How to bypass registry reflection (Wow6432Node)?

Question

I want to extract certain information from the registry but since my script is running inside a 32-bit engine, it will extract information only from the Wow6432Node for certain keys. Is there a way to bypass registry reflection and read from both

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

and

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft

?

I just want to read the values from the keys, not update it.

Thank you.

Answer 1

You can read and write specifically to the 32 or 64 bit views of the registry by passing different flags to the RegOpenKeyEx/RegCreateKeyEx functions: KEY_WOW64_64KEY and KEY_WOW64_32KEY