Incorrect Registry access

[wasowerby]

I have one installation executable which always reads the registry of the host machine (Windows XP Home) rather than the registry of the Windows Vista 32-bit guest when run in the guest. All other installation executables using exactly the same registry reading action (Wise 9.02 'Get Registry Key Value') read the guest registry ok when run in the guest OS.

Any ideas? Using VMware Workstation Version 6.0.2 Build 59824.

Regards...Andrew

[continuum]

> I have one installation executable which always reads the registry of

the host machine (Windows XP Home) rather than the registry of the

Windows Vista 32-bit guest when run in the guest.

This should be impossible - explain better please.

[wasowerby]

I have several Wise installation executables all containing exactly the same HKEY_LOCAL_MACHINE 'Get Registry Key' action:

item: Get Registry Key Value

Variable=WINVER

Key=Software\Microsoft\Windows NT\CurrentVersion

Default=0

Value Name=CurrentVersion

Flags=00000100

end

All but one return WinVer=6.0 (the Vista Business guest OS version) when they are run in a Vista VMWare guest. The 'rogue' executable returns WinVER=5.1 (the Win XP Home host's OS version) when run in the Vista guest.

Regards...Andrew

[continuum]

Very strange - and very interesting.

How should this work ? - sounds like Vodoo ...

Anyway - lets do some tests.

Try to add

monitor_control.restrict_backdoor = "true"

to the vmx-file of that misbehaving VM.

This will close the backdoor - lets see if that changes the result

[wasowerby]

No difference I'm afraid! Have attached the offending file. Run it in a Vista guest and see that 1st message is Winver=5.1 not 6.0.

Regards...Andrew

[wasowerby]

Sorry, the file was too large. Here is a cut down version Install511_P.EXE. Run it in a Vista guest and you will see a message WinVer=5.1. Now here is what's really weird: Change the name of the file to, say, Install511_T.EXE run it and you will see Winver=6.0 which is correct!!

Regards...Andrew

[wasowerby]

Now here is what's even more weird: If I run the file (Install511_P.EXE) from the following Vista guest folder: c:\Program Files\Skylog Installation Files, WinVer=5.1. If I run it from any other c:\Program Files folder (or change it's name), WinVer=6.0.

Regards...Andrew

[rsa911]

I suggest you install a tool similar to Microsoft' Proces Monitor, able to capture and display in real time, registry and file access done by processes

very easy to use and free, it does not even requires any install: just drop the exe somewhere , start it and you're done

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/processmonitor.mspx

you should be able to determine which registry keys are read by your .exe

[ksc]

From the symptoms, this is sounding more like a Microsoft compatability workaround - returning faked data to make sure that an app works correctly on newer versions of windows. Microsoft has a moderately large database of programs which have workarounds, and matching based on executable name is one technique they use, and returning an older version is a very common workaround when Microsoft has seen an app that does something like if (version != 5) { error("NT4 not supported") }.

Raymond Chen of Microsoft has a book about these efforts: http://www.amazon.com/Old-New-Thing-Development-Throughout/dp/0321440307

His blog also periodically discusses these workarounds: http://blogs.msdn.com/oldnewthing/

Loosely put, I don't think you're getting your HOST registry settings. I think you're getting registry settings faked by the Vista guest to look like an older version of Windows, faked by matches on some attribute of the executable you are running (filename and location).

[wasowerby]

Thanks for the replies. Yes, I think you're right. For some reason, my Vista guest is returning the XP version info for that file name/folder as it thinks the app is an XP app. Extremely weird! The behaviour really stuffs up my installation script as it relies on a correct determination of the OS being installed into.

Regards...Andrew