in reply to Scanning of 64 Bit registry


If perl is compiled in 32bit, the operating system will run it in WOW mode.
This means that it ties to a different location in the registry.
Instead of querying HKML\Software, the OS will query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node.
This is made by design by microsoft.
As far as I know, a 32bit program cannot access the 64bit registry. So, I would recommend to fork a program that launches reg.exe and dump it into a file. Than parse that file.

Or better, get a 64bit version of perl :-)

Dr. Mark Ceulemans
sr. Security Consultant
Evidian, Belgium

Replies are listed 'Best First'.
Re^2: Scanning of 64 Bit registry
by cdarke (Prior) on Jan 11, 2011 at 22:42 UTC
    This is the 64-bit version of Perl, or at least it is supposed to be. It is the pre-compiled ActiveState one:
    C:\>perl -v This is perl 5, version 12, subversion 0 (v5.12.0) built for MSWin32-x +64-multi-t hread (with 1 registered patch, see perl -V for more detail) Copyright 1987-2010, Larry Wall Binary build 1200 [292396] provided by ActiveState http://www.ActiveSt Built Apr 10 2010 22:58:59
    I'll try with the latest....