The Windows Registry Adventure #2: A brief history of the feature
Summary: Google Project Zero's Mateusz Jurczyk traces the Windows registry from its 1992 debut in Windows 3.1, where a single 64 KB hive called reg.dat held only OLE/COM and file type registration data, through the regf format introduced with Windows NT 3.1 in 1993. Decompiling the kernel of each NT-line release, he measures registry code growing roughly tenfold from about 10,000 lines in NT 4.0 to around 100,000 lines in Windows 11, with the largest jumps concentrated in NT 3.1-4.0, XP, Vista, and Windows 10 Anniversary Update.
Why it matters: The kernel-mode Configuration Manager that parses registry hives is a local attack surface that grew tenfold to roughly 100,000 lines, and the regf v1.3 format from Windows NT 4.0 is still the standard format loaded by Windows 11 today - so a hive file written in 1996 is still parsed by current kernels.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026