3

I'm unsure whether I should put this question in Serverfault or Stackoverflow.

I'm developing a script (so 'press start->search' is not an option) and try to find out a way to find where an application was installed.

I already have the app SID. Looked at

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths and

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders but it didn't help for this app.

Creeping through the whole registry I found this path:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0019F09C4327ED11A893800002C0A966

Could anyone explain how can 0019F09C4327ED11A893800002C0A966 be calculated if I don't know it in advance?

I noticed that the key name here is mixed back-to-front application SID:

key 0E0D0A87 6588 CF44 08ED 156E22CA84C6
sid 78A0D0E0-8856-44FC-80DE-51E622AC486C

so I tried to search straight and reversed path numbers, just 0019F09C and reversed, but no luck.

In this question the application is PHP, but the solution should work for any app which is built according to MS rules (that is, don't just unzip itself somewhere but add proper data to the registry. I hope PHP do).

upd: screenshot to to Evan Anderson's answer to Evan Anderson's answer

1 Answer 1

1

You're looking at an application managed by Windows Installer. The installation is identified by a globally-unique identifier (GUID, which you are referring to as the "SID"). That GUID is used in the name of registry locations where information about the installation is stored. The difference in the appearance of the GUID in one place versus another is because the GUID is stored in some locations in the "packed" format, and other places as "unpacked". (Here's some background and code to pack / unpack GUIDs: http://www.dwarfsoft.com/blog/2010/06/22/msi-package-code-fun/)

Options that were specified during the installation of the package, assuming it was installed on a per-machine basis, would be located in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0019F09C4327ED11A893800002C0A966\InstallProperties.

In particular, the InstallLocation value is what you're looking for. This value can contain the directory that was chosen for an installation, but an installation package is not required to update this value.

Alternatively you can locate all the files associated with an installation package by substituting the packed GUID for the package in the following command:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components" /s | find "PACKED_GUID_HERE"

This will work with any installation package but may give you a very long, verbose list of files.

1
  • I reviewed ~300 sub-keys of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ content on my Win2003 but none of the sub-keys inside that branch contains InstallProperties or InstallLocation. All sub-keys look very similar, like on the screenshot (I added it to the question) The second part of the answer really gives very long list but I have no idea how to select the proper line (perhaps, the shortest?) without a human's help, automatically.
    – Putnik
    Jul 7, 2014 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .