KEY_WOW64_32KEY not redirecting from x64 application

1

votes

I have an x64 application running on a x64 OS where i'm trying to read from the x86 registry.
This is my code:

RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Idontexist", 0, KEY_READ | KEY_WOW64_32KEY, &hKey);

I want to try to open HKCU\Software\Wow6432Node\Idontexist, but instead it's opening HKCU\Software\Idontexist.

I watched in process monitor and if I use KEY_WOW64_64KEY or KEY_WOW64_32KEY, both try to read HKCU\Software\Idontexist, instead of HKCU\Software\Wow6432Node\Idontexist.

EDIT: OS is Windows 7 if that makes any difference.

c++winapiregistry

2

votes

What keys are redirected and reflected on Windows 7 is shown in detail in this MSDN page. Too large to reproduce here, but you can clearly see that the HKCU\Software key, other than the Classes subkey, is shared, not redirected.

0

votes

Wow6432Node implies WOW64 virtualization. A 64-bit process can open a 32-bit virtualized key directly:

RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Wow6432Node\\Idontexist", 0, KEY_READ, &hKey);

If you need the same code to run in both 32-bit and 64-bit and both access the Wow6432Node key, then use IsWow64Process() in the 32-bit code to detect WOW64 and then adust the code accordingly, eg:

#ifdef _WIN64
RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Wow6432Node\\Idontexist", 0, KEY_READ, &hKey);
#else
BOOL bIsWow64 = FALSE;
IsWow64Process(GetCurrentProcess(), &bIsWow64);
DWORD Wow64Flags = (bIsWow64) ? KEY_WOW64_32KEY : 0;
RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Idontexist", 0, KEY_READ | Wow64Flags, &hKey);
#endif

However, you really shouldn't be accessing Wow6432Node directly. KEY_WOW64_32KEY should be working correctly if the target key is properly separated into 32-bit and 64-bit views:

DWORD Wow64Flags;
#ifdef _WIN64
Wow64Flags = KEY_WOW64_32KEY;
#else
BOOL bIsWow64 = FALSE;
IsWow64Process(GetCurrentProcess(), &bIsWow64);
Wow64Flags = (bIsWow64) ? KEY_WOW64_32KEY : 0;
#endif
RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Idontexist", 0, KEY_READ | Wow64Flags, &hKey);

If that is not working, than that implies that Software\\Wow6432Node\\Idontexist should not have existed in the first place, and was probably incorrectly created by a 64-bit process that did not use KEY_WOW64_... flags correctly.

KEY_WOW64_32KEY not redirecting from x64 application

2 Answers