Proposals / #659

Registry save and delete entry points take character-string keys

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

The first stack argument of SRegDeleteValue, SRegSaveData and SRegSaveString is a NUL-terminated character key, not uint*. Each wrapper tests its first byte (00414d96/00415006/00415078) and forwards the same address to a worker that appends its bytes to the registry path. The complete delete/save workers pass that path to RegOpenKeyExA or RegCreateKeyExA. All 33 incoming calls pass one of three literal strings: "Diablo II", "Configuration" or "Patch"; there are no data xrefs. Retype only Stack[4] to char* in these three entry points, preserving existing names, returns, remaining arguments, stdcall and RET 0xc/0x14/0x10. Worker register storage is unchanged. Complete target/worker/append bodies and every changed argument's caller setup were checked against the original Windows PE. No Mac pairing, API-table or runtime claim.

Changes 3, applied together

1. Retype variable win 0x00414d90 Stack[0x4]

   typeuint *→char *

2. Retype variable win 0x00415000 Stack[0x4]

   typeuint *→char *

3. Retype variable win 0x00415070 Stack[0x4]

   typeuint *→char *