Regfilter and "offline" registry access

[Peter]

Hey,

I am running an XPe system on a CF card and use the regfilter to change some
registry keys directly without switching off and on the FBWF.
For an update procedure I plug this CF card into the card reader of my PC.
Now I'd like to change and add some registry keys. So I load some registry
hives of the registry files from this cf card into regedit. But -surprise- I
do not see the actual settings of those keys which are filtered by regfilter.
Other keys which are not filtered by regfilter display the right contents.
But the ones which are handled by the regfilter have a different contents.
The reason could be the following : The regfilter creates a RegfData file in
the root where it handles those keys. This should be a ramdisk. I think this
file overlays the direct contents of the registry.
So when the system and the regfilter runs the contents of the RefData is
shown in the regedit.
But when I open the registry files "offline" I see some different contents
because I see the direct contents of the registry.
But how can I see the "correct" contents of those keys (the data inside the
RegfData) ?
Is there a way to get access to the files on the RegfData ramdisk ?
Can I read the registry keys from there ?
Can I also change the contents there and create new keys?

When I do not have access to the contents of files inside RegfData, onother
solution for my problem would be to replace the whole RegfData file on the CF
card by a RegfData file that contains the correct data.
But I have no idea how dangerous it is to replace the RegfData file?
I red that I should keep the same size? Is this really important? Is
something else important?

Thanks for any info,
Peter

 

[Mike Warren]

The regfilter creates a RegfData file
in the root where it handles those keys. This should be a ramdisk. I
think this file overlays the direct contents of the registry. So
when the system and the regfilter runs the contents of the RefData is
shown in the regedit. But when I open the registry files "offline" I
see some different contents because I see the direct contents of the
registry.

That is how I understand it to work.

Have you experimented by just deleting the RegfData file. It might be
the case that it is automatically recreated. Just a thought. I don't
know if this would work or not.