Changing a Binary Value in the Registry?

[W. Watson]

How does one change a binary value? I need to change a 0x00000000 to 0x00000001 for
LocalNPT. When the little window appears with the current binary #, it shows
something like 0000 00 00 00 00. If I change the last 00 to 01, the value becomes
something weird like 11677.

If I exit from the program, will the value I set now be the one used. Perhaps there
is a Save option, in which case I'm OK. I did export the registry before doing this.
--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[George Hester]

Try it with regedt32.

 

[Vanguard]

How does one change a binary value? I need to change a 0x00000000 to
0x00000001 for LocalNPT. When the little window appears with the
current binary #, it shows something like 0000 00 00 00 00. If I
change the last 00 to 01, the value becomes something weird like
11677.

If I exit from the program, will the value I set now be the one used.
Perhaps there is a Save option, in which case I'm OK. I did export the
registry before doing this.

Changes made in the registry are immediate (they get written to the disk
copy of the registry which may not be the same as the memory copy until
you do a Refresh in the registry editor or exit it). That's why using
the registry editor is hazardous. You could fat finger the Del key when
you meant to hit the End key and there is no Undo to get back the prior
value. When you walk across a mine field, there is no Undo after
stepping on a mine.

Is there a reason why you chose not to divulge WHAT registry key and
data item you were touching? I didn't find a match on "LocalNPT" when I
searched my registry.

The binary view you see is like using a hex editor. The first "0000"
was the byte count. The next "00 00 00 00 00" were some bytes (8 bits).
The hex editor shows each byte as a hexidecimal value. If there were
enough entries in the binary string then it might look like:

0000 xx xx xx xx xx xx xx xx
0008 xx xx xx xx xx xx xx xx
0010 xx xx xx

The first row show the first 8-bit bytes (00-07 hex), the next row shows
the next set of 8-bit bytes (08-0F hex), the third row shows the next
set of 8-bit bytes (10-1F hex), and so on. When you enter byte values,
they are 2-digit hexidecimal characters, like "4B". You don't enter
just a "4" because that will give you "40".

You are unclear as to what you mean by "it becomes". Does that mean
WHILE you are in the binary editor and after backspacing over a prior
byte (to erase it and then enter your own value in that position) and
after inserting "01" that then the bytes before or after that position
also change? Or do you mean that you edit the byte to change it to
"01", exit the hex editor, and then either refresh the registry or exit
the registry editor and return in it to find the value got changed from
"00 00 00 00 01" to "01 01 06 07 07"?

Since a search at Microsoft and Google on "LocalNPT" turned up nothing,
I haven't a clue why you would be changing this value, for what
application it is used, what that application might enforce as the fixed
or minimum values when this data item is defined, or how you are
actually using the hex editor to alter the data item's value in the
registry.

 

[Ken Blake]

In

Try it with regedt32.

If you are suggesting that will produce different results than
regedit, it will not. They are the same.

See http://support.microsoft.com/kb/141377 which states "In
Windows XP and Windows Server 2003, Regedt32.exe is a small
program that just runs Regedit.exe."

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup

 

[Vanguard]

Try it with regedt32.

--
George Hester
_________________________________

How does one change a binary value? I need to change a 0x00000000 to
0x00000001 for
LocalNPT. When the little window appears with the current binary #, it
shows
something like 0000 00 00 00 00. If I change the last 00 to 01, the
value becomes
something weird like 11677.

If I exit from the program, will the value I set now be the one used.
Perhaps there
is a Save option, in which case I'm OK. I did export the registry
before doing this.
--
Wayne T. Watson (Watson Adventures, Prop., Nevada City,
CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

Huh? In Windows XP, regedt32.exe just calls regedit.exe (because the
security stuff from regedt32.exe got rolled into regedit.exe for the
Windows XP version of regedit.exe).

regedit.exe = 146,432 bytes
regedt32.exe = 3,583 bytes

Not a hell of a lot in regedt32.exe anymore. See
http://support.microsoft.com/?id=141377, which says:

Regedt32.exe
In Windows XP and Windows Server 2003, Regedt32.exe is a small program
that just runs Regedit.exe.

 

[David Candy]

Binary looks like this

00 00 00 00

DWords look like this

0x00000000

Windows will autoconvert to/from Dwords and 4 BYTE BINARY. So if one tries to read a 4 byte binary value as a dword then you'll get the right answer (and reading a Dword as a binary value). Binary is binary to it needs to follow the byte order of intel processors which is byte order reversed. Each byte is 2 hex digits, and you write it backwards by byte (not digit)

So

0x00000001 = 01 00 00 00
0x12345678 = 78 56 34 12

I use DWords myself.

 

[W. Watson]

Changes made in the registry are immediate (they get written to the disk
copy of the registry which may not be the same as the memory copy until
you do a Refresh in the registry editor or exit it). That's why using
the registry editor is hazardous. You could fat finger the Del key when
you meant to hit the End key and there is no Undo to get back the prior
value. When you walk across a mine field, there is no Undo after
stepping on a mine.

Is there a reason why you chose not to divulge WHAT registry key and
data item you were touching? I didn't find a match on "LocalNPT" when I
searched my registry.

The binary view you see is like using a hex editor. The first "0000"
was the byte count. The next "00 00 00 00 00" were some bytes (8 bits).
The hex editor shows each byte as a hexidecimal value. If there were
enough entries in the binary string then it might look like:

0000 xx xx xx xx xx xx xx xx
0008 xx xx xx xx xx xx xx xx
0010 xx xx xx

The first row show the first 8-bit bytes (00-07 hex), the next row shows
the next set of 8-bit bytes (08-0F hex), the third row shows the next
set of 8-bit bytes (10-1F hex), and so on. When you enter byte values,
they are 2-digit hexidecimal characters, like "4B". You don't enter
just a "4" because that will give you "40".

You are unclear as to what you mean by "it becomes". Does that mean
WHILE you are in the binary editor and after backspacing over a prior
byte (to erase it and then enter your own value in that position) and
after inserting "01" that then the bytes before or after that position
also change? Or do you mean that you edit the byte to change it to
"01", exit the hex editor, and then either refresh the registry or exit
the registry editor and return in it to find the value got changed from
"00 00 00 00 01" to "01 01 06 07 07"?

Since a search at Microsoft and Google on "LocalNPT" turned up nothing,
I haven't a clue why you would be changing this value, for what
application it is used, what that application might enforce as the fixed
or minimum values when this data item is defined, or how you are
actually using the hex editor to alter the data item's value in the
registry.

Thanks for all the info.

I looked and tried again, and yes it does take affect immediately. Didn't matter
though. I finally figured it out. There was an alternative to Modify binary, Modify,
which allows one to put in a decimal number. I put in 1 and got the desired binary value.

Why divulge LocalNPT? To point out my typo errors. I really meant LocalNTP. I'm
trying to set up XP Pro so that I can sync time on my Linux box via the XP NTP time.
See below.

On "becomes", when I enter what I thought was a good value for binary 1, the result
shown for a value by regedt is a nicely formatted hex number, but it sure was not
binary 1. I think we can dimiss this part of the topic, since I got the desired result.

According to some tome on the internet, LocalNTP needs to be binary 1. The original
value was binary 0. It didn't help me, but maybe I need to boot, which I will do very
shortly. Linux spends about 10 seconds trying to update its time, but doesn't
succeed. Here goes the boot. 10, 9, 8, 0111, 0110, (binary), ...

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[W. Watson]

Well, the XP boot and the ntp restart didn't change a thing. Linux didn't sync its
time with XP.

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[Vanguard]

Well, the XP boot and the ntp restart didn't change a thing. Linux
didn't sync its time with XP.

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City,
CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

Are you running an NTP server on the Windows host (to which the Linux
host will synchronize)? Or are you trying to synchronize the other way
around (the Windows host gets the sync from the NTP server on the Linux
host)? I don't remember Windows XP coming with an NTP server since it
is a workstation OS.

If you are doing the latter case and trying to get Windows' NTP client
to connect to the NTP server on your Linux host, did you configure the
NTP client on Windows to point at the NTP server on your Linux host?

Configure recovery:
- Run the NT Services applet (services.msc).
- Select the "Windows Time" service.
- Open its properties.
- Configure what recover modes you want.

Configure the NTP client:
- Double-click the clock in the system notification area (i.e., system
tray). Or use the "Date and Time" applet in Control Panel
(timedate.cpl).
- Click the "Internet Time" tab to display it.
- Enable and configure the NTP client to connect to your Linux host's
NTP server.

Does it work now?

Also, there is no interval that you can configure the Windows NTP client
to poll the NTP server for an update. I suspect the only time that
Windows will sync with your Linux server is when you load Windows (or
possibly when you login although I doubt it). I know when I had to use
the Novell login manager that its NTP function only synchronized once
when you logged it. If you remain logged in indefinitely then you never
do another time sync.

I use Socketwatch to keep my workstation sychronized. However, it is
setup to poll lots of external 2nd and 3rd level time servers from its
list, and I've never figured out how to edit its list to get it to
always use one particular time server. There are other utilities out
there, like Atomic Clock, that might let you specify a specific time
server. Since I'm not running any NTP servers, having Socketwatch go
out and find the best one works best in my situation.

 

[W. Watson]

Are you running an NTP server on the Windows host (to which the Linux
host will synchronize)? Or are you trying to synchronize the other way
around (the Windows host gets the sync from the NTP server on the Linux
host)? I don't remember Windows XP coming with an NTP server since it
is a workstation OS.

If you are doing the latter case and trying to get Windows' NTP client
to connect to the NTP server on your Linux host, did you configure the
NTP client on Windows to point at the NTP server on your Linux host?

Configure recovery:
- Run the NT Services applet (services.msc).
- Select the "Windows Time" service.
- Open its properties.
- Configure what recover modes you want.

Configure the NTP client:
- Double-click the clock in the system notification area (i.e., system
tray). Or use the "Date and Time" applet in Control Panel (timedate.cpl).
- Click the "Internet Time" tab to display it.
- Enable and configure the NTP client to connect to your Linux host's
NTP server.

Does it work now?

Also, there is no interval that you can configure the Windows NTP client
to poll the NTP server for an update. I suspect the only time that
Windows will sync with your Linux server is when you load Windows (or
possibly when you login although I doubt it). I know when I had to use
the Novell login manager that its NTP function only synchronized once
when you logged it. If you remain logged in indefinitely then you never
do another time sync.

I use Socketwatch to keep my workstation sychronized. However, it is
setup to poll lots of external 2nd and 3rd level time servers from its
list, and I've never figured out how to edit its list to get it to
always use one particular time server. There are other utilities out
there, like Atomic Clock, that might let you specify a specific time
server. Since I'm not running any NTP servers, having Socketwatch go
out and find the best one works best in my situation.

I want to sync the linux box, astropc, from the xp pro box, solarblast. If I
understand the above, it looks like they are for the opposite situation. My xp
machine is the workhorse. The linux box runs an application 24/7. A chron job there
that updates the time from xp every 4-6 hours would probably be just fine.

Here's an aside. If instead of booting in linux, I can boot to w2k on astropc. In
this case, I can execute a net time cmd and get w2k to sync from xp pro.

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[Vanguard]

I want to sync the linux box, astropc, from the xp pro box,
solarblast. If I understand the above, it looks like they are for the
opposite situation. My xp machine is the workhorse. The linux box runs
an application 24/7. A chron job there that updates the time from xp
every 4-6 hours would probably be just fine.

Here's an aside. If instead of booting in linux, I can boot to w2k on
astropc. In this case, I can execute a net time cmd and get w2k to
sync from xp pro.

In services.msc, is the "Windows Time" service configured for automatic
startup and is it currently started? Mine is running and I can see in
SysInternal's TCPview that it is listening on port 123 (ntp). It is
shown as as an "svchost.exe" process (because
"C:\WINDOWS\System32\svchost.exe -k netsvcs" was used to start it).
However, I don't have another host at the moment at home to see if I can
sync against this host with its Windows Time service running.

Got a personal software firewall running on either host? What happens
when you disable the firewall and then attempt to sync?

I suppose you could try to enable logging in the Windows Time service
(http://support.microsoft.com/?id=816043) to see if you can see if there
are errors, or if there even connect attempts (although auditing will
also show the other-host connects, too).

How To Synchronize the Time with the Windows Time Service in Windows XP
http://support.microsoft.com/?id=307897

How to configure an authoritative time server in Windows XP
http://support.microsoft.com/?id=314054

Using the NET TIME Command to Synchronize Windows XP Workstations
http://support.microsoft.com/?id=314090

 

[George Hester]

No I'm saying that is where it should be done.

 

[George Hester]

Well Vanguard that says alot about what I know, huh? So security is set in regedit now?

 

[W. Watson]

In services.msc, is the "Windows Time" service configured for automatic
startup and is it currently started? Mine is running and I can see in
SysInternal's TCPview that it is listening on port 123 (ntp). It is
shown as as an "svchost.exe" process (because
"C:\WINDOWS\System32\svchost.exe -k netsvcs" was used to start it).
However, I don't have another host at the moment at home to see if I can
sync against this host with its Windows Time service running.

Where do I find services.msc? Control Panel->Admin Tools->Services? I have no idea
what it is. I don't see it listed in Services. I see a Windows Time. I see a TCP/IP
Helper.

Got a personal software firewall running on either host? What happens
when you disable the firewall and then attempt to sync?

No personal firewalls. The only firewall is that provided by SP2 with Security Center.

I suppose you could try to enable logging in the Windows Time service
(http://support.microsoft.com/?id=816043) to see if you can see if there
are errors, or if there even connect attempts (although auditing will
also show the other-host connects, too).
I'll look at these.
How To Synchronize the Time with the Windows Time Service in Windows XP
http://support.microsoft.com/?id=307897

How to configure an authoritative time server in Windows XP
http://support.microsoft.com/?id=314054

Using the NET TIME Command to Synchronize Windows XP Workstations
http://support.microsoft.com/?id=314090

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[Vanguard]

Where do I find services.msc? Control Panel->Admin Tools->Services? I
have no idea what it is. I don't see it listed in Services. I see a
Windows Time. I see a TCP/IP Helper.

Start -> Programs -> Administrative Tools (if logged on as an admin) ->
Services
Well, that just runs services.msc. You can use Start -> Run to just run
services.msc yourself instead of using a shortcut to it. If you
right-click on the "Services" shortcut in the Start menu, you'll see
"...\services.msc" is the program that gets loaded. Looks like you got
into the Services applet using the shortcut.

No personal firewalls. The only firewall is that provided by SP2 with
Security Center.

I think, after install Windows XP Service Pack 2, that the firewall is
on by default and you have to turn it off if you want it out of your
way. Did you try disabling it and check if the time sync worked?

 

[Kelly]

Via Services? If so.....

Go to Start/Run/Regedit and navigate to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Alex Nichol]

Well Vanguard that says alot about what I know, huh? So security is set in regedit now?

Yes. Regedit does all registry maintenance, and regedt32 is just a
small stub to call it for the benefit of those with fixed habits

 

[W. Watson]

Start -> Programs -> Administrative Tools (if logged on as an admin) ->
Services
Well, that just runs services.msc. You can use Start -> Run to just run
services.msc yourself instead of using a shortcut to it. If you
right-click on the "Services" shortcut in the Start menu, you'll see
"...\services.msc" is the program that gets loaded. Looks like you got
into the Services applet using the shortcut.

If I go Start>All Prog>Admin Tools>Services, then I look at the list of services
there is no services.msc. This is the same list I got from using Control Panel>etc.
Anyway, am I supposed to enter it as a Run command, then go to the Services dialog
and ...? I would think time services are already running, since in an earlier part of
this thread I indicated that if I boot from W2k on astropc instead of Linux, I can
sync the w2k machine with a net time.

I think, after install Windows XP Service Pack 2, that the firewall is
on by default and you have to turn it off if you want it out of your
way. Did you try disabling it and check if the time sync worked?

I'll try it later this morning. There must be some way to just disable the local
internet from firewall protection.

BTW, I posted another message ("Purging Underscored ...") about the underscore oddity
that I have. I suspect it has nothing to do with this time difficulty, but it's worth
noting. Basically, at one point I called the Linux machine astro_pc, and found XP
didn't like that. I changed it to astropc, but XP seems to at times cling to the
notion that its astro_pc.

--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[W. Watson]

If I go Start>All Prog>Admin Tools>Services, then I look at the list of
services there is no services.msc. This is the same list I got from
using Control Panel>etc. Anyway, am I supposed to enter it as a Run
command, then go to the Services dialog and ...? I would think time
services are already running, since in an earlier part of this thread I
indicated that if I boot from W2k on astropc instead of Linux, I can
sync the w2k machine with a net time.

I'll try it later this morning. There must be some way to just disable
the local internet from firewall protection.

BTW, I posted another message ("Purging Underscored ...") about the
underscore oddity that I have. I suspect it has nothing to do with this
time difficulty, but it's worth noting. Basically, at one point I called
the Linux machine astro_pc, and found XP didn't like that. I changed it
to astropc, but XP seems to at times cling to the notion that its astro_pc.

Rebooted everything, dropped the firewall, and still no date change when I tried from
astropc (Linux). See my comments above that you might have missed. I posted them very
early this morning. Particularly see the comment about w2k.

Concerning underscores, it still randomly decides to produce astro_pc in the
descriptive material when I use Network Places Near Me. Anyway, I shook it loose this
morning by rebooting astropc (Linux), rebooting XP (solarblast), logging in as
Administrator (as I usually do, and that didn't shake the astro_pc), relogging as
guest, then relogging as Administrator. That worked. Torture it. For the record,
in the above, the acutal name of astropc is astropc2004, 11 chars. I abbreviated it
here, but maybe there's some funny character limitation going on.

I thought I would just try Network Places (Computers Near Me) right now. I got a
message saying that my Galaxy workgroup (for my local network) is not available, and
neither is the list of servers for the workgroup. I just did it again, and it's OK.
Both computers are listed. Maybe it had to do with turning the firewall on/off 30
minutes ago. It sure is tempermental. The two computers can ping each other without
difficulty.


--
Wayne T. Watson (Watson Adventures, Prop., Nevada City, CA)
(121.015 Deg. W, 39.262 Deg. N) GMT-8 hr std. time)
Obz Site: 39° 15' 7" N, 121° 2' 32" W, 2700 feet

Web Page: <home.earthlink.net/~mtnviews>

 

[David Candy]

Why are you expecting a date change? You won't get one. The times MUST be close else it won't work. If the computers are different dates it won't synch.