How do I discover component keys in the registry

Question

1.00/5 (1 vote)

See more:

It seems like there are some "smart" keys in the windows registry. When I say smart...I mean that they are there (RegEdit sees them) but if you perform a search you won't find them (via OpenSubKey/GetSubKey routines).

Case in point:

The registry has the following key:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\044A7038A79602FACF77629B3A9FFA16

If you Use the OpenKey/GetSubkey method you will get the 6 subkeys NONE of which is key

044A7038A79602FACF77629B3A9FFA16

.

I wish to build a file of keys added during a install, and then go and delete them. Why? Because when the installer runs it installs just fine, but you cannot uninstall my application.

In order to perform deletion and cleanup, I must find the keys first.

What I have tried:

I've tried the following

TopKey = CurrentKey.OpenSubKey(fullpath, RegistryKeyPermissionCheck.ReadSubTree, Lrights[K]);

Where CurrentKey is

HKEY_LOCAL_MACHINE

opened via both 64 bit and 32 bit, and

Lrights[K]

is all the enumerate rights of

System.Security.AccessControl.RegistryRights

I'm running in the debugger with Administrative rights.

The code to open the initial HKEY_LOCAL_MACHINE is:

RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry32);

or

RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, RegistryView.Registry64);

Posted 29-Nov-22 7:53am

Chester West

Updated 29-Nov-22 12:19pm

Add a Solution

Comments

Richard Deeming 30-Nov-22 4:49am

"... but you cannot uninstall my application ..."
That sounds like malicious behaviour to me. Any application which deliberately tried to prevent the owner of the computer from uninstalling it would immediately be flagged as malware, and banned from the network.

If you're not trying to write malware, then try explaining what you're actually trying to do and why.

If you are trying to write malware, then you've come to the wrong site.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Dave Kreskowiak · Answer 1 · 2022-11-29T12:19:00

There's no such thing as a "smart key", or anything "smart" in the registry.

What you are seeing are component GUIDs data rearranged into a different order. I ran into this about five or six years ago. I can't find my notes on it, but various groups of bytes in the GUIDs are rearranged to make up the key values you're seeing under the Components key.

You can make up your own MSI and add a feature and a component to it. Note the GUID you give the component and install it on a test machine. Go through the component data in the registry and you'll find the component key data and compare it to the noted GUID. You can compare the two to figure out what the rearrangement is.

EDIT:
I think it went something like this. Take a GUID and reverse the first three sections of it. The next two sections, every pair of characters are swapped:

{3F7E7201-428F-4624-BE2A-AFE115BED227}
 1027E7F3 F824 4264 EBA2 FA1E51EB2D72

becomes this in the Components key:
1027E7F3F8244264EBA2FA1E51EB2D72