May 2011

You are browsing the site archives for May 2011.

That one recently cost me a couple of hours and quite a bit of nerves to figure out: In a 64bit Windows, if a 32bit process accesses the Registry, it actually interacts with a DIFFERENT registry than a 64bit process. This means that your 32bit compiled program potentially reads and writes different registry keys than the same program compiled for 64bit! I’m sure you can imagine how this might result in seemingly strange behavior if you don’t know that. Windows Registry FTW, right?

Since regedit.exe runs as a 64bit process, you can usually only see the 64bit registry, but what if you want to see/change 32bit entries? It turns out you can do that if you know how this registry redirection works. In every node in the (64bit) registry there CAN be a child node with the name “WOW6432Node” that contains the 32bit entries that override/amend the 64bit entries. The only WOW node that I could find in my registry was in HKLM\SOFTWARE, but the concept works for every other part of the registry.

Source: http://msdn.microsoft.com/en-us/library/aa384253%28v=vs.85%29.aspx