Skip to content

Apply qword, hex(2) and hex(7) reg values instead of throwing - #62

Merged
BiosSystem merged 1 commit into
masterfrom
fix/reg-writer-value-types
Sep 18, 2026
Merged

BiosSystem merged 1 commit into
masterfrom
fix/reg-writer-value-types

Conversation

@BiosSystem

Copy link
Copy Markdown
Owner

The gap

Convert-RegOperationToValueKind (Scripts/Helpers/ApplyRegistryRegFile.ps1) is the PowerShell registry writer used when a reg file is applied into a mounted user hive (-Sysprep/-User, where reg import can't target HKU\<mount>) or as the fallback when reg import fails. It only handled DWord, String, and Binary, and threw "Unsupported value type" on anything else.

But the reg-file parser (Get-RegFileOperations) already emits QWord, Hex2 (REG_EXPAND_SZ), and Hex7 (REG_MULTI_SZ), and the applied-state verifier (Get-ExpectedRegistryValueKind) already maps all three. So the writer was the only part of the parse/apply/verify pipeline out of step: a reg file using one of those types would parse and verify fine but fail to apply through the hive/fallback path.

Not a live bug today — no bundled reg file uses those types (grep confirms) — and it fails loudly (throws → rollback), not silently. This closes the asymmetry so it stays safe as reg files evolve.

Change

Added QWord, Hex2 → ExpandString, and Hex7 → MultiString cases, wrapping the qword through its bytes so a high-bit value keeps its bit pattern exactly as the dword case already does.

Validation

  • Tests\Invoke-StaticValidation.ps1 -RequirePSScriptAnalyzer clean (126 files).
  • Tests/Unit/Test-RegistryFiles.ps1: 12/12 (added 6 cases covering all value types, the high-bit dword/qword sign wrap, and the unsupported-type throw).
  • Standalone rebuilt and parses.

Convert-RegOperationToValueKind, the PowerShell registry writer used when a reg
file is applied into a mounted user hive (Sysprep and per-user) or as the
fallback when reg import fails, only handled DWord, String and Binary. The reg
file parser already produces QWord, Hex2 (REG_EXPAND_SZ) and Hex7 (REG_MULTI_SZ),
and the applied-state verifier already maps all three, so the writer was the only
part out of step: a reg file using one of those types would throw "Unsupported
value type" through that path. Add the three cases, wrapping the qword through
its bytes so a high-bit value keeps its bit pattern like the dword case does.
@BiosSystem
BiosSystem merged commit c72c63e into master Sep 18, 2026
1 check passed
@BiosSystem
BiosSystem deleted the fix/reg-writer-value-types branch September 18, 2026 07:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant