Freeware ListRegistryLinks Tool
ListRegistryLinks searches the registry for links of the type REG_LINK. Any links found will be printed out along with their respective targets. The tool is available both as 32-bit and 64-bit versions.
What Are REG_LINKs?
Registry links (internal type name: REG_LINK) seem to be one of the last great mysteries of Windows NT-based operating systems although they have been around since NT4 at least. Microsoft uses them to point the CurrentControlSet registry key to one of the actual ControlSets (typically 001 or 002). A registry link essentially is a symbolic link in the registry – one registry key pointing to another. The nice thing is that this whole pointing stuff happens completely opaquely to applications: if key A points to key B, and an application tries to access key A, it will actually see the contents of key B. The concept is simple, easy and powerful.
How to Manipulate REG_LINKs
There is only one problem: There is no officially documented way to list, create or delete REG_LINKs. The registry API simply does not have any functions for manipulating them. This makes things more difficult, but not impossible. Searching the net, I quickly found the excellent tool regln which comes with full source code and compiled both as 32-bit and 64-bit binaries. The source code of regln gave me the hints I needed: the internal NT API (not too well documented and hidden in ntdll.dll) contains the functions required for REG_LINK manipulation. With that information and some further research I put together a small command line program that scans the registry for REG_LINKs and lists those found along with their target: ListRegistryLinks.exe. The tool is available both in 32-bit and 64-bit versions.
Starting ListRegistryLinks.exe with the parameter -? prints the following help screen:
Recursively searches the registry for links (of type REG_LINK) below a given key. Each link found is displayed with its source and target keys.
The following registry hives are supported: HKLM and HKU. The option ‘-v’ enables output of keys that could not be processed because access was denied.
0: Successful execution
1: The help screen was printed, maybe because of invalid command line arguments
2: An error occured