6

I have a 32 bit application which has to add a value to x64 bit portion of the registry.

I want to do it through utilization of regedit.exe -s fileWithKeys.reg, However when I try to span regedit (in the code of the application, I utilized C:\windows\sysnative directory) then I get 32 bit version. I need to span x64 bit version of the tool (regedit) in order to add these keys to proper x64 bit node.

I found out that I can simulate this by running C:\Windows\SysWOW64\cmd.exe and calling C:\Windows\regedit.exe from there. I am not able to run 64 bit version because it seems to run the 32 bit version of regedit instead.

Is there a way to do it ?

  • 3
    Why not ... use the Registry API in app instead of spawning a command process? msdn.microsoft.com/en-us/library/windows/desktop/… – Zypher May 6 '14 at 22:44
  • 1
    Basically my strategy is - if there is a tool that is well tested then use it. – Darqer May 7 '14 at 0:05
  • 1
    OK, I've edited your question, and now think I understand the issue. So, question - do you have use the 32 bit version of cmd.exe to call regedit? It seems like it would be inifintely easier to just call C:\Windows\cmd.exe that the 32 bit version in SysWOW 64. So... is that not an option for some reason? And why not? – HopelessN00b May 7 '14 at 12:13
6

In 64-bit Windows, there exists what are called file system and registry redirection. These exist for compatibility with older applications that were written for 32-bit Windows and for applications designed for older versions of Windows. WoW64 hooks all system calls made by 32-bit processes, such that if my 32-bit application running on a 64-bit version of Windows calls C:\Windows\System32, WoW64 will transparently redirect it to C:\Windows\SysWoW64, etc.. The C:\Windows\Sysnative virtual directory points you to the native version (the 64-bit version) of the directory, regardless of the bitness of the thread referencing that file system path.

A similar mechanism exists for the registry, which is what the WoW6432Node key is all about. Technically I would call these 32-bit and 64-bit views of the registry if I wanted to be concise... Or pedantic.

I wrote some code (in C#) not too long ago for accessing a key in the native (64-bit) portion of the hive from within a 32-bit process. Here's an abridged snippet:

// Accessing 64-bit registry key from 32-bit process
enum RegAccessFlag
{
    NONE                   = 0,
    KEY_QUERY_VALUE        = 0x0001,
    KEY_SET_VALUE          = 0x0002,
    KEY_CREATE_SUB_KEY     = 0x0004,
    KEY_ENUMERATE_SUB_KEYS = 0x0008,
    KEY_NOTIFY             = 0x0010,
    KEY_CREATE_LINK        = 0x0020,
    KEY_WOW64_64KEY        = 0x0100, // This is the ticket
    KEY_WOW64_32KEY        = 0x0200,
    KEY_WOW64_RES          = 0x0300
}

public static UIntPtr HKEY_LOCAL_MACHINE = new UIntPtr(0x80000002u);

[DllImport("advapi32.dll", CharSet = CharSet.Auto)]
public static extern int RegOpenKeyEx(UIntPtr hkey, string subKey, int ulOptions, int samDesired, out UIntPtr hkResult);

static void Main(string[] args)
{
    int statusCode = RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE", 0, (int)RegAccessFlag.KEY_WOW64_64KEY | (int)RegAccessFlag.KEY_QUERY_VALUE, out hKey);
}

Of course you still need to read a value from the key once you've opened it, or create a new value, then remember to close the key once you're finished, but that would get you started if you cared to write any code.

But since you are talking about spawning a 32-bit process from another 32-bit process, so that child process can access the native view of the registry, on a 64-bit platform... you're dealing with a combination of both file system redirection and registry redirection both getting in your way. And to top all that off, regedit.exe is a bit of a special utility in this regard.

TL;DR: Give C:\Windows\sysnative\regedt32.exe a try instead of regedit.exe.

https://stackoverflow.com/questions/12233396/open-64-bit-regedit-from-32-bit-application

  • 1
    Thanks! I was able to use your answer to get the reg tool working under MSYS bash, which is a 32-bit app: $WINDIR/sysnative/reg – dOxxx Aug 15 '15 at 1:12
3

The default version of regedit.exe on a 64 bit Windows OS is the 64 bit version.

The regedit executable located in C:\Windows\SysWOW64 is the 32 bit version, and the executable in C:\Windows is the 64 bit version.

So... that's why you're seeing the 32 bit version when you run it from SysWOW64. Because you are running the 32 bit version. SysWOW64 is where the 32 bit version is located, and where it's used from (since it's run by the 64 bit system to allow compatibility).

You can verify/check which version of regedit you're running via the existence of the Wow6432Node key under HKEY_LOCAL_MACHINE\SOFTWARE. When you run regedit from C:\Windows, that node will exist (it displays the 32 bit version of your registry keys). If you run regedit from C:\Windows\SysWOW64 that key won't exist, because you're already viewing the 32 bit registry.

C:\Windows\regedit.exe <=> 64 bit version of regedit.
C:\Windows\SysWOW64\regedit.exe <=> 32 bit version of regedit.

  • I'm affraid that some redirection is going on, because when I run c:\windows\regedit.exe from cmd.exe located in c:\windows\sysWOW64 i get 32 bit version – Darqer May 6 '14 at 23:13
  • Information in TaksManager, under Processes tab it informs you about 'bitness' of the application (* or (32bit) says that app is 32 bit). The other area is the method you provided, there are not additional keys in the registry. – Darqer May 6 '14 at 23:49
  • Did you run c:\syswow64\cmd.exe and tried to run c:\regedit.exe, from this cmd ? – Darqer May 7 '14 at 0:02
  • 2
    @Darqer is saying that they are starting regedit from a 32bit cmd.exe (from the syswow64 dir). It's not clear why they want to do so but maybe that actually leads to this behavior? – Håkan Lindqvist May 7 '14 at 7:10
  • 1
    @HåkanLindqvist That's the missing piece. Yes, if you run the 32 bit version of cmd.exe, it opens a 32 bit version of regedit. Weird. Gonna see what I can learn about that if I get the chance today. – HopelessN00b May 7 '14 at 11:27
1

Seems that "%systemroot%\regedit.exe" also does some kind of redirection.

Starting from Vista, this works when you are running 32-bit cmd in 64-bit system:

"%systemroot%\sysnative\cmd.exe" /c "%systemroot%\regedit.exe"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.