WOW6432Node and API-functions RegOpenKeyEx / RegEnumKeyEx

Andrey Karpov
Articles: 565

The register in 64-bit Windows versions is subdivided into 32-bit and 64-bit hives. Most 32-bit hives have the same names as their counterparts in the 64-bit hives and vice versa. By default, 32-bit hives are displayed in the WOW6432Node node in 64-bit Windows versions. The redirection process is transparent for 32-bit applications, i.e. they can access the register hives as if they worked in the 32-bit environment despite the fact that the data are stored in a different place.

This behavior causes issues when 32-bit applications try to access the WOW6432Node node using of Windows API functions (for instance, RegOpenKeyEx and RegEnumKeyEx). When accessing the HKLM\Software\Wow6432Node node, the redirection mechanism is launched and an eternal loop of the "HKLM\Software\Wow6432Node\Wow6432Node\Wow6432Node\... and so on" kind occurs. You might often encounter such errors in various 32-bit register management utilities like, for instance, here.

Beginning with Windows Server 2008, the HKLM\Software\Wow6432Node node is hidden from the RegEnumKeyEx function, although it does not guarantee that an eternal recursion will not occur when trying to directly access this node.

But if you want to work with 64-bit register hives from a 32-bit program, you should open the HKLM\Software node using the KEY_WOW64_64KEY key. But do not try to get a direct access to WOW6432Node and avoid creating new register nodes with the same name.

As an example of an error related to WOW6432Node, consider the defect in a program system consisting of 32-bit and 64-bit units that interact with each other and use different register presentations. The following line in a 32-bit unit stopped working in one program:

  "SOFTWARE\\ODBC\\ODBC.INI\\ODBC Data Sources", 0,

To make this program friends with other 64-bit parts, you should add the KEY_WOW64_64KEY key:

  "SOFTWARE\\ODBC\\ODBC.INI\\ODBC Data Sources", 0,


Use PVS-Studio to search for bugs in C, C++, C# and Java

We offer you to check your project code with PVS-Studio. Just one bug found in the project will show you the benefits of the static code analysis methodology better than a dozen of the articles.

goto PVS-Studio;

Andrey Karpov
Articles: 565

Bugs Found

Checked Projects
Collected Errors
14 526
This website uses cookies and other technology to provide you a more personalized experience. By continuing the view of our web-pages you accept the terms of using these files. If you don't want your personal data to be processed, please, leave this site. Learn More →