cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

FASL read registry outside WOW6432Node?

Jump to solution

How do I get a FASL check to read outside Wow6432Node?  For instance, if I want to check for "\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\{e1c810aa-f7cc-4aaf-ada1-181863075f9b}" the following FASL still looks in Wow6432Node and returns VULNERABLE:

var rmtReg = new RemoteRegistry();

    rmtReg.connect();

    var EMETKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\InstalledSDB\\{e1c810aa-f7cc-4aaf-ada1-181863075f9b}";

Easy to confirm, just manually add the same key to WOW6432Node and FASL returns NOTVULNERABLE. I understand that the scanner is a 32-bit process but  I don't see why that would return the WOW6432 value when using Remote Registry.

1 Solution

Accepted Solutions
Highlighted

Re: FASL read registry outside WOW6432Node?

Jump to solution

I see, the problem is the older registry functions in FASL are not x64 compatible. The documentation says to use GetRegKeyValue3, but since that just returns null (have a case open) I used GetRegKeyValue2 instead. 2 is supposedly deprecated but had to use it since GetRegKeyValue3 didn't work.

View solution in original post

1 Reply
Highlighted

Re: FASL read registry outside WOW6432Node?

Jump to solution

I see, the problem is the older registry functions in FASL are not x64 compatible. The documentation says to use GetRegKeyValue3, but since that just returns null (have a case open) I used GetRegKeyValue2 instead. 2 is supposedly deprecated but had to use it since GetRegKeyValue3 didn't work.

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community