What is the difference between the ShowSuperHidden and SuperHidden registry values?

Question

Under the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

...there are two well-documented values that pertain to the showing of hidden files and folders in Windows Explorer.

The Hidden key shows hidden files when true, and hides them when false.

The ShowSuperHidden key is generally acknowledged as its equivalent for "super hidden" (i.e. protected/system) files; it shows super-hidden files when true, and hides them when false.

That said, where does the SuperHidden value come in? Its name suggests it would be the natural analogue to the Hidden key, but documentation on it and what it does is non-existent as far as I've been able to tell.

What is the purpose of the SuperHidden value, and how does it differ from ShowSuperHidden?

Solution

ShowSuperHidden, as we discovered, controls whether super-hidden (Hidden + System) files are displayed. As far as I can tell, SuperHidden controls nothing and its existence is probably a programming error.

Using Process Monitor, I observed reads from and writes to these Registry values. The only interaction with SuperHidden was a write when the user opened the View tab of the Folder Options dialog. It received a 1 if super-hidden files are displayed, 0 otherwise. It was never read, even when I terminated and restarted Explorer.

Procmon provides the stack that led to a monitored operation (double-click an event and consult the Stack tab), so I examined the DLL files involved using IDA v5.0. The only relevant one with a mention of SuperHidden was shell32.dll. The CachedShellState::SaveAdvancedSettings function issues a Registry write to that value and others in that key, committing the current view settings.

Explorer apparently calls that function before showing the View tab. That's probably done to make sure the Registry is consistent with the current in-memory settings before loading the current state of the View options, though I admit I'm not 100% certain on the reasoning. Anyway, the corresponding shell32.dll function CachedShellState::_GetAdvancedSettings issues a read from the correct value, ShowSuperHidden.

These disassembly listings are from the Windows 7 version of that DLL. In Windows 10, SuperHidden does not exist in the Registry, and CachedShellState::SaveAdvancedSettings writes to ShowSuperHidden.

Therefore, I conclude that when programming the version of that function that comes with Windows 7, a developer mistakenly omitted the Show in ShowSuperHidden, but the error was corrected along the way to Windows 10.

For the curious, the Folder Options dialog isn't broken by this error because it consults the ValueName entry under each setting key here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder

Working out the significance of the other parts of that branch is left as a (fun!) exercise to the reader.

Comments

[Biswapriyo]

How did you find it is shell32.dll? Process Monitor shows explorer.exe changes this registry?

[Ben N]

@Biswa Right, explorer.exe is the process responsible for the change, but it is code inside shell32.dll (which Explorer loads) that makes the call. To see DLLs involved, double-click an event and switch to the Stack tab. The frame before kernel32.dll or kernelbase.dll is usually a good one to investigate, but it's not always clear, which is why I checked several DLL files.

[Hashim Aziz]

+1, some great detective work here. Based on this it seems pretty conclusive that the SuperHidden key was a mistake. The OCD in me really wishes they'd actually used that key instead of ShowSuperHidden, just for the sake of naming consistency with Hidden.

[Vomit IT - Chunky Mess Style]

Very nice +1 and on the other post as well.

[Biswapriyo]

Why Windows 10 shell32.dll shows a different address of Show SuperHidden? image.

[Ben N]

@Biswa Good question! Different compiler/linker versions sometimes lay out the output files differently. Additionally, I think that screenshot is from a 64-bit version, while mine are from 32-bit systems, which will cause addresses and sizes to be different.

[Todd]

I joined SuperUser to upvote this! You included a number of useful things in addition to SuperHidden: another use of ProcMon, the incredible IDA tool, plus the tips in the linked question. Thank you!