Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Tonight I have come across a strange phenomenon on win7 (64bit pro). When I copy regedit.exe to for example c:\ I am no longer able to run it. It simply doesn't start any more. When I try to debug it whit olly db, olly says it's no valid 32bit pe file any more. A closer look reveals that the file is somehow scrambled/realigned. The PE-Header is moved 8 bytes back. The sections rdata and pdata appear from nowhere.

What the hack is going on here?

Cheers, Jan

share|improve this question

migrated from stackoverflow.com May 31 '12 at 1:41

This question came from our site for professional and enthusiast programmers.

    
Why are you trying to copy regedit.exe in the first place? How did you try to move it? –  sarnold May 30 '12 at 23:37
    
I wanted to play around with it. For that, I wanted to insert int 3 (0xcc), to simplify debugging (running as normal user and as admin). That's why I wanted to safe it, before editing. I did strg+c strg+v on it in the explorer. –  user1427206 May 31 '12 at 0:20

3 Answers 3

up vote 5 down vote accepted

It's not a valid 32-bit file because C:\Windows\regedit.exe is a 64-bit executable. The 32-bit version is C:\Windows\SysWow64\regedit.exe.

I can confirm that neither will run if copied out of their default location.

Win7 does some magic under the covers. If you run regedit from a 32-bit process then you'll get the 32-bit exe from C:\Windows\SysWow64. If you run from a 64-bit process then you get the one in C:\Windows. So when your 32-bit debugger thinks it's debugging C:\Windows\regedit.exe it's actually got C:\Windows\SysWow64\regedit.exe. When you copy regedit.exe out of C:\Windows then the redirection doesn't occur and your 32-bit debugger has the 64-bit exe - hence the apparent change.

share|improve this answer
    
Well, I do not think that it is of importance, that olly speaks of a 32-bit file. I can debug the original (C:\windows\regedit.exe), so it ends up, that the file get's somehow changend. Cheers, Jan –  user1427206 May 31 '12 at 0:15
    
I've just added some more info to my answer. –  Andrew Cooper May 31 '12 at 0:29
    
Any details on why they won't run if copied elsewhere? –  sarnold May 31 '12 at 0:32
    
Aaaaah, I see. That solves the scrambling question. Thanks a lot :) –  user1427206 May 31 '12 at 1:32

Several of the tools on NT6 are stupid like this, they will not run without their MUI files (probably in the en-us folder).

I once hacked regedit to run non-elevated as admin and I had to fight it all the way to get that hacked copy to run and I don't remember the exact details of what I had to do...

share|improve this answer

When copying regedit.exe, you have to copy also its .mui file located in a culture subfolder (e.g. fr-FR\regedit.exe.mui), otherwise it won't start.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.