Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

Tonight I have come across a strange phenomenon on win7 (64bit pro). When I copy regedit.exe to for example c:\ I am no longer able to run it. It simply doesn't start any more. When I try to debug it whit olly db, olly says it's no valid 32bit pe file any more. A closer look reveals that the file is somehow scrambled/realigned. The PE-Header is moved 8 bytes back. The sections rdata and pdata appear from nowhere.

What the hack is going on here?

Cheers, Jan

share|improve this question
Why are you trying to copy regedit.exe in the first place? How did you try to move it? – sarnold May 30 '12 at 23:37
I wanted to play around with it. For that, I wanted to insert int 3 (0xcc), to simplify debugging (running as normal user and as admin). That's why I wanted to safe it, before editing. I did strg+c strg+v on it in the explorer. – user1427206 May 31 '12 at 0:20

migrated from stackoverflow.com May 31 '12 at 1:41

2 Answers

up vote 4 down vote accepted

It's not a valid 32-bit file because C:\Windows\regedit.exe is a 64-bit executable. The 32-bit version is C:\Windows\SysWow64\regedit.exe.

I can confirm that neither will run if copied out of their default location.

Win7 does some magic under the covers. If you run regedit from a 32-bit process then you'll get the 32-bit exe from C:\Windows\SysWow64. If you run from a 64-bit process then you get the one in C:\Windows. So when your 32-bit debugger thinks it's debugging C:\Windows\regedit.exe it's actually got C:\Windows\SysWow64\regedit.exe. When you copy regedit.exe out of C:\Windows then the redirection doesn't occur and your 32-bit debugger has the 64-bit exe - hence the apparent change.

share|improve this answer
Well, I do not think that it is of importance, that olly speaks of a 32-bit file. I can debug the original (C:\windows\regedit.exe), so it ends up, that the file get's somehow changend. Cheers, Jan – user1427206 May 31 '12 at 0:15
I've just added some more info to my answer. – Andrew Cooper May 31 '12 at 0:29
Any details on why they won't run if copied elsewhere? – sarnold May 31 '12 at 0:32
Aaaaah, I see. That solves the scrambling question. Thanks a lot :) – user1427206 May 31 '12 at 1:32
up vote 1 down vote

Several of the tools on NT6 are stupid like this, they will not run without their MUI files (probably in the en-us folder).

I once hacked regedit to run non-elevated as admin and I had to fight it all the way to get that hacked copy to run and I don't remember the exact details of what I had to do...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.