Windows Registry
A REG file is a plain-text script containing Windows Registry entries. When executed, it merges keys and values into the registry. FileDex does not convert REG files but provides format reference information.
Windows Registry format. Platform-specific, conversion not applicable.
Common questions
Are REG files dangerous?
Yes. REG files directly modify the Windows Registry when executed. A malicious REG file can disable security features, install autorun malware, or break system functionality. Never run REG files from untrusted sources.
How do I edit a REG file without running it?
Right-click the REG file and choose 'Edit' (opens in Notepad) instead of double-clicking. Alternatively, open any text editor first and drag the file in.
What is the difference between REGEDIT4 and Version 5.00?
REGEDIT4 is the legacy format using ANSI encoding. 'Windows Registry Editor Version 5.00' is the modern format supporting Unicode (UTF-16 LE) and is used by all Windows versions since XP.
What makes .REG special
What is a REG file?
REG files are text-based scripts that contain Windows Registry entries. When executed, they merge their contents into the Windows Registry, adding or modifying keys and values. REG files are commonly used for system configuration, software deployment, and backing up registry settings.
Continue reading — full technical deep dive
How to open REG files
- Registry Editor (Windows) — Double-click to merge
- Notepad (Windows) — View/edit as text
- regedit (Windows) — Import via File menu
- Any text editor — REG files are plain text
Technical specifications
| Property | Value |
|---|---|
| Header | Windows Registry Editor Version 5.00 |
| Encoding | UTF-16 LE with BOM (or ANSI) |
| Value Types | REG_SZ, REG_DWORD, REG_BINARY, REG_MULTI_SZ |
| Root Keys | HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, etc. |
| Delete Syntax | Leading minus (-) on key or value |
Common use cases
- System configuration: Tweaking Windows settings.
- Software deployment: Pre-configuring application settings.
- Registry backup: Exporting keys for safe-keeping.
- Group Policy: Alternative to GPO for registry changes.
.REG compared to alternatives
| Formats | Criteria | Winner |
|---|---|---|
| ..REG vs ..INF | Registry modification method INF files support conditional logic and install sections, while REG files are simple merge scripts | .INF wins |
| ..REG vs ..PS1 | Registry management flexibility PowerShell scripts offer error handling, conditional logic, and remote registry access that REG files cannot | .PS1 wins |
Technical reference
- MIME Type
text/plain- Developer
- Microsoft
- Year Introduced
- 1992
- Open Standard
- No
Binary Structure
REG files are plain-text scripts beginning with a version header line ('Windows Registry Editor Version 5.00' for modern files or 'REGEDIT4' for legacy). Lines contain registry key paths in square brackets followed by value entries as name=type:data pairs. A leading minus sign before a key or value name indicates deletion.
Attack Vectors
- Registry modification can disable Windows Defender or firewall
- Autorun entries can execute malware on startup
- File association hijacking redirects file opens to malicious programs
- Social engineering tricks users into merging malicious REG files
Mitigation: FileDex does not open, execute, or parse these files. Reference page only.