1

I have a legacy Windows application that reads values from specific registry key (and its subkeys). I'd like to change the key it reads, so when it opens e.g. HKEY_LOCAL_MACHINE\SOFTWARE\Something, it will be transparently redirected to HKEY_LOCAL_MACHINE\SOFTWARE\Redirected\Something. Or even to corresponding key in HKEY_CURRENT_USER.

This is identical to what Windows itself uses for WOW64 virtualization (https://msdn.microsoft.com/en-us/library/windows/desktop/aa384232(v=vs.85).aspx).

I can inject DLL into target process, to call necessary APIs from within target process context, so maybe there is some well-hidden system API, that exposes this functionality. Only way I'm thinking currently is to hook all relevant registry APIs and change the requested keys in each and every invocation of those APIs, but I think that is rather extreme approach, so I'd like to find any better ways.

Maybe WOW64 registry redirection internal APIs can be (ab)used for this? Or maybe there exists some slightly less-involving method than API hooking of all core registry API functions?

Thanks in advance.

Titan
  • 2,875
  • 5
  • 23
  • 34
  • 1
    Hooking the registry APIs is going to be the easiest approach. Hooking RegOpenKeyEx to re-write the key should get the job done. – David Heffernan Feb 25 '16 at 12:37
  • If you are open to less-documented ways, see this [Understanding NT](http://www.drdobbs.com/understanding-nt/184416290) article for a starting point about registry symbolic links. – dxiv Feb 26 '16 at 03:40

0 Answers0