1

Tonight I have come across a strange phenomenon on win7 (64bit pro). When I copy regedit.exe to for example c:\ I am no longer able to run it. It simply doesn't start any more. When I try to debug it whit olly db, olly says it's no valid 32bit pe file any more. A closer look reveals that the file is somehow scrambled/realigned. The PE-Header is moved 8 bytes back. The sections rdata and pdata appear from nowhere.

What the hack is going on here?

Cheers, Jan

Improve this question
2
  • Why are you trying to copy regedit.exe in the first place? How did you try to move it?
    – sarnold
    May 30, 2012 at 23:37
  • I wanted to play around with it. For that, I wanted to insert int 3 (0xcc), to simplify debugging (running as normal user and as admin). That's why I wanted to safe it, before editing. I did strg+c strg+v on it in the explorer.
    – user1427206
    May 31, 2012 at 0:20

3 Answers 3

Reset to default
5

It's not a valid 32-bit file because C:\Windows\regedit.exe is a 64-bit executable. The 32-bit version is C:\Windows\SysWow64\regedit.exe.

I can confirm that neither will run if copied out of their default location.

Win7 does some magic under the covers. If you run regedit from a 32-bit process then you'll get the 32-bit exe from C:\Windows\SysWow64. If you run from a 64-bit process then you get the one in C:\Windows. So when your 32-bit debugger thinks it's debugging C:\Windows\regedit.exe it's actually got C:\Windows\SysWow64\regedit.exe. When you copy regedit.exe out of C:\Windows then the redirection doesn't occur and your 32-bit debugger has the 64-bit exe - hence the apparent change.

Improve this answer
4
  • Well, I do not think that it is of importance, that olly speaks of a 32-bit file. I can debug the original (C:\windows\regedit.exe), so it ends up, that the file get's somehow changend. Cheers, Jan
    – user1427206
    May 31, 2012 at 0:15
  • I've just added some more info to my answer.
    – Andrew Cooper
    May 31, 2012 at 0:29
  • Any details on why they won't run if copied elsewhere?
    – sarnold
    May 31, 2012 at 0:32
  • Aaaaah, I see. That solves the scrambling question. Thanks a lot :)
    – user1427206
    May 31, 2012 at 1:32
1

When copying regedit.exe, you have to copy also its .mui file located in a culture subfolder (e.g. fr-FR\regedit.exe.mui), otherwise it won't start.

Improve this answer
0

Several of the tools on NT6 are stupid like this, they will not run without their MUI files (probably in the en-us folder).

I once hacked regedit to run non-elevated as admin and I had to fight it all the way to get that hacked copy to run and I don't remember the exact details of what I had to do...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .