KEY_WOW64_64KEY and KEY_WOW64_32KEY

  • Article

This is really about Win32 on Win64, or Windows on Windows, or short for WOW.

MSDN has many information about 64 bits Windows here (https://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnanchor/html/64bitwindows.asp). One particular piece information about registry is htere (https://msdn.microsoft.com/library/default.asp?url=/library/en-us/win64/win64/registry_redirector.asp). For the most part, there are two registry hives, 64 bit hive and 32bit hive. Applications running under WOW use 32bit hive, and native 64 bit applications use 64 bit hive.

If an application running under WOW wants to use 64 bit hive, it has to specify KEY_WOW64_64KEY in RegOpenKeyEx/RegCreateKeyEx. This is documented here (https://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/registry_key_security_and_access_rights.asp).

If a registry handle hKey is opened with KEY_WOW64_64KEY under WOW, and you want to open its subkey, you still have to pass KEY_WOW64_64KEY to RegOpenKeyEx. The WOW system does not remember hKey is opened with KEY_WOW64_64KEY. If you don't pass KEY_WOW64_64KEY to RegOpenKeyEx, WOW will try to open the subkey in 32bit hive, and will likely fail to find the subkey if the subkey does not exist in 32bit hive.

KEY_WOW64_32KEY is about native 64 bit applications use 32bit hive. And it has to follow the same rule.