Re: Reading subkeys from registry
by Discipulus (Canon) on Nov 12, 2015 at 12:14 UTC
|
have you rights to read in the registry? with an administrative account i run safely your snippet (you need to add a newline after scalar(keys %$BaseKey) ):
Win32::TieRegistry=HASH(0x3b7e8c)
Number of subkeys found: 77
[long list of unistallable programs]
If you run reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
+on\Uninstall
in the command prompt you see some output?
you can also find interesting Win32::TieRegistry and Delimiter
L*
UPDATE you need to recur to povershell to see security descriptors of registry keys:
powershell Get-Acl hklm:\SOFTWARE\Microsoft\Windows\CurrentVersion\Un
+install
L*
There are no rules, there are no thumbs..
Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.
| [reply] [Watch: Dir/Any] [d/l] [select] |
|
| [reply] [Watch: Dir/Any] |
|
| [reply] [Watch: Dir/Any] [d/l] |
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\AddressBook
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\AVG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Broadcom 802.11 Network Adapter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Broadcom 802.11 Wireless LAN Adapter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Broadcom Wireless Utility
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Connection Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\CutePDF Writer Installation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\DirectDrawEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\DXM_Runtime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Fontcore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Greenshot_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\IE40
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\IE4Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\IE5BAKEX
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\IEData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Juniper_Setup_Client Activex Control
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language
+ Pack - NLD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\MobileOptionPack
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
+\MPlayer2
I remember that the access flags where succesful in the past with HKEY_CLASSES_ROOT
So probably an right issue....
| [reply] [Watch: Dir/Any] [d/l] |
|
Path Owner
+ Access
---- -----
+ ------
Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_M... NT AUTHORITY\SYSTE
+M INGEBOUWD\Gebruikers Allow ReadKey
+...
Tried it on virtual Windows 2012 server (as package) and same result, Number of subkeys found: 0
Maybe a bug on Strawberry perl 5.20v (32bits) & 5.22v (64 bits)? | [reply] [Watch: Dir/Any] [d/l] |
Re: Reading subkeys from registry -- evil registry redirection?
by Discipulus (Canon) on Nov 13, 2015 at 11:25 UTC
|
ok gepebril69 I have not a solution as your code produces useful results for me and for others too(more about it below). But I have some suggestions.
Preamble: you said special access flags to make it happen on 64bit platforms and this ringed a bell in my mind: is this monk another victim of the evil microsoft redirection? you should already know, as you are using special access flags, but to fully understand read this post from me.
Filesystem redirection has two, equally evil, brothers: Registry redirection and COM object model. See what they say about Registry redirection.
Now that you know you are walking on mobile sands quicksand i can suggest to start with a little clean new code, instead of the code presented by you (even if it runs). In fact you are querying for unistallable programs and you know that your OS segregate 32bit from 64bit ones (with the funny WoW64 name..).
So i spoiled your code from unusefull things (delimiters, arrayvalues, the call of Dumper.. but also the dump af all keys) and i add just a little code to show if the Perl version is 64bit. Most important i removed your Access special keys (more on that below) part {Access=> 0x20019|0x0100} and used the standard flag imported from Win32API::Registry ie use Win32API::Registry qw(KEY_READ); .. Access=>KEY_READ()
So the code became:
use strict;
use warnings;
use Win32API::Registry qw(KEY_READ);
use Config;
print "\n\nPerl $Config{archname}\n";
use Win32::TieRegistry(Delimiter=>"/");
my $uninstall=$Registry->Open(
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Unin
+stall",
{
Access=>KEY_READ()
#Access=> 0x20019|0x0100
}
);
print "Number of subkeys found: ".scalar(keys %$uninstall)."\n";
With my little Perl version test program i got theese results:
|
|
| Perl MSWin32-x86-multi-thread
| Number of subkeys found: 353
[OK] C:\ulisse\strawberry\perl\bin\perl.exe
|
|
| Perl MSWin32-x86-multi-thread-64int
| Number of subkeys found: 353
[OK] C:\ulisse\straw5.20-32b\perl\bin\perl.exe
|
|
| Perl MSWin32-x64-multi-thread
| Number of subkeys found: 77 <----
+ look here
[OK] C:\ulisse\straw64\perl\bin\perl.exe
|
|
| Perl MSWin32-x86-multi-thread-64int
| Number of subkeys found: 353
[OK] C:\ulisse\strP5.22-32\perl\bin\perl.exe
As the perl is 64bit the keys found are 77 on my workstation. 353 otherwise.
Now i understood why you used thees special keys (described here) because KEY_WOW64_64KEY (0x0100) is not exported by Win32API::Registry. and you used it diractly in junction with KEY_READ (0x20019).
using {Access=> 0x20019|0x0100} access (uncomment it in the above example and comment the Access=>KEY_READ()) give theese results:
|
|
| Perl MSWin32-x86-multi-thread
| Number of subkeys found: 77
[OK] C:\ulisse\strawberry\perl\bin\perl.exe
|
|
| Perl MSWin32-x86-multi-thread-64int
| Number of subkeys found: 77
[OK] C:\ulisse\straw5.20-32b\perl\bin\perl.exe
|
|
| Perl MSWin32-x64-multi-thread
| Number of subkeys found: 77
[OK] C:\ulisse\straw64\perl\bin\perl.exe
|
|
| Perl MSWin32-x86-multi-thread-64int
| Number of subkeys found: 77
[OK] C:\ulisse\strP5.22-32\perl\bin\perl.exe
As you can see all Perls see only 77 unistallable programs. The description of the access mask tell us:KEY_WOW64_32KEY (0x0200) Indicates that an application on 64-bit Windows should operate on the 32-bit registry view... But is not true! is the opposite! UPDATE last senteces is wrong: see my last reply.
If you see zero key returned on your machine, with your original code, it means to me that you have no 64bit applications uninstallable on your system (the opposite of what i read from ms docs!! in fact in the 77 subkey i find programs that resides in the 64bit program folder "C:\Program Files").Or using other words: if you use your special access flag you are probably looking for the wrong thing. try just reading them and be aware of the possible redirection occuring when you play the three card game with that OS.
HtH and let us know L*
There are no rules, there are no thumbs..
Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.
| [reply] [Watch: Dir/Any] [d/l] [select] |
|
Perl MSWin32-x86-multi-thread-64int
Number of subkeys found: 0
and
Perl MSWin32-x64-multi-thread
Number of subkeys found: 0
The used flags have little different background. Digging through Perlmonk history I found my old thread
http://www.perlmonks.org/?node_id=1112763
As you see, I got undef values on a different part of the registry
Here I didn't get undef values, but empty results. Are you using Strawberry perl | [reply] [Watch: Dir/Any] [d/l] [select] |
|
what do you mean with The used flags have little different background?
Also note that Here I didn't get undef values, but empty results is not so true: if you put null values as hashref's keys and then you look for the number of keys, ie zero.
If your last sentence is a question, yes i'm using strwaberryperl.
As you understand the redirection, testing on 2008 OS you'll see that Perl 64bit always see it's own part of the registry (18 keys in this example) while 32Bit Perl see the 32bit part with KEY_READ() and the 64bit using the special flag 0x20019|0x0100. Thus confirm that official docs are wrong. See below:
###64bit Perl
Perl MSWin32-x64-multi-thread
access: 0x20019|0x0100
Number of subkeys found: 18
Perl MSWin32-x64-multi-thread
access: KEY_READ()
Number of subkeys found: 18
###32bit Perl
Perl MSWin32-x86-multi-thread
access: 0x20019|0x0100
Number of subkeys found: 18
Perl MSWin32-x86-multi-thread
access: KEY_READ()
Number of subkeys found: 21
HtH L*
UPDATE: i was wrong (thanks Corion!) the docs are right:
KEY_WOW64_32KEY (0x0200)
Indicates that an application on 64-bit Windows should operate on the
+32-bit registry view.
KEY_WOW64_64KEY (0x0100)
Indicates that an application on 64-bit Windows should operate on the
+64-bit registry view.
So the beahvior observed is rigtly documented.
L*
There are no rules, there are no thumbs..
Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.
| [reply] [Watch: Dir/Any] [d/l] [select] |
|
|