cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

FASL read registry outside WOW6432Node?

Jump to solution

How do I get a FASL check to read outside Wow6432Node?  For instance, if I want to check for "\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{e1c810aa-f7cc-4aaf-ada1-181863075f9b}" the following FASL still looks in Wow6432Node and returns VULNERABLE:

var rmtReg = new RemoteRegistry();

    rmtReg.connect();

    var EMETKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\{e1c810aa-f7cc-4aaf-ada1-181863075f9b}";

Easy to confirm, just manually add the same key to WOW6432Node and FASL returns NOTVULNERABLE. I understand that the scanner is a 32-bit process but  I don't see why that would return the WOW6432 value when using Remote Registry.

1 Solution

Accepted Solutions

Re: FASL read registry outside WOW6432Node?

Jump to solution

I see, the problem is the older registry functions in FASL are not x64 compatible. The documentation says to use GetRegKeyValue3, but since that just returns null (have a case open) I used GetRegKeyValue2 instead. 2 is supposedly deprecated but had to use it since GetRegKeyValue3 didn't work.

View solution in original post

1 Reply

Re: FASL read registry outside WOW6432Node?

Jump to solution

I see, the problem is the older registry functions in FASL are not x64 compatible. The documentation says to use GetRegKeyValue3, but since that just returns null (have a case open) I used GetRegKeyValue2 instead. 2 is supposedly deprecated but had to use it since GetRegKeyValue3 didn't work.

View solution in original post

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community