Back in the Windows NT days, there were indeed two separate registry editors: regedit.exe (16-bit) and regedit32.exe (32-bit). With modern 64-bit Windows systems, Microsoft unified these into a single regedit.exe that handles both 32-bit and 64-bit registry access.
The key difference lies in how 32-bit applications access the registry under 64-bit Windows, through the Windows-on-Windows 64 (WoW64) subsystem. The system implements registry redirection for certain keys:
HKEY_LOCAL_MACHINE\Software\ → Redirects to HKEY_LOCAL_MACHINE\Software\WOW6432Node\
HKEY_CURRENT_USER\Software\ → Redirects to HKEY_CURRENT_USER\Software\WOW6432Node\
When developing applications that need explicit registry access, you can use these flags:
// C# example using Microsoft.Win32
RegistryKey key64 = RegistryKey.OpenBaseKey(
RegistryHive.LocalMachine,
RegistryView.Registry64);
RegistryKey key32 = RegistryKey.OpenBaseKey(
RegistryHive.LocalMachine,
RegistryView.Registry32);
Consider these scenarios:
- 32-bit apps reading from HKEY_LOCAL_MACHINE\Software\MyApp will actually access WOW6432Node\MyApp
- 64-bit services may need explicit 32-bit view to communicate with 32-bit components
- Installers must account for both views when writing registry entries
PowerShell provides easy ways to check registry views:
# Access 64-bit registry
Get-Item -Path "HKLM:\SOFTWARE\Microsoft"
# Access 32-bit registry (redirected)
Get-Item -Path "HKLM:\SOFTWARE\WOW6432Node\Microsoft"
Prior to Windows 7, certain registry keys were "reflected" between views. This behavior has been deprecated, so modern applications should explicitly access the correct view.
Back in the Windows NT days, we had two separate registry editors: regedit.exe (16-bit) and regedit32.exe (32-bit). With the transition to 64-bit Windows, Microsoft consolidated these into a single regedit.exe that handles both 32-bit and 64-bit registry access.
The key architectural difference lies in how Windows handles registry access for 32-bit applications on 64-bit systems:
// Example of registry paths affected by redirection
HKEY_LOCAL_MACHINE\Software\MyApp (32-bit app → redirected to Wow6432Node)
HKEY_LOCAL_MACHINE\Software\MyApp (64-bit app → accesses native path)
While there's no separate regedit64.exe, you can force 64-bit registry access through these methods:
// PowerShell command to launch 64-bit regedit
Start-Process -FilePath "$env:windir\regedit.exe" -ArgumentList "/m"
When writing registry access code, consider these scenarios:
// C# example showing proper registry access patterns
using (RegistryKey key = RegistryKey.OpenBaseKey(
RegistryHive.LocalMachine,
RegistryView.Registry64))
{
// This will access the true 64-bit registry
using (RegistryKey subKey = key.OpenSubKey(@"Software\MyApp"))
{
// Read/write operations here
}
}
Common pitfalls include:
- 32-bit processes reading from Wow6432Node unexpectedly
- Incorrect view flags in API calls
- Mixed-bitness DLL injection affecting registry paths
Use Process Monitor from Sysinternals to trace actual registry access paths during debugging.
Modern Windows versions implement registry virtualization for protected areas:
// Virtualized registry path example
HKEY_USERS\S-1-5-21-...\Software\Classes\VirtualStore\MACHINE\SOFTWARE\MyApp
This affects both 32-bit and 64-bit applications running without admin privileges.