Here is a new spreadsheet that lists all installed programs. It does this by enumerating registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.
This spreadsheet works on 32-bit and 64-bit Excel.
InstalledPrograms_V0_0_1.zip (https)
MD5: 0BF27B9D4B6316381E0AADC1777B7F8F
SHA256: 60AF8234BD10E12221CAD3D2544222819CB0CC0834E339084590860F30E0D580
Didier Stevens 
For 64-bit Windows, is HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ a better place to pull installed applications from?
Comment by earthsound — Friday 13 July 2012 @ 15:18
@earthsound Are you asking for 64-bit Excel on 64-bit Windows?
Comment by Didier Stevens — Friday 13 July 2012 @ 15:29
I’m not at a 64-bit machine right now, but I was under the impression that HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ may contain applications that may not be found in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall due to the difference in where 32-bit and 64-bit applications’ keys are stored, whether the keys are redirected or mapped, and which version of Windows you’re running.
Comment by earthsound — Friday 13 July 2012 @ 16:10
@earthsound Ah yes, now I understand what you mean, excellent point. I overlooked the fact that on Windows 64-bit, 32-bit installation programs will actually register the installation in key HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall (from a 64-bit viewpoint).
So I have to adapt the 64-bit part of the code to include this key (I need to check both keys in 64-bit Excel).
Comment by Didier Stevens — Friday 13 July 2012 @ 18:57
Ah nice work Didier, i am going to steal this, sign it with my cert, bundle it up with some other tricks and include it in the new version of iKAT (v2012) π
Comment by Paul Craig — Wednesday 18 July 2012 @ 16:29
@Paul I’m releasing a new version soon.
Comment by Didier Stevens — Wednesday 18 July 2012 @ 21:43
Can you flick me a mail with it when you do? I’m releasing new iKAT at XCon 2012 next month in China, so in the next few weeks would be super.
Feel free to donate any of your xls pages or ideas/concepts, they are very handy, often used by my users, and tbh really cool π
I also have a few new nifty SRP bypass tools in the new iKAT you might be interested in.
Comment by Paul Craig — Thursday 19 July 2012 @ 6:13
[…] InstalledPrograms.xls μμ VBAλ₯Ό μ΄μ©ν΄ μ€μΉλ νλ‘κ·Έλ¨ λͺ©λ‘μ νμΈν μ μλ λꡬλ€. […]
Pingback by [Jul 2012] FI Newsletter | FORENSIC INSIGHT — Friday 3 August 2012 @ 9:49
[…] fixed InstalledPrograms as earthsound suggested: now I include 32-bit installations on 64-bit systems (provided you use […]
Pingback by Update: InstalledPrograms.xls V0.0.2 « Didier Stevens — Tuesday 14 August 2012 @ 21:39