How to find a installed target?

[LCF-AT]

Hi guys,

 

just have a short question again.

 

Can you show me a exsample how to check the registry to find some specific installed targets filenames?So I wanna find the target name as "ABC.exe" + the path to this file.So I tried already to use RegOpenKey../ RegEnumKey..like this..

0012FFB4   0046A03D  /CALL to RegOpenKeyA from UnPackMe.0046A038

0012FFB8   80000002  |hKey = HKEY_LOCAL_MACHINE

0012FFBC   0046A081  |Subkey = "software\*\ABC.exe"

0012FFC0   0046A094  \pHandle = OFFSET <UnPackMe.handle>

...but its not working to find the filename on that way. Problem also is that the file can be installed in any folder xy not same as ABC folder etc.So I think I have to check all folders & sub folders in HKLM to find the same name ABC.exe and also the path too.Question now is how to handle this?Or a better question would be....is there any other better and faster way to find it out whether the target ABC.exe was installed on system or not + if yes how to get the path?Maybe you know again some helpfully answers to handle this problem.

 

In short again: How to check whether ABC.exe is installed on system (Yes/No) and if YES how to get the path to this target (c:\...\. \..\ABC.exe).

 

Thanks again

[simple]

There's no "1 size fits all' way to check if a program is installed. Some programs use the regsitry, others don't (many don't). There's various ways to run an .exe at startup besides registry.

 

If by "installed" you mean if a program runs on startup, you can use that kernel driver process detector you had written for u a year or 2 back, and it should tell you the directory the .exe is running from.

[NeWOT]

I think it depends in some situations. In one that if it using installer then it probably made a folder in Program files ... And the second, is zipped maybe then you can't, you can see if it's running or not. Maybe the file made in C:\ or in %TEMP% or in %appdata% in most situations..

[LCF-AT]

Hi again,

 

ok I made a code now to check the registry for the installed folder names which seems to be always same (I think so).After this I check for Reg key name "InstallDir" to get the path.So this way is working now so far.I also checked other normal apps and they did almost the same so that I think its ok so now. Just using RegOpenKeyEx & RegQueryValueEx APIs for this.If found = all ok and if not then app shouldn't be installed or its portable etc. Anyway so I think this is the easiest solution so far to use for me.

 

Thanks again guys.