Click here to Skip to main content
15,946,529 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
It seems like there are some "smart" keys in the windows registry. When I say smart...I mean that they are there (RegEdit sees them) but if you perform a search you won't find them (via OpenSubKey/GetSubKey routines).

Case in point:

The registry has the following key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\044A7038A79602FACF77629B3A9FFA16


If you Use the OpenKey/GetSubkey method you will get the 6 subkeys NONE of which is key
044A7038A79602FACF77629B3A9FFA16
.

I wish to build a file of keys added during a install, and then go and delete them. Why? Because when the installer runs it installs just fine, but you cannot uninstall my application.

In order to perform deletion and cleanup, I must find the keys first.

What I have tried:

I've tried the following
TopKey = CurrentKey.OpenSubKey(fullpath, RegistryKeyPermissionCheck.ReadSubTree, Lrights[K]);


Where CurrentKey is
HKEY_LOCAL_MACHINE
opened via both 64 bit and 32 bit, and
Lrights[K]
is all the enumerate rights of
System.Security.AccessControl.RegistryRights


I'm running in the debugger with Administrative rights.

The code to open the initial HKEY_LOCAL_MACHINE is:

RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry32);


or
RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry64);
Posted
Updated 29-Nov-22 12:19pm
Comments
Richard Deeming 30-Nov-22 4:49am    
"... but you cannot uninstall my application ..."
That sounds like malicious behaviour to me. Any application which deliberately tried to prevent the owner of the computer from uninstalling it would immediately be flagged as malware, and banned from the network.

If you're not trying to write malware, then try explaining what you're actually trying to do and why.

If you are trying to write malware, then you've come to the wrong site.

1 solution

There's no such thing as a "smart key", or anything "smart" in the registry.

What you are seeing are component GUIDs data rearranged into a different order. I ran into this about five or six years ago. I can't find my notes on it, but various groups of bytes in the GUIDs are rearranged to make up the key values you're seeing under the Components key.

You can make up your own MSI and add a feature and a component to it. Note the GUID you give the component and install it on a test machine. Go through the component data in the registry and you'll find the component key data and compare it to the noted GUID. You can compare the two to figure out what the rearrangement is.

EDIT:
I think it went something like this. Take a GUID and reverse the first three sections of it. The next two sections, every pair of characters are swapped:
{3F7E7201-428F-4624-BE2A-AFE115BED227}
 1027E7F3 F824 4264 EBA2 FA1E51EB2D72

becomes this in the Components key:
1027E7F3F8244264EBA2FA1E51EB2D72
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900