How to run specific cmd.exe to get desired results?

Question

Windows 10:

I am trying to get the results from command,

REG QUERY HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL

When I start cmd from C:\Windows\System32\cmd.exe , it shows that Notepad++ is installed (which it is and is the desired output).

When I start cmd from C:\Windows\SysWOW64\cmd.exe , it does not show Notepad++.

I am running cmd from another custom application and it gives me the results as if run from sysWOW64.

How can I start the C:\Windows\SysWOW64\cmd.exe and have it start the C:\Windows\System32\cmd.exe and produce the desired result when running my Reg Query? Trying to use this method to simulate using my other application.

I have tried “ start C:\Windows\System32\cmd.exe /e:off /v:off /d /k ” and I get the undesired results.

Any help in getting the desired output and to understand why there is a difference between the cmd programs is greatly appreciated.

Answer 1

It is clear from your question that your custom application is 32-bit, and the information you require is from the 64-bit registry.

I do not believe that you need to do anything special in order to retrieve the information your require, as the option is already available in the command you're using.

If you open up a Command Prompt window, type reg query /? , and read the output, you should see the following information:

 /reg:64 Specifies the key should be accessed using the 64-bit registry view.

So to see if the 64-bit version of NotePad++ is installed, the following should let you know if the key exists, even from a 32-bit environment.

Reg Query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /F "NotePad++" /K /Reg:64

And, if you were wanting to see the location it was installed, then perhaps you could expand that further to:

Reg Query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /S /F "NotePad++" /K /V "InstallLocation" /Reg:64

Answer 2

I recommend to read first the Microsoft documentations:

• WOW64 Implementation Details
• File System Redirector
• Registry Keys Affected by WOW64
• Application Registration

The batch file finds out if being executed on 32-bit or on 64-bit Windows. Further it finds out if being executed in 32-bit execution environment on being executed on 64-bit Windows to access both Uninstall registry keys.

@echo off
setlocal EnableExtensions DisableDelayedExpansion
set "Windows64Bit="
set "WindowsBits=32"
rem Is the environment variable ProgramFiles(x86) defined?
rem That variable is defined by default only on 64-bit Windows?
if not "%ProgramFiles(x86)%" == "" set "Windows64Bit=1" & set "WindowsBits=64"

rem Define tool for the registry queries which is on 32-bit Windows the
rem 32-bit reg.exe in system directory of Windows and on 64-bit Windows
rem the 64-bit reg.exe in system directory of Windows.
set "RegTool=%SystemRoot%\System32\reg.exe"
rem Is the batch file executed by 32-bit cmd.exe in %SystemRoot%\SysWOW64
rem on 64-bit Windows, then change the path to use also in this case the
rem 64-bit reg.exe in Windows system directory.
if defined Windows64Bit if exist %SystemRoot%\Sysnative\reg.exe set "RegTool=%SystemRoot%\Sysnative\reg.exe"

echo Query %WindowsBits%-bit uninstall key of local machine.
%RegTool% QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
echo/
pause
echo/
echo Query %WindowsBits%-bit uninstall key of current user.
%RegTool% QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall 2>nul
echo/
pause
if defined Windows64Bit (
    echo/
    echo Query 32-bit uninstall key of local machine.
    %RegTool% QUERY HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    echo/
    pause
    echo/
    echo Query 32-bit uninstall key of current user.
    %RegTool% QUERY HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall 2>nul
    echo/
    pause
)

endlocal

There is nothing written about the reason to output everything of the Uninstall registry keys for Notepad++ .

Answer 3

The following will launch the 64 bit cmd.exe from a 32 bit cmd.exe (or other 32 bit application). This produces the desired output.

C:\Windows\Sysnative\cmd.exe /k "REG QUERY HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL"

This link explains in more detail. https://www.samlogic.net/articles/sysnative-folder-64-bit-windows.htm