Do you have exported a Windows registry key or entire Windows registry to a *.reg file which contains for example

Code: Select all
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,3b,00,25,00,\
  53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,3b,00,25,\
  00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,\
  73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,77,00,62,00,65,00,6d,\
  00,00,00

or

Code: Select all
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"=hex(7):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\
  50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,\
  00,5c,00,49,00,44,00,4d,00,20,00,43,00,6f,00,6d,00,70,00,75,00,74,00,65,00,\
  72,00,20,00,53,00,6f,00,6c,00,75,00,74,00,69,00,6f,00,6e,00,73,00,5c,00,55,\
  00,6c,00,74,00,72,00,61,00,45,00,64,00,69,00,74,00,5c,00,75,00,65,00,33,00,\
  32,00,63,00,74,00,6d,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00,00,00,5c,00,3f,\
  00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,\
  20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,49,00,44,00,4d,00,20,00,43,00,6f,\
  00,6d,00,70,00,75,00,74,00,65,00,72,00,20,00,53,00,6f,00,6c,00,75,00,74,00,\
  69,00,6f,00,6e,00,73,00,5c,00,55,00,6c,00,74,00,72,00,61,00,45,00,64,00,69,\
  00,74,00,5c,00,75,00,65,00,36,00,34,00,63,00,74,00,6d,00,6e,00,2e,00,64,00,\
  6c,00,6c,00,00,00,00,00,00,00

and you want to know what is Path and which pending file rename operations are configured for next Windows restart?

Then UltraEdit / UEStudio script GetStringFromRegHex.js can help you.

This script can be viewed and downloaded from Macros & Scripts page on clicking on Get string from registry value with hexadecimal values.

This script converts a Windows registry value with hexadecimal values either selected in an active Windows registry file or just present in active clipboard to a readable string written by default to active output window.

Supported are registry files / clipboard contents in the formats:

  • ANSI ... REGEDIT4 in first line of *.reg file
  • Unicode ... Windows Registry Editor Version 5.00 in first line of *.reg file
Supported are registry values of following types:

  • hex(2) ... REG_EXPAND_SZ ... string containing references to values of environment variables which need to be expanded.
  • hex(6) ... REG_LINK ... a symbolic registry link, honestly never seen in a *.reg file and therefore not tested.
  • hex(7) ... REG_MULTI_SZ ... one or more null terminated strings.
The output can be written to

  • output window – default, not for strings with non ASCII/ANSI characters,
  • a new file,
  • active clipboard.
It is even possible to output the single string or the multiple strings to output window, new file and clipboard at once.

The script works even for the first versions of UltraEdit for Windows and UEStudio with support for scripts although it was really hard and time expensive to find workarounds for various scripting issues in for UE for Windows v13.00 to v14.10 and UES v6.20 to v6.60.

Add this script after downloading and saving to any directory like %APPDATA%\IDMComp\scripts via Scripting - Scripts to the Script List for easy execution at any time via menu Scripting or the Script List view.

The selection must begin at start of line with registry value name and must contain at least 1 hexadecimal value after the colon. This script is not written for having just the hexadecimal values selected or copied to clipboard. It is possible to have also lines above and below selected in active file or copied to clipboard as they are ignored by the script.

Please read the entire introducing comment at top of the script before using it the first time.

This script contains workarounds for various issues which could be of general interest also for other scripts.

Problems solved in this script:

  • No support by UltraEdit for Windows and UEStudio up to currently latest versions 22.20 (UE) respectively 15.30 (UES) to write a JavaScript string with Unicode characters with a code value greater U+00FF to a file or to clipboard.
  • No support by UltraEdit for Windows < v14.20 and UEStudio < v9.00 for direct access of clipboard content.
  • Selected text in a Unicode file copied wrong to a JavaScript string with each byte of UTF-16 LE byte stream being a separate character by UE for Windows < v14.10 and UES < v6.60.
  • UltraEdit for Windows v13.20 and UEStudio v6.40 delete in hex edit mode the bytes on execution of command hexDelete, but the deleted bytes are suddenly back after write being executed next.
  • UltraEdit for Windows < v13.20 and UEStudio < v6.40 append to a file in hex edit mode only bytes up to end of display line on write.
    The workaround for this bug must be extra enabled in script by initializing a boolean variable with value true.