PDA

View Full Version : Display 64 bit part of registry on 64 bit systems


PepiMK
2007-12-16, 19:54
Situation: On 32 bit Windows, there's just one "type" of registry; but on 64 bit Windows, 32 bit applications see, for some subkeys, a different part than 64 bit applications.

Experienced: RegAlyzer behaves like a 32 bit application.

Expected: Even 32 bit applications can access the 64 bit registry part, which should be possible in RegAlyzer to allow the user to browse the full registry.

PepiMK
2007-12-18, 23:38
Problem found in reading these keys probably, a slight inconsistency in the Windows API when accessing 32 vs. 64 bit. Good chance to have a new version this year therefore :)

PepiMK
2007-12-20, 16:56
Used a slightly different approach than the official regedit.exe one, since the Wow6432Node linking is kind of silly implemented.

Screenshot on how we attempt it:
http://www.safer-networking.org/images/regalyzer/bits6432.png

Pythagoras
2008-02-05, 23:11
Hi,

nice to see what you put in this new version for 64bit. I can confirm that 1.5.6.8beta on Vista 64bit German does not show the "endless" loop problem. Search proceedes and comes to an end finally.

I like the tree display of 32 and 64. I will need to review this some time to find out if the content is plausible, at first glance it seems okay. Some applications appear in both sections if they have a 64bit portion installed.

If you start searching at the root "My Computer" or at "HKLM" of the registry it seems you omit the 64bit part in my test case. Is this "works as designed" or a bug?
This is likely not what a damn user would expect. ;-)
Only if i select the "64 Software" icon as base for search the following keys are found when looking for "\Users\":

Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\
Name: "Default"
Value: "%SystemDrive%\Users\Default"

Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\***your local profile IDs***\
Name: "ProfileImagePath"
Value: "C:\Users\**your user name**

Maybe you can add a "tag" / "flag" / "column" or someting alike to the search result windows to mark 64bit results like in the tree.

Greetings
Pythagoras