Windows 64bit and the Registry

Registry Redirection and Reflection

Background

Some Windows 64 bit operating systems include support for running 32 bit applications. This support is provided via a 32 bit sub-system which has been given the nickname Wow64. The Wow64 sub-system executes in user mode and performs all the necessary transformations (also known as thunking) to allow the 32 bit applicaiton interact with the 64 bit API.

When a 32 bit application executes it has certain expectations about the system on which it is running, expectations which cannot be guarenteed to be true on a 64 bit system (if it ran with direct access to the system settings). As an example, a 32 bit application might expect that (when it reads the name of a DLL from the registry) it will be able to load the library into its address space. However, if the registry entry pointed to a 64 bit DLL this would not infact be possible. The Wow64 sub-system has several mechanisms to ensure a 32 bit application won't be stumbled when running on a 64 bit system.

What WOW64 does

The Wow64 sub system provides translation/emmulation services, it receives calls from the 32 bit binary images and thunks the call prameters to make the correct 64 bit kernel calls (it also provides 32 bit instruction emmulation for pure 64 bit processors such at the Intel Itanium for more details see this Microsoft Explaination). 

In order to ensure application compatibility the Wow64 sub-system provides a separate logical view of pertainant sections of the registry to 32 bit applications. It does this by a technique called registry redirection.

Registry Redirector

The registry redirector intercepts 32 bit registry calls to each logical view and maps them to the corresponding physical registry location. The redirection process is transparent to the calling application allowing the 32 bit application to access registry data as if it were running on 32 bit Windows.

Registry Redirection is enabled for the following registry keys:

Ref.    :    Registry Redirector

Registry Reflection

Sometimes, when a 32 bit application updates the registry, the changes are also applicable in the 64 bit registry; Conversely, equally true, changes made by a 64 bit application might also be applicable to a 32 bit application.

The Microsoft Registry Reflector is intelligent and copies COM activation data for Local servers between the 32 bit and 64 bit registry views (but not in-process data) because 32 bit and 64 bit in-process data mixing is not permitted on 64 bit Windows.

Registry Reflection is enabled for the following registry keys:

Ref.    :    Registry Reflection

Side Effects

One of the mechanisms Microsoft have used to implement Registry Redirection is by handle / key subsitution during calls to RegOpenKey. When an 32 bit application attempts to open any key called Wow6432Node  windows always returns a handle to HKEY_LOCAL_MACHINE\Software\Wow6432Node (the 32 bit SOFTWARE hive) regardless of the actual location of the sub-key. This can lead to a problem if anyone creates a sub-key using this reserved word as its name

Potential Infinite Loop

For example, if someone where to create a key named Wow6432Node  under the 32 bit SOFTWARE hive then when a 32 bit application opens this key it will not be actually be opening this key but will infact be just re-opening the 32 bit SOFTWARE hive (but it has no way to know this as this is a transparent translation). As you can see, if the application was performing a tree-walk of the registry, this would lead to an infinite loop (as each time it opens this key, it will be re-enumerating the 32 bit SOFTWARE hive).

It is of note that Microsoft Registry Editor is not crippled by this type of infinite loop situation because its default recurive behaviour is to not enumerate deeper if an error is encountered. When the full registry path grows beyond 1999 characters RegEdit will fail to open the path and thus not enumerate deeper into the infinite path (effectively preventing infinite looping).

Microsoft References : Example of Registry  of Registry Reflection and Redirection

 Return to Latest Links