What is KEY_WOW64_RES? - winapi

Question

In the windows headers, there are
//
// Registry Specific Access Rights.
//
#define KEY_QUERY_VALUE (0x0001)
#define KEY_SET_VALUE (0x0002)
#define KEY_CREATE_SUB_KEY (0x0004)
#define KEY_ENUMERATE_SUB_KEYS (0x0008)
#define KEY_NOTIFY (0x0010)
#define KEY_CREATE_LINK (0x0020)
#define KEY_WOW64_32KEY (0x0200)
#define KEY_WOW64_64KEY (0x0100)
#define KEY_WOW64_RES (0x0300)
These are all well documented in the MSDN article, Registry Key Security and Access Rights, except
KEY_WOW64_RES. What does this mean? It appears to turn on contradictory flags.

Answer 1

KEY_WOW64_RES is a combination of both KEY_WOW64_32KEY and KEY_WOW64_64KEY. It is useful for masking out WOW64 bits, such as when you need to make changes to a existing rights mask but want to preserve the WOW64 bits.
For example, you can AND a mask with KEY_WOW64_RES to retrieve its existing WOW64 bits, mask out KEY_WOW64_RES from the new mask, and then OR the original WOW64 bits into the new mask, eg:
REGSAM Rights = ...;
REGSAM Wow64Rights = rights & KEY_WOW64_RES;
Rights = (NewRights & ~KEY_WOW64_RES) | Wow64Rights;
One library I know uses KEY_WOW64_RES when attempting to open a Registry key for read-only access using less restrictive rights each time it fails:
// Preserve KEY_WOW64_XXX flags for later use
WOWFlags = FAccess & KEY_WOW64_RES;
Result = RegOpenKeyEx(..., KEY_READ | WOWFlags, ...);
if (Result == 0)
{
...
}
else
{
Result = RegOpenKeyEx(..., STANDARD_RIGHTS_READ | KEY_QUERY_VALUE | KEY_ENUMERATE_SUB_KEYS | WOWFlags, ...);
if (Result == 0)
{
...
}
else
{
Result = RegOpenKeyEx(..., KEY_QUERY_VALUE | WOWFlags, ...);
if (Result == 0)
{
...
}
}
}