Weird behavior when getting registry value via RegQueryValueEx and RegGetValue

Question

I am having some issues in c++ with the aforementioned functions. Both are behaving in the exact same way. Here is the process I am seeing:

run code to get registry value. Double check that it found 10000, which it should have (10000 is the default windows limit on GDI objects per process), and it does.
change the registry using regedit to something other than 10000
run the code again, but this time it again finds 10000, when it should have found the new value.

No matter what I try, it will always only find the original value and not the updated value of the registry.

Things i've noticed/tried:

It does this for every value i've looked at, not just GDIProcessHandleQuota. (it doesn't always return 10000 since that's specific to the GDI value, it just always returns the pre-modify value for any given value)
It does this even if i reboot the computer and open regedit to verify the key actually changed before running step 3.
all the results values in the code below (results, results2, results3) are 0, indicating ERROR_SUCCESS (lol), meaning they experienced no issues.

finally, here is the code snippet in which i'm experiencing the problems:

HKEY hKey;

//open the key for viewing in RegQueryValueEx, store opened handle in hkey
LONG result = RegOpenKeyEx(HKEY_LOCAL_MACHINE,
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
        0,
        KEY_ALL_ACCESS,
        &hKey);


DWORD dwReturn;
DWORD dwBufSize = sizeof(DWORD);

//after this line executes, dwReturn should have the DWORD data of the specified registry key/valuename
LONG result2 = RegQueryValueEx(hKey,
    "GDIProcessHandleQuota",
    0,
    0, 
    reinterpret_cast<LPBYTE>(&dwReturn), 
    &dwBufSize);

DWORD value;
DWORD size = sizeof(DWORD);


//after this executes, value should contain the DWORD data of the specified  registry key/valuename
LONG result3 = RegGetValue(hKey,
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
    "GDIProcessHandleQuota",
    RRF_RT_ANY,
    NULL,
    &value,
    &size
    );

How are you compiling your program - 32 bit or 64 bit? If 32 bit, your program is actually looking in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows — The Dark, Jul 21 '16 at 01:36
@The Dark it's being compiled as Win32. Is that location correct even though it's being told the path I gave it explicitly? — Sveniat, Jul 21 '16 at 01:39
Sorry - I edited my comment as you were typing - check the Wow6432Node key — The Dark, Jul 21 '16 at 01:40
Is there a way to force the program to look in the other location? Why are there 2 locations in the first place? which one is the "right" value for the key? (aka which one SHOULD I be looking at) — Sveniat, Jul 21 '16 at 01:43
There is a way to read the other location here: http://stackoverflow.com/questions/11808462/avoid-registry-wow6432node-redirection - it is c# but the idea is the same. There are two locations to keep 32 bit and 64 applications separated, so I guess as a 32 bit application you should leave it alone and read from the Wow6432Node key. Alternatively, you could change to being a 64 bit application. — The Dark, Jul 21 '16 at 02:10
[Check MSDN on Wow64](https://msdn.microsoft.com/en-us/library/windows/desktop/aa384253%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396) — David Thomas, Jul 21 '16 at 02:31
*"it's being compiled as Win32"* - Technically not correct. Win32 designates the API (as opposed to Win16). The target platform is usually called x86 for 32 bit, and x64 for 64 bit. — IInspectable, Jul 21 '16 at 08:29

Remy Lebeau · Accepted Answer · 2016-07-21T04:32:10.277

Your issue is most likely caused by the WOW64 emulator when running a 32-bit app on a 64bit machine. Refer to the MSDN documentation for more details:

Registry Redirector

Registry Keys Affected by WOW64

32-bit and 64-bit Application Data in the Registry

Accessing an Alternate Registry View

To open a 64bit key in a 32bit app, you need to include the KEY_WOW64_64KEY flag when opening the key with RegOpenKeyEx(), or the RRF_SUBKEY_WOW6464KEY flag when opening the key with RegGetValue().

You are also opening the key with too many permissions (which could kick in Registry Virtualization under UAC, but that is disabled on the particular key you are accessing in this example, but you should be aware of it). KEY_ALL_ACCESS will only work for admin users. Most users do not have write access to HKLM, only read-only access, so opening the key with KEY_ALL_ACCESS will fail for non-admins. Always request the minimum permissions you actually need. In this case, open the key for KEY_QUERY_VALUE access.

You are also calling RegGetValue() with the wrong parameter values.

Try something more like this instead:

HKEY hKey;

//open the key for viewing in RegQueryValueEx, store opened handle in hkey
LONG result = RegOpenKeyEx(
    HKEY_LOCAL_MACHINE,
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
    0,
    KEY_QUERY_VALUE | KEY_WOW64_64KEY,
    &hKey);

if (result != ERROR_SUCCESS)
{
    ...
}
else
{
    DWORD value;
    DWORD size = sizeof(DWORD);

    //after this line executes, value should have the DWORD data of the specified registry key/valuename
    result = RegQueryValueEx(
        hKey,
        "GDIProcessHandleQuota",
        0,
        0, 
        reinterpret_cast<LPBYTE>(&value), 
        &size);

    if (result != ERROR_SUCCESS)
    {
        ...
    }

    size = sizeof(DWORD);

    //after this executes, value should contain the DWORD data of the specified registry key/valuename
    result = RegGetValue(
        hKey,
        NULL,
        "GDIProcessHandleQuota",
        RRF_RT_REG_DWORD,
        NULL,
        &value,
        &size);

    if (result != ERROR_SUCCESS)
    {
        ...
    }

    RegCloseKey(hKey);
}

Alternatively:

DWORD value;
DWORD size = sizeof(DWORD);

//after this executes, value should contain the DWORD data of the specified registry key/valuename
LONG result = RegGetValue(
    HKEY_LOCAL_MACHINE,
    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
    "GDIProcessHandleQuota",
    RRF_RT_REG_DWORD | RRF_SUBKEY_WOW6464KEY,
    NULL,
    &value,
    &size);

if (result != ERROR_SUCCESS)
{
    ...
}

Weird behavior when getting registry value via RegQueryValueEx and RegGetValue

1 Answers1