{"id":4166,"date":"2017-03-19T02:12:16","date_gmt":"2017-03-19T02:12:16","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4166"},"modified":"2017-03-19T02:13:32","modified_gmt":"2017-03-19T02:13:32","slug":"more-contained-redirections-coming-to-registry-near-you","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/03\/19\/more-contained-redirections-coming-to-registry-near-you\/","title":{"rendered":"More contained redirections coming to Registry near you&#8230;"},"content":{"rendered":"<p>I recently came across an interesting bit inside the Registry of Windows 10.<\/p>\n<p>The key:<\/p>\n<ul>\n<li>HKLM\\system\\currentcontrolset\\control\\hiveredirectionlist<\/li>\n<\/ul>\n<p>is looked at during the system boot by the smss.exe process and the latter attempts to read the following entries underneath:<\/p>\n<ul>\n<li>\\REGISTRY\\MACHINE\\HARDWARE<\/li>\n<li>\\REGISTRY\\MACHINE\\SECURITY<\/li>\n<li>\\REGISTRY\\MACHINE\\SOFTWARE<\/li>\n<li>\\REGISTRY\\MACHINE\\SYSTEM<\/li>\n<li>\\REGISTRY\\USER\\.DEFAULT<\/li>\n<li>\\REGISTRY\\MACHINE\\SAM<\/li>\n<\/ul>\n<p>Googling around brought only one meaningful <a href=\"http:\/\/ipvb.oschina.io\/container\/2016\/04\/24\/WindowsContainers\/\">result<\/a> talking about Container technology inside Windows 10 and Windows Server 2016. These entries will be used to deliver the redirection functionality intended to support a full isolation of the container.<\/p>\n<p>So&#8230; now we will have Container Registry redirection, on top of a <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa384232(v=vs.85).aspx\">WOW Registry Redirection<\/a> and <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa384235(v=vs.85).aspx\">WOW Registry Reflection<\/a>, on top of a temporary <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724901(v=vs.85).aspx\">Registry overriding<\/a>, on top of <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724353(v=vs.85).aspx\">INI to Registry mapping<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I recently came across an interesting bit inside the Registry of Windows 10. The key: HKLM\\system\\currentcontrolset\\control\\hiveredirectionlist is looked at during the system boot by the smss.exe process and the latter attempts to read the following entries underneath: \\REGISTRY\\MACHINE\\HARDWARE \\REGISTRY\\MACHINE\\SECURITY \\REGISTRY\\MACHINE\\SOFTWARE &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/03\/19\/more-contained-redirections-coming-to-registry-near-you\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[19,55],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4166"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4166"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4166\/revisions"}],"predecessor-version":[{"id":4168,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4166\/revisions\/4168"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}