Highlighted
Absent Member.
Absent Member.
759 views

Windows: Reading 64bit registry data when your application is 32bit.

[Migrated content. Thread originally posted on 14 January 2011]

With the introduction of 64bit Windows some years ago, something new came in place, a shadow hive serving the numerous 32bits applications out there.

I will not go into the details about the diversion of registry access here, but state that the registry on 64bit Windows has a subkey under HKEY_LOCAL_MACHINE\SOFTWARE named Wow6432Node.

A 32bit application making inquiries on HKEY_LOCAL_MACHINE\SOFTWARE will effectively read under this key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node. The 64bit OS does this automatically, you won't notice.

For most, this is just fine, as what is there, is what a 32bit app usually would need to read from the HKEY_LOCAL_MACHINE\SOFTWARE hive.

In some special circumstances however, it might be necessary to read the native hive. As we shall see, it is actually quite easy to accomplish.

The key is the library function REG_OPEN_KEY_EX

Example:

CALL "REG_OPEN_KEY_EX" 
    USING OPEN-KEY-HANDLE, SUBKEY-TO-BE-OPENED, SAM-DESIRED, 
        SUBKEY-HANDLE, 
    GIVING STATUS-CODE


The variable SAM-DESIRED may be set to a number of values as defined in acugui.def, for instance KEY_QUERY_VALUE.

To read the 64bit hive from your 32bit applicaton, all you have to do, is to add 256 to the preferred value you set in SAM-DESIRED. Hence, if you have set SAM-DESIRED to KEY_QUERY_VALUE, it will have the value 1, add 256 to SAM-DESIRE.

When you now execute the function, it will have the value 257, which will turn off the redirection and allow you to read the native HKEY_LOCAL_MACHINE\SOFTWARE hive.

As always with the registry, don't do anything if you don't know what you do.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.