1

I have a 32-bit program that is trying to access a key stored in HKLM\Software\Microsoft\VisualStudio in a Windows 64-bit setup running Windows 8.1.

Usually it works just fine and it will actually read that key from the Software\Wow6432Node.

However I have one machine (which doesn't seem that different from others) for which the read fails. When I look at the registry accesses with Process Monitor it shows that it is trying to read it from the VirtualStore and there it is not present, thus the failure.

Any reason why Windows is not presenting the merged view to my application as it does on other installs?

Thanks, Manu

Emmanuel Stapf
  • 213
  • 1
  • 7
  • Wow64 redirection and the virtual store are two different things. What exactly does Process Monitor say? (Please copy and paste the text from the relevant event(s) into your question.) – Harry Johnston Mar 17 '15 at 22:45
  • Basically I can see a call to RegOpenKey to HKLM\Software\Microsoft with the REPARSE status, then a second call to RegOpenKey to HKCU\Classes\VirtualStore\Machine\Software\Microsoft and from there I'm trying in my program to access the subkey VisualStudio and process monitor shows an access to HKCU\Classes\VirtualStore\Machine\Software\Microsoft\VisualStudio with a missing key error. And that's it. It never looks at the real HKLM\Software\Microsoft\VisualStudio entry which does exist. – Emmanuel Stapf Mar 18 '15 at 23:32
  • OK, that's the virtual store, which is related to UAC rather than to WOW64. I'm not certain of the details, but I think that is triggered by the existence of `HKCU\Classes\VirtualStore\Machine\Software\Microsoft` which in turn would have been caused by some software running in compatibility mode trying to write to `HKLM\Software\Microsoft` without adequate permissions to do so. That might have happened ages ago; once the key exists in the user's virtual store, all further references are redirected to it. – Harry Johnston Mar 18 '15 at 23:42
  • Your explanation makes sense but my program never wrote to this hive of the registry key. Some other programs did. It is quite unfortunate. – Emmanuel Stapf Mar 19 '15 at 08:32
  • I *think* that you only see the contents of virtual keys from applications that are themselves running in compatibility mode, so it may be that all you need to do is make sure that your application has a valid manifest. – Harry Johnston Mar 19 '15 at 18:21
  • Yes adding a manifest with the proper content, I'm able to bypass the virtual store. – Emmanuel Stapf Mar 24 '15 at 10:11

1 Answers1

2

The virtual store is a compatibility mechanism that was introduced with UAC, and is not directly related to WOW64. When a program that does not declare itself to be compatible with Windows Vista attempts to create a key or file but does not have access to do so, Windows redirects the write into the virtual store. From that point onwards, attempts to open that key or file will be automatically redirected to the virtual store.

To avoid being redirected to a virtual store key or file that another application may have created, use a manifest to declare that your application is compatible with Windows Vista.

Harry Johnston
  • 35,639
  • 6
  • 68
  • 158