The first part is the app exe name in null-terminated Unicode, which is easy enough. Past that, each level of the path is included, first in non-Unicode, then Unicode (except for the path root/drive, which is just non-Unicode), but separated by unknown data structures.
My underlying problem is that the .Net Reportviewer control's UI export button calls the common dialog, but the control doesn't expose any way of setting the initial folder. I'd like to reliably read/write these keys to manage default open/save behavior.
Example registry key dump (app is notepad.exe, path is "C:\Stuff\DLTemp\HattoriHanzo"):
"10"=hex:6e,00,6f,00,74,00,65,00,70,00,61,00,64,00,2e,00,65,00,78,00,65,00,00,\ 00,14,00,1f,50,e0,4f,d0,20,ea,3a,69,10,a2,d8,08,00,2b,30,30,9d,19,00,2f,43,\ 3a,5c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,4c,00,31,00,\ 00,00,00,00,87,48,c0,8a,10,00,53,74,75,66,66,00,38,00,08,00,04,00,ef,be,7b,\ 44,5a,69,87,48,c0,8a,2a,00,00,00,1f,d8,01,00,00,00,ca,04,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,53,00,74,00,75,00,66,00,66,00,00,00,14,00,50,00,31,\ 00,00,00,00,00,87,48,b1,95,10,00,44,4c,54,65,6d,70,00,00,3a,00,08,00,04,00,\ ef,be,1c,45,60,7e,87,48,b1,95,2a,00,00,00,61,5b,02,00,00,00,62,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,44,00,4c,00,54,00,65,00,6d,00,70,00,00,00,\ 16,00,5e,00,31,00,00,00,00,00,87,48,ca,9a,10,00,48,41,54,54,4f,52,7e,31,00,\ 00,46,00,08,00,04,00,ef,be,87,48,ab,90,87,48,ca,9a,2a,00,00,00,e3,e3,04,00,\ 00,00,0e,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,74,00,74,\ 00,6f,00,72,00,69,00,48,00,61,00,6e,00,7a,00,6f,00,00,00,18,00,00,00
You can decode the remaining bytes using the SHGetPathFromIDListW Windows API call.
For example, see the C# implementation of it at https://svcperf.codeplex.com/SourceControl/latest#src/Viewer/UIUtils/MruFileHelper.cs , but that class decodes OpenSavePidlMRU, which doesn't contain the executable name. You can do the same with the remaining bytes that you get from LastVisitedPidlMRU.