Question to "Remote Regedit"

In Win8.1SE (OS in Ram) with the Runscanner plugin (v55):

"Remote Regedit" shows me in HKLM the registry of the remote system
But in HKCU i see the registry of the Win8.1SE Administrator. 

Is it not the case that the /ac switch should load the remote user to HKCU?

fuwi

It works fine here  (x86  OS in RAM   v. 55)

My build is x64, OS in RAM

fuwi

Runscanner is only a 32 bit application so will show the 32 bit registry and can only be used with 32 bit applications.

Before you ask it uses the free MS detours package to intercept registry calls. The free version does not support 64 bit. MS charges $10000 for the 64 bit version. Hence there will not be a 64 bit version of runscanner. Its use is not recommended on 64 bit os.

Aah, thanks for this interesting information paraglider! 

fuwi

Hi Paraglider

Is it fine to use Remote Regedit to edit an offline 64 bit OS registry from a 32 bit PE ?.

In Win8.1SE (OS in Ram) with the Runscanner plugin (v55):

"Remote Regedit" shows me in HKLM the registry of the remote system
But in HKCU i see the registry of the Win8.1SE Administrator. 

Is it not the case that the /ac switch should load the remote user to HKCU?

I made a rebuild with x86 source -> identical to x64 build (registry of the Win8.1SE Administrator in HKCU)

fuwi

If there is one user then /ac will autoselect the user. Otherwise you should be prompted for the current user.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList in the remote registry is inspected to find the available user hives.

Also needs the /ec parameter to force the dialog. On my win8.1 x64 system I see 3 users in the ProfileList registry key apart from the 3 builtin system users.

Try adding the /ll parameter. It worked for me using 8.1 pe se and loading my 8.1 x64 remote registry.

If /ll is specified then last logged on user will be read from the remote registry and automatically set as HKCU. Acess to the remote SAM hive is required for this to work. Hence runscanner must be run as the SYSTEM user ( SAM subkeys have reigstry permissions set which only permit access by the SYSTEM user). This happens automatically when run from PE. If the current user profile could not be autoselected then the /ec parameter can be specified to force the showing of the select user dialog.

For info:
I tested with 8.1 OS x86/x64, the remote registry HKLM, HKCU is well mounted here.
I have the default settings: Runscanner.exe /t 0 /sd /ac /m+ /y regedit.exe.
in 64 bit PE regedit.exe 32-bit is called.

Is it fine to use Remote Regedit to edit an offline 64 bit OS registry from a 32 bit PE ?.

Whatever the PE or host architecture, remote regedit seems to work fine without concern to edit it.