What's the format of the DefaultConnectionSett

Question

The Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections contains a binary value called DefaultConnectionSettings that stores all sorts of data about the user's proxy configuration. What's the exact format of this data?

All I have been able to find out so far is what's in this forum post, which is by no means complete and seems to be wrong in some respects.

Answer 1

Steven's answer is quite complete, just the many "placeholders" surprised me. My researches show, that most of them are in fact 32-bit integers stored in little-endian format (i.e. lowest byte first, i.e. 0xa1b2c3d4 ist stored as 0xd4 0xc3 0xb2 0xa1). This makes the magic DefaultConnectionSettings pretty simple:

4 bytes int: 0x46 or 0x3C (whatever that means)
4 bytes int: counter, increment upon every change
4 bytes int: proxy settings, i.e. a merge of these bits:
                                 0x1 always present
                                 0x2 enable manual proxy
                                 0x4 enable autoconfig
                                 0x8 enable autodetect
4 bytes int: length of proxyServer string (can be 0)
proxyServer string in ASCII (i.e. server:port)
4 bytes int: length of proxyOverrides string (can be 0)
proxyOverrides string in ASCII (domains separated by ; 
                                use <local> for local override)
4 bytes int: length of autoconfigUrl string (can be 0)
autoconfigUrl string in ASCII
4 bytes int: 0x00 or 0x01 (whatever that means)
31 bytes: 0x00 (whatever that means)

Answer 2

I have found this perhaps it helps you!

0.  keep this value
    1.  "00" placeholder
    2.  "00" placeholder
    3.  "00" placeholder
    4.  "xx" increments if changed
    5.  "xx" increments if 4. is "FF"
    6.  "00" placeholder
    7.  "00" placeholder
    8.  "01"=proxy deaktivated; other value=proxy enabled
    9.  "00" placeholder
    10. "00" placeholder
    11. "00" placeholder
    12. "xx" length of "proxyserver:port"
    13. "00" placeholder
    14. "00" placeholder
    15. "00" placeholder
    "proxyserver:port"
if 'Bypass proxy for local addresses':::
    other stuff with unknown length
    "<local>"
    36 times "00"
if no 'Bypass proxy for local addresses':::
    40 times "00"

Answer 3

Just want to expand upon Zain Ali's answer (as an answer, since I don't have enough reputation points to comment), and of Course, thank Zain for posting the information that they did as it helped me greatly when I was trying to figure the rest out.

Number 8 is a little more complicated than just showing that the proxy is disabled or not. It also sets two other checkboxes in the settings.

Setting number 8 to "01" unchecks the box to enable the proxy, and unchecks the box to "Automatically Detect Settings" and the box to use a script.

Setting number 8 to "0f" however enables everything.

To be clear, this 8th byte is basically setting flags. The least significant bit of the byte is always a "1" so far as i can tell. The second least significant bit is "1" if the manual proxy settings checkbox is checked. The 3rd least significant bit is a "1" if the box for using a script is checked and you provide an address for the script. The 4th least significant bit is to set the checkbox "Automatically Detect Settings" (basically, setting these bits to 1 checks the box, and 0 unchecks them)

I have gone for setting it to "03" which enables only the manual proxy

Also, "Other stuff with unknown length" doesn't seem to be correct as the length is known. Stuff after that is being referred to is the exception list for the proxy delimited by a semi-colon. The length of this list is the byte right after the "proxyserver:port". That, combined withe the 3 "00"s of padding accounts for the difference of 4 bytes that was mentioned as being different depending on what else you had.

0.  keep this value
1.  "00" placeholder
2.  "00" placeholder
3.  "00" placeholder
4.  "xx" increments if changed
5.  "xx" increments if 4. is "FF"
6.  "00" placeholder
7.  "00" placeholder
8.  "03"=enable proxy, enable auto detect settings, auto script etc
9.  "00" placeholder
10. "00" placeholder
11. "00" placeholder
12. "xx" length of "proxyserver:port"
13. "00" placeholder
14. "00" placeholder
15. "00" placeholder
"proxyserver:port"
    "xx" length of proxy exception list
    "00" placeholder
    "00" placeholder
    "00" placeholder
Proxy Exception list delimited by semi-colons (use "<local>" to exclude local addresses)
36 times "00"

I have spent quite some time trying to figure this all out so hopefully I haven't missed something.

I have made a batch script where you can give it the proxy server and port, along with your list of exceptions and it will automatically create the binary code and stick it into the registry where it needs to be (assuming that the 8th byte is "03").

It would be trivial to change the code to just print out the binary instead by just replacing the whole "reg add" line with "echo %data%".

Also note that the script i have provided below is changing the HKLM key as I was using the script to set a machine-wide proxy in conjunction with GPOs. Changing to HKCU instead should fix that.

That can be found here (if you are good with batch, feel free to make the script better as I am not greatly familiar with it and I think it will probably show in the code): https://gist.github.com/hallzy/b7dfba5f71c0251f1139f8c531cd7817

Answer 4

Rather than read/write the Registry value directly, you should be using WinInet's InternetQueryOption() and InternetSetOption() functions instead.

With that said, have a look at these:

How to set 'automatic configuration script' for a dial-up connection programmatically?

http://www.visualbasicscript.com/fb.ashx?m=76412