I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a click and a GUI pops pup.

Is it possible to identify how the app uses registry, how?


You can try to dissect your executable in IDA Pro and find functions like these: RegOpenKeyEx, RegSetValueEx, RegGetValue, RegQueryValueExW, RegCloseKey, RegOpenCurrentUser (they are part of advapi32.dll).

If you prefer to analyse the registry activity of your app dynamically then use regshot. It's very easy to use it - just make first shot of the registry before you launch your app and then second shot (after say 3-5 minutes) and then press compare-button. regshot will make a report about registry keys/values that have been opened, added, deleted.


To see which registry keys your applications accesses while running, use Procmon. If you want to monitor more DLL calls than mere registry accesses, i recommend API Monitor.

  • Furthermore, both of those tools allow you to examine the call-stack for any captured log entry. That will help you find the function in your program that solicited the registry lookup. Sep 18 '15 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.