Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Tonight I have come across a strange phenomenon on win7 (64bit pro). When I copy regedit.exe to for example c:\ I am no longer able to run it. It simply doesn't start any more. When I try to debug it whit olly db, olly says it's no valid 32bit pe file any more. A closer look reveals that the file is somehow scrambled/realigned. The PE-Header is moved 8 bytes back. The sections rdata and pdata appear from nowhere.

What the hack is going on here?

Cheers, Jan

share|improve this question

migrated from May 31 '12 at 1:41

This question came from our site for professional and enthusiast programmers.

Why are you trying to copy regedit.exe in the first place? How did you try to move it? – sarnold May 30 '12 at 23:37
I wanted to play around with it. For that, I wanted to insert int 3 (0xcc), to simplify debugging (running as normal user and as admin). That's why I wanted to safe it, before editing. I did strg+c strg+v on it in the explorer. – user1427206 May 31 '12 at 0:20
up vote 5 down vote accepted

It's not a valid 32-bit file because C:\Windows\regedit.exe is a 64-bit executable. The 32-bit version is C:\Windows\SysWow64\regedit.exe.

I can confirm that neither will run if copied out of their default location.

Win7 does some magic under the covers. If you run regedit from a 32-bit process then you'll get the 32-bit exe from C:\Windows\SysWow64. If you run from a 64-bit process then you get the one in C:\Windows. So when your 32-bit debugger thinks it's debugging C:\Windows\regedit.exe it's actually got C:\Windows\SysWow64\regedit.exe. When you copy regedit.exe out of C:\Windows then the redirection doesn't occur and your 32-bit debugger has the 64-bit exe - hence the apparent change.

share|improve this answer
Well, I do not think that it is of importance, that olly speaks of a 32-bit file. I can debug the original (C:\windows\regedit.exe), so it ends up, that the file get's somehow changend. Cheers, Jan – user1427206 May 31 '12 at 0:15
I've just added some more info to my answer. – Andrew Cooper May 31 '12 at 0:29
Any details on why they won't run if copied elsewhere? – sarnold May 31 '12 at 0:32
Aaaaah, I see. That solves the scrambling question. Thanks a lot :) – user1427206 May 31 '12 at 1:32

Several of the tools on NT6 are stupid like this, they will not run without their MUI files (probably in the en-us folder).

I once hacked regedit to run non-elevated as admin and I had to fight it all the way to get that hacked copy to run and I don't remember the exact details of what I had to do...

share|improve this answer

When copying regedit.exe, you have to copy also its .mui file located in a culture subfolder (e.g. fr-FR\regedit.exe.mui), otherwise it won't start.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .