WINCSS.REG — Binary Registry Payload

This page documents the WINCSS.REG file provided with ConstructiVision v3.60 media.

Warning

WINCSS.REG is not a plain-text .reg export. It is a compiled InstallShield registry payload in CREG format.

File Characteristics

Property

Value

Filename

WINCSS.REG

Size

8,192 bytes (8 KB)

Format

InstallShield CREG

Location

src/x86/v3_60/v3.60/

Binary Structure (Hex Analysis)

Offset  Bytes                           ASCII
------  ------------------------------  -----
0x0000  43 52 45 47 00 00 01 00         CREG....
0x0008  00 10 00 00 00 00 00 00         ........
0x0010  01 00 21 00 00 00 80 00         ..!....
0x0020  52 47 4B 4E E0 0F 00 00         RGKN....

Confirmed Signatures:

  • CREG at offset 0x00 — Compiled Registry header

  • RGKN at offset 0x20 — Registry Key Names section

This is the InstallShield Compiled Registry format used by InstallShield 5.x/6.x installers (circa 1998-2002).

Format Details

Offset

Value

Meaning

0x00-0x03

CREG

File signature

0x04-0x07

0x00010000

Version (1.0)

0x08-0x0B

0x00001000

Block size

0x20-0x23

RGKN

Key names section

The file contains encoded registry keys and values that the InstallShield installer applies during setup.

Extractable Strings

Due to encoding, only fragments are readable:

  • Registrationq — Likely part of a registry key path

  • VVj1j — Encoded data

Probable Registry Targets

Based on v7.0’s wincss2000.exe (which uses the same CSS licensing system), this file likely writes to:

HKLM\Software\ConstructiVision\CSS\1.0
HKLM\Software\ConstructiVision\CSS-LT\1.0

CSS = Credit Software System (ConstructiVision’s licensing subsystem)

Probable values:

  • License ID / hardware fingerprint

  • Panel credit count (trial panels)

  • Registration status

  • Authorization code hash

How It’s Used

The InstallShield installer (setup.exe / setup.ins) reads WINCSS.REG and applies the registry entries during installation Phase 11 (see Installer Sequence Analysis).

Installer runs
    ↓
Reads WINCSS.REG (CREG format)
    ↓
Decodes registry entries
    ↓
Writes to HKLM\Software\ConstructiVision
    ↓
Wincss.exe reads these keys for license validation

Comparison with v7.0

Aspect

v3.60

v7.0

File

WINCSS.REG (8 KB)

wincss2000.exe (84 KB)

Type

CREG payload

Standalone executable

Registry Access

Written by installer

Managed by exe directly

Readable

No (encoded)

Yes (strings extractable)

Decoding Options

To fully decode WINCSS.REG:

  1. Unshield — Open source InstallShield extractor

    pip install unshield

  2. InstallShield Cabinet Tools — Legacy tools on archive.org

  3. Custom CREG Parser — The format is partially documented:

    • CREG header defines sections

    • RGKN section contains key names

    • Values follow in encoded form

  4. Install Trace — Run installer in VM, capture registry with Procmon