Didier Stevens

Friday 13 July 2012


Filed under: My Software — Didier Stevens @ 13:01

Here is a new spreadsheet that lists all installed programs. It does this by enumerating registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

This spreadsheet works on 32-bit and 64-bit Excel.

InstalledPrograms_V0_0_1.zip (https)
MD5: 0BF27B9D4B6316381E0AADC1777B7F8F
SHA256: 60AF8234BD10E12221CAD3D2544222819CB0CC0834E339084590860F30E0D580


  1. For 64-bit Windows, is HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ a better place to pull installed applications from?

    Comment by earthsound — Friday 13 July 2012 @ 15:18

  2. @earthsound Are you asking for 64-bit Excel on 64-bit Windows?

    Comment by Didier Stevens — Friday 13 July 2012 @ 15:29

  3. I’m not at a 64-bit machine right now, but I was under the impression that HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ may contain applications that may not be found in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall due to the difference in where 32-bit and 64-bit applications’ keys are stored, whether the keys are redirected or mapped, and which version of Windows you’re running.

    Comment by earthsound — Friday 13 July 2012 @ 16:10

  4. @earthsound Ah yes, now I understand what you mean, excellent point. I overlooked the fact that on Windows 64-bit, 32-bit installation programs will actually register the installation in key HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall (from a 64-bit viewpoint).

    So I have to adapt the 64-bit part of the code to include this key (I need to check both keys in 64-bit Excel).

    Comment by Didier Stevens — Friday 13 July 2012 @ 18:57

  5. Ah nice work Didier, i am going to steal this, sign it with my cert, bundle it up with some other tricks and include it in the new version of iKAT (v2012) πŸ™‚

    Comment by Paul Craig — Wednesday 18 July 2012 @ 16:29

  6. @Paul I’m releasing a new version soon.

    Comment by Didier Stevens — Wednesday 18 July 2012 @ 21:43

  7. Can you flick me a mail with it when you do? I’m releasing new iKAT at XCon 2012 next month in China, so in the next few weeks would be super.
    Feel free to donate any of your xls pages or ideas/concepts, they are very handy, often used by my users, and tbh really cool πŸ™‚
    I also have a few new nifty SRP bypass tools in the new iKAT you might be interested in.

    Comment by Paul Craig — Thursday 19 July 2012 @ 6:13

  8. […] InstalledPrograms.xls μ—‘μ…€ VBAλ₯Ό μ΄μš©ν•΄ μ„€μΉ˜λœ ν”„λ‘œκ·Έλž¨ λͺ©λ‘μ„ 확인할 수 μžˆλŠ” 도ꡬ닀. […]

    Pingback by [Jul 2012] FI Newsletter | FORENSIC INSIGHT — Friday 3 August 2012 @ 9:49

  9. […] fixed InstalledPrograms as earthsound suggested: now I include 32-bit installations on 64-bit systems (provided you use […]

    Pingback by Update: InstalledPrograms.xls V0.0.2 « Didier Stevens — Tuesday 14 August 2012 @ 21:39

RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.