Accessing the 64-bit Registry

I knew there had to be a way for a 32-bit application to access the 64-bit registry on a 64-bit system, and I finally found it. Don’t ask me what I think of the way Live Search works on the MSDN site, however: the answer would curl your hair.

What I needed to know is mostly buried in an MSDN article called Accessing an Alternate Registry View, which is in the MSDN tree under MSDN / MSDN Library / Win32 and COM Development / Development Guides /Programming Guide for 64-bit Windows / Running 32-bit Applications.

Normally, a 32-bit application only sees the 32-bit registry, and a 64-bit application sees the whole registry. The 32-bit registry is filed under the Wow6432Node key. Looking under the Wow6432Node key is bad practice, however, since that location may change in the future.

Basically, if an application that wants to scan the whole registry detects that it is running on 64-bit Windows, it needs to scan the registry twice: once to get the 32-bit registry keys, and once to get the 64-bit registry keys. Two flags apply:

These flags can be specified in the samDesired parameter of the following registry functions:

• RegCreateKeyEx
• RegDeleteKeyEx
• RegOpenKeyEx

Once you have opened a key with one of these flags, subsequent enumeration of the registry continues from the key you opened. Your application does have to be careful to be consistent: if a 32-bit application decides to delete a key that it found using the KEY_WOW64_64KEY flag, it had better use the same flag on the RegDeleteKeyEx call.

By the way, you can simulate the registry view of a 32-bit application for yourself. On a 64-bit system, there are two copies of Regedit. Running “regedit” launches the 64-bit version. Running “c:Windowssyswow64regedit.exe –m” lets you launch the 32-bit version. The “-m” flag allows multiple instances of the Registry Editor to be open.