The Windows Registry Adventure #4: Hives and the registry layout
ID: 35c3b024-a94b-5d85-92ce-bc15d665f13b
STIX ID: report--35c3b024-a94b-5d85-92ce-bc15d665f13b
Feed Name: Google Project Zero
Technical deep dive by Google Project Zero into Windows Registry internals: how user-mode APIs map to kernel-mode (\\Registry), the role and security of top-level keys, the structure and lifecycle of registry hives (system, user, application, volatile, and differencing) and their on-disk artifacts, enumeration methods, and the mechanics, privileges, flags, and mount points for loading/unloading hives (including VRegDriver for containerized differencing hives), with notes on legacy behaviors and security implications.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.