Problem With Read Registry In Windows 64 Bit

i have a big problem with reading registry value in windows 64bit ...
i use from all code and command and test thats...

in windows 64 bit i can read nsis key with this codes:

ReadRegDWORD $R2 HKLM "SOFTWARE\Wow6432Node\NSIS" "VersionMajor" ;work
ReadRegDWORD $R2 HKLM "SOFTWARE\NSIS" "VersionMajor" ;work 

but this code not work for reading some of applications registry keys (WITH NSIS)

ReadRegDWORD $R2 HKLM "SOFTWARE\Wow6432Node\Key1" "MyValue" ;not work on some of keys
ReadRegDWORD $R2 HKLM "SOFTWARE\Key1" "MyValue" ;not work on some of keys 

But I can read thats with command line...

for /f "tokens=2*" %%a in ('reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Key1" /v "MyValue"') do set "$setM1=%%b"
cls
echo "%$setM1%"
cls 

now my question is that: i how can read that key with nsis?

One important note:
when that program is installed on computer i can read registry part of that program...But When i uninstall that i can read registy key that program...

I already told you to use the real key name in your examples and not something generic like MyKey or Key1. This is your last warning, if you don't listen I will stop answering your questions or even ban you from the forums!


Before we can continue you need to answer two questions:

1) Are you using SetRegView anywhere in your script?

2) Tell us the real name of the key you want to access.

Originally Posted by Anders View Post

I already told you to use the real key name in your examples and not something generic like MyKey or Key1. This is your last warning, if you don't listen I will stop answering your questions or even ban you from the forums!


Before we can continue you need to answer two questions:

1) Are you using SetRegView anywhere in your script?

2) Tell us the real name of the key you want to access.

🙁

1) yes i use from SetRegView but not work and not read again...
2) thats key is "HKEY_LOCAL_MACHINE\SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"

my program is backuper from offline update, i need read lastlastupdate and convert that from unix to date.time (find last update time) and use that date in backup name.datetime.exe

i do it in x86 (32) bit windows but i cant read that key\value on 64 bit windows with nsis.... but with CMD mi can read

Try

SetRegView 64
ReadRegDWORD $R2 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"
SetRegView 32
ReadRegDWORD $R3 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"

One of them should work, if not then the AV software might be cloaking/hiding it's keys or something else is getting in the way. Process Monitor will help in these cases...

Originally Posted by Anders View Post

Try


One of them should work, if not then the AV software might be cloaking/hiding it's keys or something else is getting in the way. Process Monitor will help in these cases...

thanks mr Anders

this picture is program process when update database,before update i don't see registry address





i try again and find clues....
when AV use from registry (Sample when update database) i can read registry with code:

ReadRegDWORD $R2 HKLM "SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" "lastlastupdate" 

but after that in normal condition i cant read with nsis just but can read from cmd...
1) what is the problem?
2) why in windows 86 (32) bit i easy can read registry
3) what i can read and show with CMD in all conditions in all windows versions?

How can the problem be solved?
Thanks

Have you tried this

SetRegView 32
ReadRegDWORD $R2 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"

?

You should monitor your NSIS program with Process Monitor as well...

mr Anders i monitor NSIS program with Process Monitor...
Results:

1) I test this codes:

ReadRegDWORD $R1 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView64.1==> $R1" ;Work on x32 x64
ReadRegDWORD $R2 HKLM "SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView64.2==> $R2"  ;Work on x64
SetRegView 64
ReadRegDWORD $R3 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView64.3==> $R3"  ;Work on x32
SetRegView 64
ReadRegDWORD $R4 HKLM "SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView64.4==> $R4"  ;Work on x64 

monitor NSIS program with Process Monitor (When Cant Read Registry NSIS program):






monitor NSIS program with Process Monitor (When Can Read Registry NSIS program):





2) I test this codes:

ReadRegDWORD $R5 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView32.1==> $R5"  ;Work on x32 x64
ReadRegDWORD $R6 HKLM "SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView32.2==> $R6"  ;Work on x64
SetRegView 32
ReadRegDWORD $R7 HKLM "SOFTWARE\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView32.3==> $R7" ;Work on x32 x64
SetRegView 32
ReadRegDWORD $R8 HKLM "SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" "lastlastupdate"
DetailPrint "WithoutSetRegView32.4==> $R8" ;Work on x64 

monitor NSIS program with Process Monitor (When Cant Read Registry NSIS program):






monitor NSIS program with Process Monitor (When Can Read Registry NSIS program):





Mr Anders if is possible download and install AV on windows x64 and end restart computer for start seevices and test that...



codes work:
on x32Bit: At all time
on x64Bit: work some times (At a time when AV updating database) (i think when AV use from registry values i can read whit nsis)

but in all time in x32 x64 bit i can read with CMD command line

also i decode a service process and i see this in codes in that:

Dim avprogram
Set avprogram = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter:AntiVirusProduct").Spawninstance_
avprogram.instanceGuid = "{1B2C78D0-7F17-4587-8F75-554CCC260541}"
avprogram.displayName = "Sheed AntiVirus"
avprogram.productUptoDate = true
avprogram.onAccessScanningEnabled = true
avprogram.companyName = "SheedSoft Corporation"
avprogram.Delete_
  Set avprogram = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter:AntiSpywareProduct").Spawninstance_
avprogram.instanceGuid = "{1B2C78D0-7F17-4587-8F75-554CCC260541}"
avprogram.displayName = "Sheed AntiVirus"
avprogram.productUptoDate = true
avprogram.onAccessScanningEnabled = true
avprogram.companyName = "SheedSoft Corporation" 

It is possible that this is the case?


with CMD with this code always work on x32 x64 :



work on x32:

echo off
for /f "tokens=2*" %%a in ('reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Sheed\AntiVirus\Update" /v "lastlastupdate"') do set "$setM1=%%b"
cls
echo %$setM1%
pause 

work on x64:

echo off
for /f "tokens=2*" %%a in ('reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Sheed\AntiVirus\Update" /v "lastlastupdate"') do set "$setM1=%%b"
cls
echo %$setM1%
pause 

Mr Anders
also i test registry key exist with code:

!include "MUI.nsh"
Section
ClearErrors
ReadRegStr $0 HKLM "SOFTWARE\Sheed" ""
${If} ${Errors}
MessageBox MB_OK "key does not exist"
${Else}
MessageBox MB_OK "key exist"
${EndIf}
SectionEnd 

and NSIS Program show me message "key exist"...!!!!!!!!!!!!!!
but what i cant read regiskry value from that key!...?

Without RequestExecutionLevel in your script reads and writes can be redirected to the VirtualStore. Only Process Monitor can tell you if it is happening...

mr anders again i monitor nsis program with process Monitor.

this picture is for that...





i see Result: access denied

a question:
in nsis can i read registry and send return value to nsis?

Why can't you just ask the AV company (if what you are doing is anyway legitimate that is)?

I don't know why it is using SetInfoKey(KeySetHandleTagsInformation) (MSDN: "Reserved for system use"). When using NSIS RegRead* on a normal key you should see: Open+QueryValue+Close. Because you are reading a AV product key we don't know if they are doing any kind of hooking to protect itself...


NSIS cannot give you the error code, you have to call the API directly:

!include WinCore.nsh
!define RRF_RT_ANY 0x0000ffff
!define RRF_SUBKEY_WOW6432KEY 0x00020000
Section
System::Call 'ADVAPI32::RegGetValue(i ${HKEY_LOCAL_MACHINE}, t "SOFTWARE\Microsoft\Windows\CurrentVersion", t "SM_GamesName", i${RRF_RT_ANY}|${RRF_SUBKEY_WOW6432KEY},*i.r1,i0,*i0r2)i.r0' ; Vista+
DetailPrint Error=$0,RegType=$1,Size=$2
SectionEnd

thanks mr anders
because they are not responding properly..!!!
yes i think this is security way....but for whay?!read a value from AV registry What's wrong?!!!!!I do not know!
i test your code and no see: Error=0,RegType=1,Size=7
now i how can use API directly?
I haven't no information in this regard,possible give me example?
thanks master

It is a example, just change the key path and value name in my example...

Originally Posted by Anders View Post

It is a example, just change the key path and value name in my example...

🙁 Show error

Error=5,RegType=0,Size=0

what happened?
i can't access to read value in that key?

Yes, ERROR_ACCESS_DENIED = 5.

The first thing you can do is to check the ACL of the key (Right click the key and click permissions in Regedit) to make sure you have read access. You could also try to run the installer as System by using PSExec from SysInternals/Microsoft.


The other thing you can try is to see if there is anything hooking the registry functions, you might be able to spot it on the Stack tab for the Open or Query operation in Process Monitor. This is what Open looks like for me on Win8, if yours have other modules then you should investigate those. (I have symbols set up correctly, if you don't then the location column might be wrong for most of the items)