Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the difference between SHDeleteKey and RegDeleteTree?

RegDeleteTree

  • Description: Deletes the subkeys and values of the specified key recursively.

  • Signature: LONG WINAPI RegDeleteTree(HKEY, LPCTSTR)

  • Minimum Supported: Vista

  • Includes: Winreg.h/Advapi32.lib

SHDeleteKey

  • Description: Deletes a subkey and all its descendants. This function removes the key and all the key's values from the registry.

  • Signature: LSTATUS SHDeleteKey (HKEY, LPCTSTR)

  • Minimum Supported: XP

  • Includes: Shlwapi.h/Shlwapi.lib

It looks they are both used to remove registry recursively. And their parameters signatures are almost the same.

Is the RegDeleteTree just a refined version of SHDeleteKey with a different name? Should I change to use newer RegDeleteTree or are there some differences between them?

like image 671
Chen OT Avatar asked Oct 19 '15 05:10

Chen OT


2 Answers

IMHO, and the documentation provided, I think the differences are;

  • API moved to different dll, the reason can be removing the shell library dependency for a single functionality as commented by OP.
  • RegDeleteTree needs you to have KEY_SET_VALUE privilege if the key have any value.

Link given by Christian.K summarizes it well. I am including some of the significant part of that blog in the answer;

Over the past couple of releases of Windows, there have been a great number of "shell" helper APIs that have gotten "promoted" out of the shell and transformed into Win32 core APIs. One of the reasons for that has been the ongoing Architectural Layering effort initiated by some of the teams in the Core OS Division.

The SHRegGetValue API was one of the APIs flagged by the layering issue as being more appropriate for core OS functionality - the analysis done by the layering team showed that a number of low level components in operating system were calling into the shell DLLs because the shell helper functions provided some convenient functionality that wasn't present in the lower layers.

As a result, a number of shell APIs were recreated as kernel32 APIs.

like image 23
Abhineet Avatar answered Nov 15 '22 08:11

Abhineet


The main differences between SHDeleteKey and RegDeleteTree are these:

1) The way they delete registry keys. For example:

SHDeleteKey(HKEY_CURRENT_USER, L"Software\\Company\\App\\Settings");

will delete everything in the Settings key, including the Settings key itself. While:

RegDeleteTree(HKEY_CURRENT_USER, L"Software\\Company\\App\\Settings");

will delete everything in the Settings key, except the Settings key. It will remain empty.

2) RegDeleteTree allows to specify WOW64 key redirection as such:

HKEY hKey = NULL;
if(RegOpenKeyEx(HKEY_CURRENT_USER,
    L"Software\\Classes\\CLSID\\{-my-guid-}", 0, 
    DELETE | KEY_ENUMERATE_SUB_KEYS | KEY_QUERY_VALUE | KEY_SET_VALUE |
    KEY_WOW64_64KEY, //For WOW64, delete only 64-bit redirected part
    &hKey) == ERROR_SUCCESS)
{
    if(RegDeleteTree(hKey, NULL) == ERROR_SUCCESS)
    {
        //Deleted everything in HKEY_CURRENT_USER\Software\Classes\CLSID\{-my-guid-}
    }

    RegCloseKey(hKey);
}

3) RegDeleteTree resides in the same lower-level DLL as the rest of the registry functions, i.e. Advapi32.dll, while SHDeleteKey is in Windows Shell's Shlwapi.dll. This distinction may be important for certain types of services.

4) RegDeleteTree is not available on older operating systems, such as Windows XP SP3, Server 2003. It is only available since Vista and Server 2008.

like image 130
ahmd0 Avatar answered Nov 15 '22 07:11

ahmd0