Thursday, June 28, 2012

Info regarding HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings

Stuff that I've learned so far about the connection settings binary, I'm placing it here in for my reference later so I don't forget.

1) Byte number zero always has a 3C or 46 - I couldn't find more information about this byte.The next three bytes are zeros.

2) Byte number 4 is a counter used by the 'Internet Options' property sheet (Internet explorer->Tools->Internet Options...).
As you manually change the internet setting (such as LAN settings in the Connections tab), this counter increments.Its not very useful byte.But it MUST have a value.I keep it zero always.The next three bytes are zeros (Bytes 5 to 7).
 
3) Byte number 8 can take different values as per your settings.
The value is :
09 when only 'Automatically detect settings' is enabled
03 when only 'Use a proxy server for your LAN' is enabled
0B when both are enabled
05 when only 'Use automatic configuration script' is enabled
0D when 'Automatically detect settings' and 'Use automatic configuration script' are enabled
07 when 'Use a proxy server for your LAN' and 'Use automatic configuration script' are enabled
0F when all the three are enabled.
01 when none of them are enabled.
The next three bytes are zeros (Bytes 9 to B).
 
4) Byte number C (12 in decimal) contains the length of the proxy server address.For example a proxy server '127.0.0.1:80' has length 12 (length includes the dots and the colon).The next three bytes are zeros (Bytes D to F).

5) Byte 10 (or 16 in decimal) contains the proxy server address - like '127.0.0.1:80' (where 80 is obviously the port number)

6) the byte immediatley after the address contians the length of additional information.The next three bytes are zeros. For example if the 'Bypass proxy server for local addresses' is ticked, then this byte is 07,the next three bytes are zeros and then comes a string i.e. '<local>' (<local> indicates that you are bypassing the proxy server.Now since <local> has 7 characters, the length is 07!).
You will have to experiment on your own for finding more about this.
If you dont have any additional info then the length is 0 and no information is added.

7) The byte immediately after the additional info, is the length of the automatic configuration script address (If you dont have a script address then you dont need to add anything,skip this step and goto step 8).The next three bytes are zeros,then comes the address.

8) Finally, 32 zeros are appended.(I dont know why! Presumably to fill the binary blob, perhaps it is expected to be a certain length by something, don't you wish windows had some source?)

No comments:

Post a Comment