如何绕过注册表反射(Wow6432Node)?注册表、反射、Wow6432Node

2023-09-08 00:37:30 作者:水里有怪人

我想提取从注册表中的某些信息,但因为我的剧本是在一个32位引擎上运行,它只会从Wow6432Node某些键提取信息。有没有一种方法可以绕过注册表反射和来自读

I want to extract certain information from the registry but since my script is running inside a 32-bit engine, it will extract information only from the Wow6432Node for certain keys. Is there a way to bypass registry reflection and read from both

HKEY_LOCAL_MACHINE \ SOFTWARE \微软

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \微软

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft

我只是想从钥匙读取的值,而不是更新它。

I just want to read the values from the keys, not update it.

感谢你。

推荐答案

您可以读取和写入专门为32位或64位的观点注册表中传递的不同的标志来的 RegOpenKeyEx的/函数RegCreateKeyEx 功能: KEY_WOW64_64KEY KEY_WOW64_32KEY

You can read and write specifically to the 32 or 64 bit views of the registry by passing different flags to the RegOpenKeyEx/RegCreateKeyEx functions: KEY_WOW64_64KEY and KEY_WOW64_32KEY