One Day Sec

Why can't hidden registry entries be seen or modified with regedit.exe?

Hidden registry entries start with the null character (`\0`), which Windows interprets as a string terminator. When regedit or other Win32 API–based tools attempt to read the key name, they stop at the first `\0`, causing a read error or missing the entry altogether. The Native API, however, can specify the exact length of the string, bypassing this truncation. This principle is explained in the Penetration Techniques - Creating "Hidden" Registry Entries article.
regeditstring terminatorWin32 APINative APIhidden registry

Browse all Q&A →