Hkey_local_machine Software Wow6432node

0 views
Skip to first unread message

Elenio Guardado

unread,
Aug 4, 2024, 5:27:56 PM8/4/24
to montsandseabca
Whenyou install a new program or when you run a program on a Windows x64 Edition computer, registry calls made by 64-bit programs access the HKEY_LOCAL_MACHINE\Software registry sub key without redirection. WOW64 intercepts registry calls to HKEY_LOCAL_MACHINE\Software that are made by 32-bit programs, and then redirects them to the HKEY_LOCAL_MACHINE\Software\WOW6432node sub key. By redirecting only the 32-bit program calls, WOW64 makes sure that programs always write to the appropriate registry sub key. Registry redirection does not require program code modification, and this process is transparent to the user.

So, you can't write to HKEY_LOCAL_MACHINE\Software\WOW6432node directly from a 32 Bit application (which AutoIT is). However, you don't have to write to that Key directly . If a 32 Bit application writes to HKEY_LOCAL_MACHINE\Software WOW64 intercepts that call and redirects it to HKEY_LOCAL_MACHINE\Software\WOW6432node. So, just write to HKEY_LOCAL_MACHINE\Software\ and your programm will work just fine. Reading is the same!


So, you can't write to HKEY_LOCAL_MACHINE\Software\WOW6432node from a 32 Bit application (which AutoIT is). However, you don't have to write to that Key directly . If a 32 Bit application writes to HKEY_LOCAL_MACHINE\Software WOW64 intercepts that call and redirects it to HKEY_LOCAL_MACHINE\Software\WOW6432node. So, just write to HKEY_LOCAL_MACHINE\Software\ and your programm will work just fine. Reading is the same!


This is what i have to detect if the program is running on a x64 box. I didnt have this code before and it still wrote the code to HKEY_LOCAL_MACHINE\SOFTWARE\. now that i have the code it still writes the code to HKEY_LOCAL_MACHINE\SOFTWARE\ eventhough i tell it to write to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node


On the bright side though, this should give... arg i forget the name, but there was someone that wanted a way to find out if the xp their program was running on was 64bit... seems like that registry node would be a good thing to check for to tell....


I may have my signals crossed on how the wow6432node key works, but a 32 bit program should be able to read 32 bit registry entries in the HKLM\software\wow6432node key. Not just the 64 bit entries in the HKLM\software key.


idea... what if you export the registry, and then read it in with auto it, are the values you need exported and read? seems like they should be.... then you could just read it back in with your program and read that data instead of reading direct from the registry


Do you know of any way to export remote registry entries? It appears that the reg command only handles local registries. :"> If I can get remote registry entries exported, than this would probably solve my problem...

3a8082e126
Reply all
Reply to author
Forward
0 new messages