Use a variable in a Remote Registry query

3 posts · Closed

Aaron Guest
28 Aug 2019

Hi Andrew, Ann and all,

Quick question: is it possible to use a variable in a Remote Registry query?

I'm trying to read a specific value for a 32-bit program across both x86 and x64 systems, which will either reside in

HKLM\Software\Wow6432Node\Program Name\Key

or

HKLM\Software\Program Name\Key

depending on the OS architecture, but haven't had any luck with trying the bracket / vertical line method, or changing the drop-down value to allow wildcards.

E.g. I've tried

HKLM\Software\[Wow6432Node\|\ ]Program Name\Key

which in theory would return either of the above, and variations of this, but keep getting No Key returned.

As a workaround, I have two separate queries which work, but I'd love to be able to combine these into one column with one query.

Andrew SoftPerfect
29 Aug 2019

This syntax isn't supported in registry paths in the current release. However, it makes sense to implement it, which we just did in the fresh builds.

It should now be possible to use something like this in the multiple keys/wildcards mode:

Software\\[Wow6432Node\|]Program Name\Key

Please note: it has to be either wildcards (* and ?) or alternating segments [segment1|segment2], not both in the same expression.

We have also added a Registry Browser for convenient selection of paths and value names. Look for the [...] buttons next to the registry path and value name when editing a Remote Registry item.

Aaron Guest
3 Sep 2019

Thanks Andrew - you're a legend... works perfectly!! Is here anything you can't get this wonderful program to do!?! ;-)

This topic is closed. It has had no new posts for over a year, so the software versions it talks about may be out of date. Start a new topic in Network Scanner if you have a similar question.