May 132011

Kheb Screenshot

File system and registry discovery tool


Kheb allows you to see exactly what changes any software makes on your Windows Mobile Pocket PC. It works by taking complete snapshots of your PPC’s state, and creating a diff file that shows the changes between snapshots.

Kheb is a useful tool for software developers, ROM chefs, and advanced users.

Examples of useful stuff Kheb can do

• Shows you where an application places its files – for example, sometimes the executable and shortcuts are placed in obscure locations, with Kheb you can always find them

• Security – See for yourself if dubious applications install sneaky registry settings to auto-load, or if they leave traces behind after being uninstalled.

• Helps create a custom CAB or OEM package based on an existing CAB, even if the CAB uses setup.dll to run code during installation. Great for aspiring ROM Chefs.

• Gives you a deeper understanding of how system settings work under the hood.

• Tells you exactly where an application hides its “registration information” after you enter a valid serial number. It can help you avoid going through annoying registration schemes over and over. Note that Kheb isn’t a hacking tool – you still need to properly register first, though Kheb could be used to easily create pre-registered releases.

• Helps you learn – if you’re a software developer, studying real-life examples of registry changes will let you find interesting and useful hooks into the system that you can use in your own software.


• Requires .NET Compact Framework 3.5

• Please read the help file accessible through the menu for usage instructions.

• A complete snapshot of your device can take several minutes, so be patient…

• If you have network mapped storage, you will probably want to exclude the network directory in kheb.ini.

• I’d like to hear about your experience using Kheb – bug reports, feature requests, usability suggestions are all appreciated.

• If you create a release using Kheb, I’d appreciate it if you mention the program. Thank you!

This free software is provided AS IS, and you, its user, assume all risks when using it.

If you find Kheb useful, and want to support my efforts, please consider a small donation:

For download and feedback, see XDA thread.


• Improved storage card detection algorithm.
• Improved error reporting – info about the exact problematic registry key\file is written to error.log file.
• Improved error handling – Kheb recovers from most IO problems (permissions, unconnected network filesystems, etc) and continues running.
• New icon
• “Generate OEM from diff” item is only enabled if there are existing diffs.
• Latest diff is auto selected
• More entries in kheb.ini

• Initial public release

Ideas for a future version
• gui editor for kheb.ini file
• ability to pause\abort Kheb operation
• ability to run in the background with lowered priority
• Separate kheb.ini into 2 files to allow retaining user setting when upgrading version
• Ability to add description to diffs
• XDA_UC compatible .reg
• Ability to name snapshots, not just diffs

Compatibility: Microsoft Windows Mobile 6.1 to 6.5.3

Price: Free!

If you find Kheb useful, and want to support my efforts, please consider a small donation: