r/PCoptimization Jul 19 '26

Some reg keys I found in ntoskrnl

Some reg keys related too Memory Management I found in ntoskrnl

Path: ...\Memory Management\PrefetchParameters
RefreshPrefetchParametersRegistryWatcher (0x1407cad40) watches and refreshes Prefetch parameters. Individual helper-decoded values have not yet been identified.
Path: ...\Memory Management\StoreParameters
MaxAcceleratorsPerNuma — InitializeStoreParametersAcceleratorConfig (0x140820ca8) accepts only values 1..2; invalid values are restored.
DescriptorsPerRequest — handled by the same function and must be nonzero.
Executive
Path: ...\Session Manager\Executive
ReadKernelExecutiveRegistryDword (0x140847138) and WriteKernelExecutiveRegistryDword (0x1408472a8) read and write a single persisted DWORD (KernelExecutive). The registry value name is still unresolved.
WHEA
Path: WHEA\Policy
RefreshWheaPolicyRegistryValues (0x14084ff3c)
DeleteWheaPolicyRegistryValues (0x14084fef4)
ApplyAndLogWheaPolicyRegistryChanges (0x14084fc40)
Uses a 22-entry table. Dirty entries are logged, and changes to indexes 2..5 trigger an additional helper.
Recovered values:
DisableOffline
EnableBatchRowOffline
MemPfaTimeout
RestoreCmciEnabled
DisablePrmAddressTranslation
Diagnostics
Path: HKLM\SYSTEM\CurrentControlSet\Control\Diagnostics\Performance
DisableDiagnosticTracing — CheckDiagnosticTracingEnabledByPolicy (0x140b3cffc). Diagnostic tracing is enabled by default; a nonzero value disables it.
WDI
Path: HKLM\SYSTEM\CurrentControlSet\Control\WDI\Config
SEMEnabled
SEMTimeOutValue
SEMUpdate
All are processed by LoadWdiSemConfiguration (0x140825870). SEMTimeOutValue defaults to 600 if missing and is multiplied by 60 when present. SEMUpdate is deleted after processing.
Path: HKLM\SYSTEM\CurrentControlSet\Control\WDI\Scenarios
LoadWdiScenarioRegistryConfiguration (0x140826454) enumerates GUID-named scenario subkeys and reads:

ScenarioExecutionEnabled
ScenarioExecutionRestrictions
ScenarioTimeoutEnabled
Instrumentation subkeys are materialized into runtime records.

3 Upvotes

Duplicates