3

I have an application where I am restricted to using the NtCreateKey / ZwCreateKey function(s). (e.g. in a driver) There is another application I don't control which runs under WOW64, which reads a value from this registry key.

I want to set the registry value such that this application can find it. However, WOW64 is implemented in kernel32 -- so I can't pass the KEY_WOW64_32KEY flag like I can when using RegOpenKeyEx.

The easiest way seems to be to include Wow6432Node in the path passed to ZwCreateKey, but MSDN discourages this:

WOW64 defines the following symbolic links only for compatibility with existing applications that may use hardcoded registry key paths containing Wow6432Node. New applications should avoid using Wow6432Node in registry key paths.

This seems to put me between a rock and a hard place... how can I place data in the 32 bit registry view? The MSDN language says "avoid" -- is this a situation where Wow6432Node is unavoidable?

Billy ONeal
  • 104,103
  • 58
  • 317
  • 552
  • 2
    Using `Wow6432Node` in this situation seems ok to me. – Jonathan Potter Sep 03 '13 at 02:48
  • @JonathanPotter: I think so, but I try to avoid doing things that MSDN says not to do whenever possible. – Billy ONeal Sep 03 '13 at 02:50
  • I take it there's no chance you could get a user-mode process to make the registry changes on your behalf? – Harry Johnston Sep 11 '13 at 21:54
  • @Harry: Nope. IPC is a can of worms I don't want to open over this. – Billy ONeal Sep 11 '13 at 22:19
  • ... well, you could stick the registry settings in the ordinary 64-bit part of the registry and get the user-mode process to monitor and copy them. But I agree that's not a *good* solution. – Harry Johnston Sep 11 '13 at 22:30
  • 1
    Looking at this again, I'd argue that this is a forwards compatibility issue - that is, the only reason not to use Wow6432Node is that it might not work in future releases of Windows - and that device drivers are never guaranteed to be forwards compatible. So I wouldn't worry about it too much. – Harry Johnston Dec 02 '14 at 05:00

0 Answers0