Reading the Registry and Wow6432Node key

Home Q&A Reading the Registry and Wow6432Node key

Reading from the Windows Registry, including the Wow6432Node, is commonly used when you need to retrieve values for 32-bit applications running on a 64-bit Windows OS.

Here’s a quick explanation and sample code in PowerShell, Python, and C#:

What is Wow6432Node?

Wow6432Node is a registry node used on 64-bit Windows to separate 32-bit application settings from 64-bit ones. It is found under:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node

Read Registry (including Wow6432Node)

PowerShell Example:

# Read a 32-bit registry key on 64-bit system
$key = "HKLM:\SOFTWARE\Wow6432Node\YourAppName"
Get-ItemProperty -Path $key

If the key is under HKEY_CURRENT_USER, adjust the path accordingly.

Python Example (using winreg):

import winreg
# Read from 32-bit registry view
key_path = r"SOFTWARE\Wow6432Node\YourAppName"
try:
    registry_key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, key_path, 0, winreg.KEY_READ | winreg.KEY_WOW64_32KEY)
    value, regtype = winreg.QueryValueEx(registry_key, "YourValueName")
    print(f"Value: {value}")
    winreg.CloseKey(registry_key)
except FileNotFoundError:
    print("Registry key not found.")

C# Example:

using Microsoft.Win32;
string keyPath = @"SOFTWARE\Wow6432Node\YourAppName";
using (RegistryKey key = Registry.LocalMachine.OpenSubKey(keyPath, false))
{
    if (key != null)
    {
        var value = key.GetValue("YourValueName");
        Console.WriteLine("Value: " + value);
    }
    else
    {
        Console.WriteLine("Key not found");
    }
}