Wrong registry paths for 32 and 64 bit aliases and applications

[mnissl]

There are a couple of wrong assumptions about aliases and their registry paths:

The alias does not depend on the processor architecture of the host machine, but on the architecture of the running process: a 64 bit application will take the 64 bit alias, a 32 bit application will take the 32 bit alias, even on a 64 bit machine.

Then again, due to Registry Redirection, it is not necessary to specify two different paths as registy redirection will do this automatically (transparently) for you.

So it is sufficient to supply only @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo" to the GetValue() method ... and it will be correct for both 32 and 64 bit applications.

In fact, you mixed up the two paths in your code: the one with "WOW6432Node" is the path for 32 bit applications, not for 64 bit!

So your code is broken for 64 bit applications as redirection does not take place if you explicitly refer to the WOW6432Node path ... but this path holds the value for 32 bit applications!

[droyad]

@mnissl Thanks for that, I've recently learnt about redirection magic and this now makes sense

[droyad]

Also see this tweet and the thread it belongs to from swiftonsecurity