How to determine if a registry key is redirected by WOW64?

Question

Is it possible to determine whether or not a given registry key is redirected?

My problem is that I want to enumerate registry keys in both the 32-bit and 64-bit registry views in a generic manner from a 32-bit application. I could simply open each key twice, first with KEY_WOW64_64KEY and then with KEY_WOW64_32KEY. However, if the key is not redirected this gives you exactly the same key and you end up enumerating the exact same content twice; this is what I am trying to avoid.

I did find some documentation on it, but it looks like the only way is to examine the hive and do a bunch of string comparisons on the key. Another possibility I thought of is to try to open Wow6432Node on each subkey; if it exists then the key must be redirected. I.e. if I am trying to open HKCU\Software\Microsoft\Windows I would try to open the following keys: HKCU\Wow6432Node, HKCU\Software\Wow6432Node, HKCU\Software\Microsoft\Wow6432Node, and HKCU\Software\Microsoft\Windows\Wow6432Node. Unfortunately, the documentation seems to imply that a child of a redirected key is not necessarily redirected so that route also has issues.

So, what are my options here?

Answer 1

Your goal is not clear. Why do you need to enumerate registry keys in both the 32-bit and 64-bit registry views in a generic manner from a 32-bit application? What do you want to do with 64-bit values in your application? What would you do if there is some different values for x64 and x86 key? It feels like strange or rather wrong idea.

Keys are redirected for important reason: to not break behavior of x86 applications. For example: CLSID is used by COM to find proper implementation for a given interface. Among other, "proper" means that it might be run by caller code i.e. should be of the same platform. That's why there should be different sets of entries for x64 and x86. Reasons for other redirected keys are similar. Generally speaking, those redirected keys has to be different for x86 and x64 applications.

As Raymond Chen wrote, "On 64-bit Windows, 32-bit programs run in an emulation layer, and if you don't like that, then don't use the emulator" and I totally agree with his advice. So my best advice if you need something like this, is to do it from x64 application. But first reconsider whether you really need it.

EDIT: There is samDesired parameter of RegOpenKeyEx that you might find useful. Also take a look at "Accessing an Alternate Registry View" MSDN article.

Answer 2

You're in for a fair amount of pain, it depends on the operating system version. The full list is available here.