Jump to content

HKLM64 vs HKLM?


VAN0
 Share

Recommended Posts

Hello.

The help file is not clear on what HKLM64 exactly does.

1) Does it effect script compiled as 64bit or 32bit, or does it only affect on what OS it's being executed on?

2) if using 32bit script I want to write into HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\my_key on 64bit OS and HKEY_LOCAL_MACHINE\SOFTWARE\my_key on 32bit OS, what path do I use in my script? So far in my tests it doesn't matter what I use HKLM or HKLM64, it always writes into HKEY_LOCAL_MACHINE\SOFTWARE\my_key which suggests that we have to run a check what type of script is running and then use appropriate paths for each versions separately...making HKLM64 useless when compiling both 32 and 64bit

Thank you.

Link to comment
Share on other sites

Wow6432Node Registry Key

The Wow6432Node registry entry indicates that you are running a 64-bit Windows version.

The operating system uses this key to display a separate view of HKEY_LOCAL_MACHINE\SOFTWARE for 32-bit applications that run on 64-bit Windows versions. When a 32-bit application writes or reads a value under the HKEY_LOCAL_MACHINE\SOFTWARE\<company>\<product> subkey, the application reads from the HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\<company>\<product> subkey.

A registry reflector copies certain values between the 32-bit and 64-bit registry views (mainly for COM registration) and resolves any conflicts using a "last-writer-wins" approach.

https://www.advancedinstaller.com/user-guide/registry-wow6432-node.html

Spoiler

Renamer - Rename files and folders, remove portions of text from the filename etc.

GPO Tool - Export/Import Group policy settings.

MirrorDir - Synchronize/Backup/Mirror Folders

BeatsPlayer - Music player.

Params Tool - Right click an exe to see it's parameters or execute them.

String Trigger - Triggers pasting text or applications or internet links on specific strings.

Inconspicuous - Hide files in plain sight, not fully encrypted.

Regedit Control - Registry browsing history, quickly jump into any saved key.

Time4Shutdown - Write the time for shutdown in minutes.

Power Profiles Tool - Set a profile as active, delete, duplicate, export and import.

Finished Task Shutdown - Shuts down pc when specified window/Wndl/process closes.

NetworkSpeedShutdown - Shuts down pc if download speed goes under "X" Kb/s.

IUIAutomation - Topic with framework and examples

Au3Record.exe

Link to comment
Share on other sites

When you setup AutoIt on your system did you use "Use native x64 tools by default" or "Use x86 tools by default (recommended for compatibility).  Because if you used the recommended method RegWrite will write to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\my_key.  You can test by running the following via F5:

#RequireAdmin
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_UseX64=n
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\my_key", "Value", "REG_SZ", "Data")

Also HKLM and HKLM64 are really only for 32-bit scripts, on a 64-bit machine both of these will point to HKLM\SOFTWARE, in a 64-bit compiled script you would have to use HKLM or HKLM64 ...\SOFTWARE\WOW6432Node to access 32-bit node.

Edited by Subz
Link to comment
Share on other sites

Your code worked fine, it created new key in HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\my_key

So, it turned out in my case it was due to fact that I was compiling both 32 and 64bit versions and had this:
 

#AutoIt3Wrapper_Compile_Both=y
#AutoIt3Wrapper_UseX64=y

Evidently this defaults to run script in 64bit?

So, back to the problem.

It seems that If one is planning on compiling script into both 32 and 64bit executable they would have to not only check what OS it's running on but also what type of executable, and then "manually" correct registry path accordingly, because we can't rely on HKLM/HKLM64

It just doesn't make sense why HKLM/HKLM64 only affects 32bit executables.

Link to comment
Share on other sites

The only way to access 64-bit node in a 32-bit compiled script is using HKLM64 you can't access it any other way that I know of.  I have found that I can do everything I need using 32-bit compiled script and have never found a need for 64-bit.  However if you need to have both than you will need to add some instructions to the top of your script something like:

Global $sHKLM32 = @AutoItX64 = 1 ? "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE" : "HKLM\SOFTWARE"
Global $sHKLM64 = @AutoItX64 = 1 ? "HKEY_LOCAL_MACHINE\SOFTWARE" : "HKLM64\SOFTWARE"

 

Edited by Subz
Link to comment
Share on other sites

you can also add one line if you are reading keys from the OS automatically. For example :

Global $sHKLM32 = @AutoItX64 = 1 ? "HKLM\SOFTWARE\WOW6432NODE" : "HKLM\SOFTWARE"
Global $sHKLM64 = @AutoItX64 = 1 ? "HKLM\SOFTWARE" : "HKLM64\SOFTWARE"

Global $sHKLM = @OSarch = "X64" ? $sHKLM64 : $sHKLM32

Global $vResult = RegRead($sHKLM & "\Microsoft\Windows NT\CurrentVersion\Winlogon","AutoAdminLogon")
    If @error Then MsgBox(4096, "Error", "Error reading registry key: " & @error)
Switch $vResult
    Case 1
        MsgBox(4096, "Result", "Autologon Enabled / " & @extended)
    Case Else
        MsgBox(4096, "Result", "Autologon Disabled / " & @extended)
EndSwitch

 

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...