Home / server / Questions / 609089
In Process
Putnik
Asked: 2014-07-01 12:41:11 +0800 CST

How to find a path where an application was set up?

  • 772

I'm unsure whether I should put this question in Serverfault or Stackoverflow.

I'm developing a script (so 'press start->search' is not an option) and try to find out a way to find where an application was installed.

I already have the app SID. Looked at

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths and

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders but it didn't help for this app.

Creeping through the whole registry I found this path:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0019F09C4327ED11A893800002C0A966

Could anyone explain how can 0019F09C4327ED11A893800002C0A966 be calculated if I don't know it in advance?

I noticed that the key name here is mixed back-to-front application SID:

key 0E0D0A87 6588 CF44 08ED 156E22CA84C6
sid 78A0D0E0-8856-44FC-80DE-51E622AC486C

so I tried to search straight and reversed path numbers, just 0019F09C and reversed, but no luck.

In this question the application is PHP, but the solution should work for any app which is built according to MS rules (that is, don't just unzip itself somewhere but add proper data to the registry. I hope PHP do).

upd: screenshot to to Evan Anderson's answer to Evan Anderson's answer

windows-server-2003

1 Answers

  1. You're looking at an application managed by Windows Installer. The installation is identified by a globally-unique identifier (GUID, which you are referring to as the "SID"). That GUID is used in the name of registry locations where information about the installation is stored. The difference in the appearance of the GUID in one place versus another is because the GUID is stored in some locations in the "packed" format, and other places as "unpacked". (Here's some background and code to pack / unpack GUIDs: http://www.dwarfsoft.com/blog/2010/06/22/msi-package-code-fun/)

    Options that were specified during the installation of the package, assuming it was installed on a per-machine basis, would be located in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0019F09C4327ED11A893800002C0A966\InstallProperties.

    In particular, the InstallLocation value is what you're looking for. This value can contain the directory that was chosen for an installation, but an installation package is not required to update this value.

    Alternatively you can locate all the files associated with an installation package by substituting the packed GUID for the package in the following command:

    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components" /s | find "PACKED_GUID_HERE"

    This will work with any installation package but may give you a very long, verbose list of files.

    • 1