The Windows Registry Adventure #4: Hives and the registry layout
Summary: Google Project Zero's Mateusz Jurczyk explains that the five HKEY root keys seen in Regedit are user-mode pseudo-handles with the highest bit set, translated by KernelBase.dll into internal paths before reaching the kernel, which has no awareness of them. The kernel's registry tree starts at the \Registry object in the NT namespace, whose four subkeys are A, MACHINE, USER and WC, with HKEY_LOCAL_MACHINE mapping to \Registry\Machine and HKEY_USERS to \Registry\User.
What you should know: The \Registry\A subtree holds app hives loaded via RegLoadAppKey, and CmpParseKey denies any attempt to open them by full path with STATUS_ACCESS_DENIED regardless of the caller's privileges or security descriptor - so these hives are reachable only through handles the loading process already holds.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026