Problem with ShellExecute and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

[Duane Clark]

Dan Kegel wrote:
> 
> Thanks for the --debugmsg +process tip (and I guess you also did relay?)!
> 
> But if you also add +reg, you'll see that the App Paths key is indeed being searched
> by SearchPath():
> 

That was done inside CreateProcessA (note the relay Call and Ret pair), 
and at least at first glance, appears to be looking for the App Path key 
for "ListV", which is the name of my test application. I am note real 
sure what the NtQueryValueKey calls are doing though. I still think the 
problem is later on, in SHELL_FindExecutable. I think the registry 
checks here are "red herrings". Then again, I could be completely wrong 
about that ;)

Probably the best way to determine that is to modify your simple program 
to call CreateProcess directly, and see what happens then.

08073208:Call kernel32.CreateProcessA(00000000,40582788 "wordpad.exe 
readme.txt",00000000,00000000,00000000,00000000,00000000,0040e4db 
"C:\\",40581eb8,40581ea8) ret=40c8d29f
trace:process:CreateProcessA app (null) cmdline "wordpad.exe readme.txt"
trace:process:find_exe_file looking for "wordpad.exe"
trace:reg:NtOpenKey 
((nil),L"Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\App 
Paths",f003f,0x4057e998)
trace:reg:NtOpenKey <- 0x4c
trace:reg:NtOpenKey (0x4c,L"ListV.exe",f003f,0x4057e994)
trace:reg:NtOpenKey <- (nil)
trace:reg:NtOpenKey 
((nil),L"Machine\\Software\\Wine\\Wine\\Config\\AppDefaults",f003f,0x4057fdf0)
trace:reg:NtOpenKey <- 0x4c
trace:reg:NtOpenKey (0x4c,L"ListV.exe\\DllOverrides",f003f,0x4057fdec)
trace:reg:NtOpenKey <- (nil)
trace:reg:NtQueryValueKey (0x14,L"wordpad.exe",2,0x4057fee4,80,22)
trace:reg:NtQueryValueKey (0x14,L"*wordpad.exe",2,0x4057fee4,80,24)
trace:reg:NtQueryValueKey (0x14,L"*",2,0x4057fee4,80,2)
trace:process:find_exe_file Trying built-in exe 
"C:\\WINDOWS\\SYSTEM\\wordpad.exe"
trace:process:find_exe_file Trying native exe 
"C:\\WINDOWS\\SYSTEM\\wordpad.exe"
trace:process:find_exe_file looking for "wordpad.exe readme.txt"
trace:reg:NtOpenKey 
((nil),L"Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\App 
Paths",f003f,0x4057e998)
trace:reg:NtOpenKey <- 0x4c
trace:reg:NtOpenKey (0x4c,L"ListV.exe",f003f,0x4057e994)
trace:reg:NtOpenKey <- (nil)
trace:reg:NtOpenKey 
((nil),L"Machine\\Software\\Wine\\Wine\\Config\\AppDefaults",f003f,0x4057fdf0)
trace:reg:NtOpenKey <- 0x4c
trace:reg:NtOpenKey (0x4c,L"ListV.exe\\DllOverrides",f003f,0x4057fdec)
trace:reg:NtOpenKey <- (nil)
trace:reg:NtQueryValueKey (0x14,L"wordpad.exe 
readme.txt",2,0x4057fee4,80,44)
trace:reg:NtQueryValueKey (0x14,L"*wordpad.exe 
readme.txt",2,0x4057fee4,80,46)
trace:reg:NtQueryValueKey (0x14,L"*",2,0x4057fee4,80,2)
trace:process:find_exe_file Trying built-in exe 
"C:\\WINDOWS\\SYSTEM\\wordpad.exe readme.txt"
trace:process:find_exe_file Trying native exe 
"C:\\WINDOWS\\SYSTEM\\wordpad.exe readme.txt"
08073208:Ret  kernel32.CreateProcessA() retval=00000000 ret=40c8d29f