# Changes to registry after applying a dll

Hi All;

Anybody know of a easy method to see what changes a regsvr32 of a dll does to the registry?
Reason for the question is that i have to apply a certain dll that randomly unregsiters itself, and for me to fault find, i need to know what areas of the registry it changes, and the next time it stops working, i can see what has happend.

So any suggestions would be greatly appriciated!

Cheers All!:tiphat:

are you sure the dll should be registered using regsrv32 or should it be placed into the GAC?

DT.

the software house that released it told us that we have to regsvr32 the dll, that and im not sure what ‘GAC’ is

try it anyway, open two explorer windows and drop the dll from it’s location into c:\windows\assembly (from memory, might need a :google: )

Got to rush, back in a few hours …

DT.

take a before and after snapshot of the entire registry? Don’t know what utilities there are to compare, but a unix style “diff” might give some clues.

If it’s a random change, schedule the regedit export ?

[QUOTE=DoubleTop;440180]try it anyway, open two explorer windows and drop the dll from it’s location into c:\windows\assembly (from memory, might need a :google: )

Got to rush, back in a few hours …

DT.[/QUOTE]

Cheers for this (never knew it exisisted) tried it and got a error message saying ;

‘The module ‘***.dll’ was expected to contain an assembly manifest.’

So i assume that this wasn’t written correctly, or in a way that will allow me to check the contents.

Spaceboy i will check this out with using a diff on the registry hives (assuming the hives are text editable??)

if there is no assembly manifest, then it’s not a .net dll, so it’s nothing to do with the gac

there are many registry snapshot tools, and watchers - a google will get you a choice of loads

DT.

well using diff like spaceboy said on a exported reg files of the entire hive has given me some useful results, tho i am unsure of what the following means? and if this ‘seed’ part is just a unique identifier or something different;

> " S e e d " = h e x : 9 0 , b 7 , 1 6 , b 2 , b d , 9 e , 7 2 , 3 5 , f 6 , 8 4 , 6 7 , 5 b , a 1 , 5 1 , 6 3 , 7 4 , 8 6 , b 6 , 9 6 , f 9 , 4 5 , a d , \

> 4 0 , d d , 5 2 , 2 2 , 5 6 , 0 1 , 0 1 , e a , 1 c , 1 8 , c 8 , b 4 , 4 8 , 3 2 , 8 e , 1 0 , b 6 , 0 1 , f 4 , 1 d , 0 6 , e c , e 2 , 6 4 , 0 e , \

> 1 5 , 2 0 , 1 1 , 4 c , 4 a , e 5 , 7 5 , b 8 , 2 6 , 2 b , b 5 , 5 1 , 0 9 , d 4 , f 9 , 9 d , d e , 3 0 , d 5 , 1 b , 1 6 , b 9 , 3 8 , 9 a , 1 4 , \

> d d , f c , a c , 6 5 , 1 6 , 7 8 , e e , 3 9

the > means the lines are added to the second file in your diff comparison I think …

the “Seed”=hex… stuff is just the text that has changed, so search in the registry for the text output above.

bit of a long shot but you never know

open a cmd prompt
try

reg compare