in reply to Scanning of 64 Bit registry


If perl is compiled in 32bit, the operating system will run it in WOW mode.
This means that it ties to a different location in the registry.
Instead of querying HKML\Software, the OS will query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node.
This is made by design by microsoft.
As far as I know, a 32bit program cannot access the 64bit registry. So, I would recommend to fork a program that launches reg.exe and dump it into a file. Than parse that file.

Or better, get a 64bit version of perl :-)

Dr. Mark Ceulemans
sr. Security Consultant
Evidian, Belgium