Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I have a GUI app that seems to use registry. So I wanna know if I can capture that function that access registry and check if it's activated because this app doesn't use windows directory, it's just a click and a GUI pops pup.
Is it possible to identify how the app uses registry, how?
You can try to dissect your executable in IDA Pro and find functions like these: RegOpenKeyEx, RegSetValueEx, RegGetValue, RegQueryValueExW, RegCloseKey, RegOpenCurrentUser (they are part of advapi32.dll).
If you prefer to analyse the registry activity of your app dynamically then use regshot. It's very easy to use it - just make first shot of the registry before you launch your app and then second shot (after say 3-5 minutes) and then press compare-button. regshot will make a report about registry keys/values that have been opened, added, deleted.
To see which registry keys your applications accesses while running, use Procmon. If you want to monitor more DLL calls than mere registry accesses, i recommend API Monitor.
