How to view the system registry by using 64-bit versions of Windows

The registry in 64-bit versions of Windows is divided into 32-bit and 64-bit keys. Many of the 32-bit keys have the same names as their 64-bit counterparts, and vice versa.
The default 64-bit version of Registry Editor (Regedit.exe) that is included with 64-bit versions of Windows displays both 64-bit keys and 32-bit keys. The WOW64 registry redirector presents 32-bit programs with different keys for 32-bit program registry entries. In the 64-bit version of Registry Editor, 32-bit keys are displayed under the following registry key:

HKEY_LOCAL_MACHINESoftwareWOW6432Node

You can view or edit both 64-bit and 32-bit registry keys and values by using the default 64-bit version of Registry Editor. To view or edit 64-bit keys, you must use the 64-bit version of Registry Editor (Regedit.exe). You can also view or edit 32-bit keys and values by using the 32-bit version of Registry Editor in the %systemroot%Syswow64 folder. There are no differences in the way you perform tasks between the 32-bit version of Registry Editor and the 64-bit version of Registry Editor. To open the 32-bit version of Registry Editor, follow these steps:

  1. Click Start, and then click Run.
  2. In the Open box, type %systemroot%syswow64regedit, and then click OK.
    Note You must close the 64-bit version of Registry Editor before you can open the 32-bit version (and vice versa) unless you start the second instance of Registry Editor with the -m switch. For example, if the 64-bit version of Registry Editor is already running, type %systemroot%syswow64regedit -m in step 2 to start the 32-bit version of Registry Editor.

To support the co-existence of 32-bit and 64-bit COM registration and program states, WOW64 presents 32-bit programs with an alternate view of the registry. 32-bit programs see a 32-bit HKEY_LOCAL_MACHINESoftware tree (HKEY_LOCAL_MACHINESoftwareWOW6432Node) that is completely separate from the true 64-bit HKEY_LOCAL_MACHINESoftware tree. This isolates HKEY_CLASSES_ROOT, because the per-computer portion of this tree resides within the following registry key:

HKEY_LOCAL_MACHINESoftware

To enable 64-bit/32-bit program interoperability through COM and other mechanisms, WOW64 uses a "Registry Reflector" that mirrors certain registry keys and values between the 64-bit and 32-bit registry views. The reflector is "intelligent", in that is only reflects COM activation data.

Back to the top

Reflected Keys

The WOW64 Registry reflector may modify the contents of keys and values during the reflection process to adjust path names, and so on. Because of this, the 32-bit and 64-bit contents may differ. For example, pathnames that contain the system32 registry entry are written as SysWOW64 in the 32-bit section of the registry. The following keys are reflected:

  • HKEY_LOCAL_MACHINESoftwareClasses
  • HKEY_LOCAL_MACHINESoftwareCOM3
  • HKEY_LOCAL_MACHINESoftwareOle
  • HKEY_LOCAL_MACHINESoftwareEventSystem
  • HKEY_LOCAL_MACHINESoftwareRPC

Reference: http://support.microsoft.com/kb/305097/

Leave a Reply

Your email address will not be published. Required fields are marked *