I'm a bit surprised when seeing the main language is C++ instead of C#.

Btw, it looks promise. I think I will love it with Find All feature, intuitive and informative.

Re:Registry Explorer: Replacement for the Windows Built-In R... by bloblaw on Saturday July 24, 2021 @10:59PM (#27946333)
Wow, how times have changed!

I say that because when C# was released, many Windows developers refused to use it and continued to only write Windows programs in "native" languages like C++, VB6, and Delphi.

I must admit my own bias and state that I still prefer applications written in "native" code on Windows (C++ / Delphi) to C#. It's not really an issue worth arguing over these days (and hasn't been for years), but there it is. FWIW, all the SysInternals tools are C++

Re:Registry Explorer: Replacement for the Windows Built-In R... by userbinator on Sunday July 25, 2021 @02:45AM (#27947279)
The startup times are noticeably longer for anything non-native, and noticeable can turn into annoyance when it's an application you're unlikely to leave open all the time, like a registry editor.
Re:Registry Explorer: Replacement for the Windows Built-In R... by pilif on Sunday July 25, 2021 @01:00AM (#27946845)
VB6 didn’t produce native binaries
Re:Registry Explorer: Replacement for the Windows Built-In R... by bloblaw on Sunday July 25, 2021 @01:48AM (#27947008)
VB6 did support compiling "native" binaries by default, and not to p-code, as previous versions did.

https://blog.decompiler-vb.net/the-truth-about-p-code/

Re:Registry Explorer: Replacement for the Windows Built-In R... by 0xdeadb00f on Sunday July 25, 2021 @12:21AM (#27946695)
> I'm a bit surprised when seeing the main language is C++ instead of C#.

May I ask why? That isn't that surprising to me.

Re:Registry Explorer: Replacement for the Windows Built-In R... by foepys on Sunday July 25, 2021 @03:14AM (#27947394)
With the current state of .NET I wouldn't either.

Once Microsoft makes up its mind about which way it wants to go for UI and distribution of desktop applications, maybe. I don't want to use buggy, incomplete WinForms, deprecated, half-abandoned, buggy WPF, or unfinished WinUI.

Re:Registry Explorer: Replacement for the Windows Built-In R... by foepys on Sunday July 25, 2021 @07:21AM (#27948334)
To the people downvoting this:

WPF is complete, done, never to be changed again according to Microsoft. But nevetheless they have recently started fixing bugs for .NET 6. Notably not the one where returning from the Windows 10 lock screen made the application freeze. They called that production-ready for .NET 5. [1]

WinForms is a mess. They reinvented the wheel when porting it from .NET Framework by changing APIs, then noticing that this wasn't a good idea because porting applications from .NET Framework would become a complete rewrite which would make WinForms on .NET pointless. So they stopped changing the APIs halfway through, which makes it still necessary to rewrite complex UIs. [3] The WinForms designer in Visual Studio does not work with third-party controls (even your own) when targeting .NET 5/6. You need to sign an NDA to get access to internal VS APIs to do that. They call that production-ready. [2]

WinUI 3 is missing a lot of controls and features. But because Windows 11 needed to be released, they implemented the bare minimum that they needed for themselves and called it production-ready.

It's a mess. A huge mess when developing a desktop UI application larger than a calculator.

1: https://github.com/dotnet/wpf/issues/2158

2: https://devblogs.microsoft.com/dotnet/windows-forms-designer...

> We are working closely with the control vendors such as Progress Telerik, DevExpress and GrapeCity on supporting their controls in the Windows Forms designer in the nearest future for .NET Core and .NET 5 projects. We are also collaborating with ActiPro, Infragistics, and SyncFusion.

Situation unchanged, no access to the APIs without an NDA.

3: https://docs.microsoft.com/en-us/dotnet/core/compatibility/w...

Re:Registry Explorer: Replacement for the Windows Built-In R... by contextfree on Sunday July 25, 2021 @01:57PM (#27951352)
Windows 11 doesn't currently use WinUI 3 at all, it's all still WinUI 2.x/UWP XAML based, including the new stuff.

Actually I don't think WinUI 3 currently has any immediate advantages over WinUI 2.x from the app developer's point of view, except that there's a nice Visual Studio template for creating standalone Win32 apps using it, but I believe you can achieve more or less the same thing with a little more upfront work by just making an app that does its entire UI in one big XAML Island, and in fact that's how Windows Terminal works. The long-term advantages are supposed to come from WinUI 3's XAML and composition stack being decoupled from the Windows OS build.

Re:Registry Explorer: Replacement for the Windows Built-In R... by thrower123 on Sunday July 25, 2021 @08:56AM (#27948832)
Nah, just use WinForms. It's alwys going to work, and it's better than all the half-baked abandoned successor platforms.
Re:Registry Explorer: Replacement for the Windows Built-In R... by foepys on Sunday July 25, 2021 @09:22AM (#27948989)
> It's alwys going to work

That's a hope I currently do not share. There were multiple cases where Microsoft employees proposed features for WinForms that were only stopped by community members because it would have broken WinForms in very subtle ways. If Microsoft were on their own, it would already be broken. Also see the VS WinForms designer problem in the sibling comment.

I have the feeling that the original WinForms designers quit Microsoft years ago and some juniors are left trying to force their new ideas into it to make a name for themselves.

Re:Registry Explorer: Replacement for the Windows Built-In R... by cmeacham98 on Sunday July 25, 2021 @08:40AM (#27948747)
> Show real Registry (not just the standard one)

Can someone with more Windows knowledge explain this? Does regedit show a "fake" registry?

Re:Registry Explorer: Replacement for the Windows Built-In R... by roblabla on Sunday July 25, 2021 @09:29AM (#27949033)
The Windows Registry API is an incomplete wrapper over the NT Registry API. One glaring problem with it is that the windows API uses null-terminated string, whereas the NT API (and the underlying file format) use length-prefixed strings. This means you can effectively hide keys and values from software using the normal Windows API.
Re:Registry Explorer: Replacement for the Windows Built-In R... by internet2000 on Saturday July 24, 2021 @09:04PM (#27945745)
Not high DPI aware :(
Re:Registry Explorer: Replacement for the Windows Built-In R... by pxeboot on Saturday July 24, 2021 @08:30PM (#27945576)
This looks great. Happy to see an easy way to access registry timestamps, as the default editor doesn't make it known they even exist.
Re:Registry Explorer: Replacement for the Windows Built-In R... by ape4 on Sunday July 25, 2021 @09:11AM (#27948933)
The search alone is worth it. Searching in regedit means pressing F3 (find next) an zillion times.
Re:Registry Explorer: Replacement for the Windows Built-In R... by userbinator on Saturday July 24, 2021 @08:38PM (#27945618)
Name collision aside, it's always good to see more native Win32 software being written. But the requirements seem to be unexpectedly high:

Build the solution file with Visual Studio 2022 preview. Can be built with Visual Studio 2019 as well (change toolset to v142

Re:Registry Explorer: Replacement for the Windows Built-In R... by tasogare on Saturday July 24, 2021 @09:46PM (#27945947)
Having VS 2019 (which is free as Community Edition) is not a really high requirement, it's probably already installed by any developer developing on one of the MS stack.
Re:Registry Explorer: Replacement for the Windows Built-In R... by SamuelAdams on Saturday July 24, 2021 @10:14PM (#27946096)
Yeah if you wanted to you could also probably use VS Code, there is a .vscode directory in the GitHub source code so I imagine the author used that too at some point.
Re:Registry Explorer: Replacement for the Windows Built-In R... by blt on Saturday July 24, 2021 @09:53PM (#27945983)
Probably the author wanted to use some C++20 feature.
Re:Registry Explorer: Replacement for the Windows Built-In R... by dataflow on Saturday July 24, 2021 @11:10PM (#27946386)
Are you referring to the run-time requirements, or just compile-time?
Re:Registry Explorer: Replacement for the Windows Built-In R... by agumonkey on Sunday July 25, 2021 @06:48AM (#27948212)
very nice

for the author, what about split panels or tabs, sometimes I needed to operate on two parts of the registry in sync~

also maybe a diff view for patch export/import

just suggesting

kudos

Re:Registry Explorer: Replacement for the Windows Built-In R... by jaclaz on Sunday July 25, 2021 @08:17AM (#27948619)
Re:Registry Explorer: Replacement for the Windows Built-In R... by agumonkey on Sunday July 25, 2021 @02:20PM (#27951537)
pretty nice
Re:Registry Explorer: Replacement for the Windows Built-In R... by rudian on Sunday July 25, 2021 @01:26AM (#27946935)
Everyone: Naming is hard.

This guy: