Jump to content
Tuts 4 You
Sign in to follow this  
LCF-AT

How to find a installed target?

Recommended Posts

LCF-AT

Hi guys,


 


just have a short question again.


 


Can you show me a exsample how to check the registry to find some specific installed targets filenames?So I wanna find the target name as "ABC.exe" + the path to this file.So I tried already to use RegOpenKey../ RegEnumKey..like this..



0012FFB4 0046A03D /CALL to RegOpenKeyA from UnPackMe.0046A038
0012FFB8 80000002 |hKey = HKEY_LOCAL_MACHINE
0012FFBC 0046A081 |Subkey = "software\*\ABC.exe"
0012FFC0 0046A094 \pHandle = OFFSET <UnPackMe.handle>

...but its not working to find the filename on that way. :) Problem also is that the file can be installed in any folder xy not same as ABC folder etc.So I think I have to check all folders & sub folders in HKLM to find the same name ABC.exe and also the path too.Question now is how to handle this?Or a better question would be....is there any other better and faster way to find it out whether the target ABC.exe was installed on system or not + if yes how to get the path?Maybe you know again some helpfully answers to handle this problem. :)


 


In short again: How to check whether ABC.exe is installed on system (Yes/No) and if YES how to get the path to this target (c:\...\. \..\ABC.exe).


 


Thanks again


Share this post


Link to post
simple

There's no "1 size fits all' way to check if a program is installed. Some programs use the regsitry, others don't (many don't). There's various ways to run an .exe at startup besides registry.


 


If by "installed" you mean if a program runs on startup, you can use that kernel driver process detector you had written for u a year or 2 back, and it should tell you the directory the .exe is running from.


Share this post


Link to post
NeWOT

I think it depends in some situations. In one that if it using installer then it probably made a folder in Program files ... And the second, is zipped maybe then you can't, you can see if it's running or not. Maybe the file made in C:\ or in %TEMP% or in %appdata% in most situations..


  • Like 1

Share this post


Link to post
LCF-AT

Hi again,


 


ok I made a code now to check the registry for the installed folder names which seems to be always same (I think so).After this I check for Reg key name "InstallDir" to get the path.So this way is working now so far.I also checked other normal apps and they did almost the same so that I think its ok so now. :) Just using RegOpenKeyEx & RegQueryValueEx APIs for this.If found = all ok and if not then app shouldn't be installed or its portable etc. :) Anyway so I think this is the easiest solution so far to use for me.


 


Thanks again guys.


  • Like 1

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...