Reading subkeys from registry

gepebril69 has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Reading subkeys from registry by Discipulus (Canon) on Nov 12, 2015 at 12:14 UTC
have you rights to read in the registry? with an administrative account i run safely your snippet (you need to add a newline after `scalar(keys %$BaseKey)` ): `Win32::TieRegistry=HASH(0x3b7e8c) Number of subkeys found: 77 [long list of unistallable programs]` [download] If you run `reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi +on\Uninstall` [download] in the command prompt you see some output? you can also find interesting Win32::TieRegistry and Delimiter L* UPDATE you need to recur to povershell to see security descriptors of registry keys: `powershell Get-Acl hklm:\SOFTWARE\Microsoft\Windows\CurrentVersion\Un +install` [download] L* There are no rules, there are no thumbs.. Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.	[reply] [d/l] [select]
Re^2: Reading subkeys from registry (wfm) by tye (Sage) on Nov 12, 2015 at 14:24 UTC
FYI, the posted code works for me whether run as administrator or not. - tye	[reply]
Re^3: Reading subkeys from registry (wfm) by Discipulus (Canon) on Nov 13, 2015 at 09:20 UTC
you are obviously right (uch the author!!) i suggested administrative problems because of the phrase about windows 64 bit special access keys. I'll add more info in brief. L* There are no rules, there are no thumbs.. Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.	[reply] [d/l]
Re^2: Reading subkeys from registry by gepebril69 (Scribe) on Nov 12, 2015 at 12:29 UTC
Hi Discipulus, Added a newline. When I run it with admin right -> same result. When I use your commandline code (reg query ...... ) I get positive results :) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\AddressBook HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\AVG HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Broadcom 802.11 Network Adapter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Broadcom 802.11 Wireless LAN Adapter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Broadcom Wireless Utility HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Connection Manager HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\CutePDF Writer Installation HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\DirectDrawEx HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\DXM_Runtime HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Fontcore HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Greenshot_is1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\IE40 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\IE4Data HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\IE5BAKEX HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\IEData HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Juniper_Setup_Client Activex Control HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language + Pack - NLD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\MobileOptionPack HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall +\MPlayer2 [download] I remember that the access flags where succesful in the past with HKEY_CLASSES_ROOT So probably an right issue....	[reply] [d/l]
Re^2: Reading subkeys from registry by gepebril69 (Scribe) on Nov 12, 2015 at 16:42 UTC
The output of Powershell `Path Owner + Access ---- ----- + ------ Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_M... NT AUTHORITY\SYSTE +M INGEBOUWD\Gebruikers Allow ReadKey +...` [download] Tried it on virtual Windows 2012 server (as package) and same result, Number of subkeys found: 0 Maybe a bug on Strawberry perl 5.20v (32bits) & 5.22v (64 bits)?	[reply] [d/l]
Re: Reading subkeys from registry -- evil registry redirection? by Discipulus (Canon) on Nov 13, 2015 at 11:25 UTC
ok gepebril69 I have not a solution as your code produces useful results for me and for others too(more about it below). But I have some suggestions. Preamble: you said special access flags to make it happen on 64bit platforms and this ringed a bell in my mind: is this monk another victim of the evil microsoft redirection? you should already know, as you are using special access flags, but to fully understand read this post from me. Filesystem redirection has two, equally evil, brothers: Registry redirection and COM object model. See what they say about Registry redirection. Now that you know you are walking on ~~mobile sands~~ quicksand i can suggest to start with a little clean new code, instead of the code presented by you (even if it runs). In fact you are querying for unistallable programs and you know that your OS segregate 32bit from 64bit ones (with the funny WoW64 name..). So i spoiled your code from unusefull things (delimiters, arrayvalues, the call of Dumper.. but also the dump af all keys) and i add just a little code to show if the Perl version is 64bit. Most important i removed your Access special keys (more on that below) part `{Access=> 0x20019\|0x0100}` and used the standard flag imported from Win32API::Registry ie `use Win32API::Registry qw(KEY_READ); .. Access=>KEY_READ()` So the code became: `use strict; use warnings; use Win32API::Registry qw(KEY_READ); use Config; print "\n\nPerl $Config{archname}\n"; use Win32::TieRegistry(Delimiter=>"/"); my $uninstall=$Registry->Open( "HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Unin +stall", { Access=>KEY_READ() #Access=> 0x20019\|0x0100 } ); print "Number of subkeys found: ".scalar(keys %$uninstall)."\n";` [download] With my little Perl version test program i got theese results: `\| \| \| Perl MSWin32-x86-multi-thread \| Number of subkeys found: 353 [OK] C:\ulisse\strawberry\perl\bin\perl.exe \| \| \| Perl MSWin32-x86-multi-thread-64int \| Number of subkeys found: 353 [OK] C:\ulisse\straw5.20-32b\perl\bin\perl.exe \| \| \| Perl MSWin32-x64-multi-thread \| Number of subkeys found: 77 <---- + look here [OK] C:\ulisse\straw64\perl\bin\perl.exe \| \| \| Perl MSWin32-x86-multi-thread-64int \| Number of subkeys found: 353 [OK] C:\ulisse\strP5.22-32\perl\bin\perl.exe` [download] As the perl is 64bit the keys found are 77 on my workstation. 353 otherwise. Now i understood why you used thees special keys (described here) because `KEY_WOW64_64KEY (0x0100)` is not exported by Win32API::Registry. and you used it diractly in junction with `KEY_READ (0x20019)`. using `{Access=> 0x20019\|0x0100}` access (uncomment it in the above example and comment the `Access=>KEY_READ()`) give theese results: `\| \| \| Perl MSWin32-x86-multi-thread \| Number of subkeys found: 77 [OK] C:\ulisse\strawberry\perl\bin\perl.exe \| \| \| Perl MSWin32-x86-multi-thread-64int \| Number of subkeys found: 77 [OK] C:\ulisse\straw5.20-32b\perl\bin\perl.exe \| \| \| Perl MSWin32-x64-multi-thread \| Number of subkeys found: 77 [OK] C:\ulisse\straw64\perl\bin\perl.exe \| \| \| Perl MSWin32-x86-multi-thread-64int \| Number of subkeys found: 77 [OK] C:\ulisse\strP5.22-32\perl\bin\perl.exe` [download] As you can see all Perls see only 77 unistallable programs. ~~The description of the access mask tell us:KEY_WOW64_32KEY (0x0200) Indicates that an application on 64-bit Windows should operate on the 32-bit registry view... But is not true! is the opposite!~~ UPDATE last senteces is wrong: see my last reply. If you see zero key returned on your machine, with your original code, it means to me that you have no 64bit applications uninstallable on your system (the opposite of what i read from ms docs!! in fact in the 77 subkey i find programs that resides in the 64bit program folder "C:\Program Files").Or using other words: if you use your special access flag you are probably looking for the wrong thing. try just reading them and be aware of the possible redirection occuring when you play the three card game with that OS. HtH and let us know L* There are no rules, there are no thumbs.. Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.	[reply] [d/l] [select]
Re^2: Reading subkeys from registry -- evil registry redirection? by gepebril69 (Scribe) on Nov 13, 2015 at 18:52 UTC
Hi Discipulus Thanks for all the effort so far When I run your code on both systems I get `Perl MSWin32-x86-multi-thread-64int Number of subkeys found: 0` [download] and `Perl MSWin32-x64-multi-thread Number of subkeys found: 0` [download] The used flags have little different background. Digging through Perlmonk history I found my old thread http://www.perlmonks.org/?node_id=1112763 As you see, I got undef values on a different part of the registry Here I didn't get undef values, but empty results. Are you using Strawberry perl	[reply] [d/l] [select]
Re^3: Reading subkeys from registry -- evil registry redirection? by Discipulus (Canon) on Nov 16, 2015 at 08:45 UTC
what do you mean with The used flags have little different background? Also note that Here I didn't get undef values, but empty results is not so true: if you put null values as hashref's keys and then you look for the number of keys, ie zero. If your last sentence is a question, yes i'm using strwaberryperl. As you understand the redirection, testing on 2008 OS you'll see that Perl 64bit always see it's own part of the registry (18 keys in this example) while 32Bit Perl see the 32bit part with `KEY_READ()` and the 64bit using the special flag `0x20019\|0x0100`. ~~Thus confirm that official docs are wrong.~~ See below: `###64bit Perl Perl MSWin32-x64-multi-thread access: 0x20019\|0x0100 Number of subkeys found: 18 Perl MSWin32-x64-multi-thread access: KEY_READ() Number of subkeys found: 18 ###32bit Perl Perl MSWin32-x86-multi-thread access: 0x20019\|0x0100 Number of subkeys found: 18 Perl MSWin32-x86-multi-thread access: KEY_READ() Number of subkeys found: 21` [download] HtH L* UPDATE: i was wrong (thanks Corion!) the docs are right: `KEY_WOW64_32KEY (0x0200) Indicates that an application on 64-bit Windows should operate on the +32-bit registry view. KEY_WOW64_64KEY (0x0100) Indicates that an application on 64-bit Windows should operate on the +64-bit registry view.` [download] So the beahvior observed is rigtly documented. L* There are no rules, there are no thumbs.. Reinvent the wheel, then learn The Wheel; may be one day you reinvent one of THE WHEELS.	[reply] [d/l] [select]
Re^4: Reading subkeys from registry -- evil registry redirection? by gepebril69 (Scribe) on Nov 17, 2015 at 13:27 UTC
Re^4: Reading subkeys from registry -- evil registry redirection? by gepebril69 (Scribe) on Nov 20, 2015 at 13:35 UTC