Search code examples
windowsvisual-c++registrywow64

Why would an access to the 32-bit view of HKEY_CURRENT_USER registry hive fall back to 64-bit view?

My 32-bit application is running on 64-bit Windows 7. I am trying to access the registry HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall. I can see in regedit that I have several subkeys below the Uninstall key in the default 64-bit registry view (Dropbox creates a key in that location, as well as Google Chrome). However, there is really no Uninstall key in the 32-bit registry view. Actually, in regedit there is only a single Active Setup key below HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft. There is not even a Windows subkey below Microsoft.

However, when my 32-bit application tries to access the 32-bit registry view of HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall, I get the keys from the 64-bit view. Why is that?

Even the flag KEY_WOW64_32KEY won't help here. Our code needs to know whether the results are from the 32-bit view or the 64-bit view.

Our code also accesses both the 32-bit and 64-bit views of the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall and I do not see this issue there. The difference is that the 32-bit view of HKLM has an Uninstall key and the 32-bit view of HKCU does not.

I know the registry redirection of WoW64, but this seems different. I could not really find any useful information on MSDN. Could someone shed some light on this?

Solution

  • This is documented, but only indirectly. This MSDN page lists HKLM\Software as redirected and HKCU\Software as shared.

    Note: in this context redirected means that there are two registry views, one for 32-bit and one for 64-bit (in other words: the Wow6432Node subkey exists and is used), whereas shared means that there is only one view for 32-bit and 64-bit processes.

    And yes, it is interesting that HKEY_CURRENT_USER\Software\Wow6432Node exists. As the OP mentioned there is only a subkey Microsoft\Active Setup\Installed Components below that - which is probably there because the autors of the Active Setup code at Microsoft incorrectly used the Wow6432Node as subkey path in their registry API calls instead of specifying the desired view via the samDesired parameter of RegOpenKeyEx.