Why 64bit Process writing to 32bit registry hive

0
votes

I have a PowerShell script that I wrap with NSIS script to create .exe

PS script writes value to HKEY_LOCAL_MACHINE\SOFTWARE\FolderName

However, I noticed that it is actually writing to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\FolderName

I am on 64bit OS. The default Hive should be 64bit and I am not setting or redirecting the registry to 32bit hive.

Executeable from NSIS writes to 32bit Hive. If I run PS script in ISE, it write to 64bit hive, as expceted.

So, I do not know why it is writing under WOW6432Node when wrapped in NSIS. Anything I need to look at?

2
powershellregistryregistrykey
Default hive depend not from OS bitness, but from process bitness. It is very likely that NSIS invokes 32-bit PowerShell. - user4003407
@PetSerAl I think you are right. While researching, I noticed that, but was not sure as I am pretty new to PS/NSIS. How can I invoke it from 64bit instance? - Omar
I am not familiar with NSIS, so I can not help you here. - user4003407

2 Answers

1
votes

If you're running the script of 64bit machine, this would work.

   ${If} ${RunningX64}
        ${DisableX64FSRedirection}
    ${EndIf}

    # put your code here

    ${If} ${RunningX64}
       ${EnableX64FSRedirection}
    ${EndIf}
0
votes

As per my knowledge, NSIS uses two Win32 APIs to execute processes ShellExecute and CreateProcess

If your Operating System is 64 bit then both of them can run 64 bit process (x64) from NSIS 32 bit process.

The issue what you have faced is because it might have invoked a 32 bit PS. So double check on that part.