What is the file format of settings.dat?

[treysis]

Some configuration of Winget is stored inside the settings.dat file inside %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\#

I want to change some setting inside this file manually/externally because Winget doesn't allow me to alter this setting (my user account is non-admin, so privilege escalation via UAC doesn't work). But I have no idea how this file is shaped. I guess it's a binary format? How would one change this?

Ok, it's a registry hive file (regf) that can be opened with regedit. However, it contains a datastream(?) with some hash/checksum. So editing would require recalculation and that is of course more complicated.

[Masamune3210]

Even if you were able to change it, chances are the option behind UAC would also fail without UAC due to your account not having the right permissions.

[Masamune3210]

What are you trying to change, anyway

[treysis]

I want to override wrong hashes via InstallerHashOverride and I want to be able to use local manifests via LocalManifestFiles.

Using those settings after enabling them in settings.dat shouldn't be a problem as those don't need elevated privileges and my Winget installation is a non-privileged installation as well: I just installed Winget via MS Store on my unprivileged account. It's not even available to the admin account. Requiring elevated privileges for so-called "admin settings" is a purely arbitrary limitation by the Winget devs.

[Trenly]

@denelon - do you have any thoughts to add?

[denelon]

Overriding SHA256 values is a potential security risk. That's why it requires running WinGet in the administrator context (or by Group Policy) to change the setting. The same concern exists for installing packages with a local manifest. If packages have an incorrect hash, a PR submitted to the community repository for the new installer would "fix" the hash mismatch for anyone trying to install the package.

[treysis]

What's the concern? I can just download the package and install it anyways, I just can't use winget to do it. I don't need admin rights to install winget, so why would I need admin rights to change some setting that is written in a user-writable file anyways?