Why can some HKLM entries be read on 64-bit PCs but some cannot from VB6

Question

So our software is used by one of our customers on legacy Windows versions because they're in an industrial,air-gaped setting and they have Windows XP and a bunch of old servers that are the only things that work for them. A few of of these are 64-bit.

Reading the registry I note that in some cases our 32-bit app can actually read directly the entry below on 64-bit Window - which should not theoretically be possible:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer and pull the version number from the string value "Version".

However, if we create a key on that same PC like HKEY_LOCAL_MACHINE\SOFTWARE\Our Software and add a string value like "Last Serviced", that cannot be read.

Permissions and ownership are the same as the IE entry when we try adding it there to no avail.

Going with \\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Our Software\Last Service Date works, of course, but why if some other stuff can go in the "normal" part of the registry and be readable, some won't? It would be easier and cleaner when pulling data from the application to read the service date, and critical if it gets incorrectly added to the standard HKEY_LOCAL_MACHINE by carelessness.

Am I missing something?

Answer 1

You have encountered the Registry Redirector :

The registry redirector isolates 32-bit and 64-bit applications by providing separate logical views of certain portions of the registry on WOW64. The registry redirector intercepts 32-bit and 64-bit registry calls to their respective logical registry views and maps them to the corresponding physical registry location. The redirection process is transparent to the application. Therefore, a 32-bit application can access registry data as if it were running on 32-bit Windows even if the data is stored in a different location on 64-bit Windows.

Some application registry keys, such as HKEY_LOCAL_MACHINE\Software are always redirected. Most of the registry hives are not redirected.

A 32/64-bit program may still force access to the 64/32-bit version of the registry by including special flags in the request, as described in the article Accessing an Alternate Registry View. See also Example of Registry Redirection on WOW64.