How to determine if a registry key is redirected by WOW64?

Posted by Luke on Stack Overflow See other posts from Stack Overflow or by Luke
Published on 2010-04-22T17:10:41Z Indexed on 2010/04/22 17:33 UTC
Read the original article Hit count: 340

Filed under:
|
|

Is it possible to determine whether or not a given registry key is redirected?

My problem is that I want to enumerate registry keys in both the 32-bit and 64-bit registry views in a generic manner from a 32-bit application. I could simply open each key twice, first with KEY_WOW64_64KEY and then with KEY_WOW64_32KEY. However, if the key is not redirected this gives you exactly the same key and you end up enumerating the exact same content twice; this is what I am trying to avoid.

I did find some documentation on it, but it looks like the only way is to examine the hive and do a bunch of string comparisons on the key. Another possibility I thought of is to try to open Wow6432Node on each subkey; if it exists then the key must be redirected. I.e. if I am trying to open HKCU\Software\Microsoft\Windows I would try to open the following keys: HKCU\Wow6432Node, HKCU\Software\Wow6432Node, HKCU\Software\Microsoft\Wow6432Node, and HKCU\Software\Microsoft\Windows\Wow6432Node. Unfortunately, the documentation seems to imply that a child of a redirected key is not necessarily redirected so that route also has issues.

So, what are my options here?

© Stack Overflow or respective owner

Related posts about Windows

Related posts about registry