https://wiki.spybot.info/index.php?action=history&feed=atom&title=Advanced_registry_parametersAdvanced registry parameters - Revision history2026-05-02T22:48:06ZRevision history for this page on the wikiMediaWiki 1.39.15https://wiki.spybot.info/index.php?title=Advanced_registry_parameters&diff=601&oldid=prevCCRDude: formatting; link to adv. build parameters2008-02-22T09:47:05Z<p>formatting; link to adv. build parameters</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 09:47, 22 February 2008</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be <del style="font-weight: bold; text-decoration: none;">Value</del>=<del style="font-weight: bold; text-decoration: none;">Data </del>which would need the value <del style="font-weight: bold; text-decoration: none;">"Value" </del>to be a string containing the text <del style="font-weight: bold; text-decoration: none;">"Data"</del>. <del style="font-weight: bold; text-decoration: none;">Value</del>=dword:755 would be similar, but referencing to a <del style="font-weight: bold; text-decoration: none;">DWORD of the value </del>755.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be <ins style="font-weight: bold; text-decoration: none;">''value</ins>=<ins style="font-weight: bold; text-decoration: none;">data'' </ins>which would need the value <ins style="font-weight: bold; text-decoration: none;">''value'' </ins>to be a string containing the text <ins style="font-weight: bold; text-decoration: none;">''data''</ins>. <ins style="font-weight: bold; text-decoration: none;">''value</ins>=dword:755<ins style="font-weight: bold; text-decoration: none;">'' </ins>would be similar, but referencing to a <ins style="font-weight: bold; text-decoration: none;">REG_DWORD equaling decimal </ins>755.</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>In addition to the equals sign, you can use negations. <del style="font-weight: bold; text-decoration: none;">Value</del>!=<del style="font-weight: bold; text-decoration: none;">Data </del>would detect only if <del style="font-weight: bold; text-decoration: none;">"Value" </del>is NOT <del style="font-weight: bold; text-decoration: none;">"Data"</del>. And <del style="font-weight: bold; text-decoration: none;">Value</del>=exists: would be true whenever <del style="font-weight: bold; text-decoration: none;">"Value" </del>exists.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>In addition to the equals sign, you can use negations. <ins style="font-weight: bold; text-decoration: none;">''value</ins>!=<ins style="font-weight: bold; text-decoration: none;">data'' </ins>would detect only if <ins style="font-weight: bold; text-decoration: none;">''value'' </ins>is NOT <ins style="font-weight: bold; text-decoration: none;">''data''</ins>. And <ins style="font-weight: bold; text-decoration: none;">''value</ins>=exists:<ins style="font-weight: bold; text-decoration: none;">'' </ins>would be true whenever <ins style="font-weight: bold; text-decoration: none;">''value'' </ins>exists.</div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>You can also add relative paths (for checking values in subkeys), and absolute paths (beginning with a backslash, starting in the same root key).</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>You can also add relative paths (for checking values in subkeys), and absolute paths (beginning with a backslash, starting in the same root key).</div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr>
<tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Fields that accept advanced registry parameters often, but not always, also support [[Advanced build parameters|advanced build parameters]].</ins></div></td></tr>
</table>CCRDudehttps://wiki.spybot.info/index.php?title=Advanced_registry_parameters&diff=118&oldid=prevCCRDude: New page: Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be Value=Data which would need the value "Value" to be a stri...2008-02-16T18:35:11Z<p>New page: Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be Value=Data which would need the value "Value" to be a stri...</p>
<p><b>New page</b></p><div>Advanced registry parameters are additional conditions that have to be met by the scanner if identified. An easy example would be Value=Data which would need the value "Value" to be a string containing the text "Data". Value=dword:755 would be similar, but referencing to a DWORD of the value 755.<br />
In addition to the equals sign, you can use negations. Value!=Data would detect only if "Value" is NOT "Data". And Value=exists: would be true whenever "Value" exists.<br />
You can also add relative paths (for checking values in subkeys), and absolute paths (beginning with a backslash, starting in the same root key).</div>CCRDude