{"id":6538,"date":"2019-07-13T20:52:55","date_gmt":"2019-07-13T20:52:55","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6538"},"modified":"2019-07-13T20:54:14","modified_gmt":"2019-07-13T20:54:14","slug":"beyond-good-ol-run-key-part-111","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/07\/13\/beyond-good-ol-run-key-part-111\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 111"},"content":{"rendered":"\n<p>I came across this entry by a pure chance. I was testing some software (sorry, can&#8217;t reveal which one) and  noticed that at some stage it tried to read the following WOW6432Node entry from the Registry:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\BidInterface\\Loader<br>:Path=?<\/p><\/blockquote>\n\n\n\n<p>Of course, anytime I see something like this I immediately test it as it is an opportunity to document yet another persistence mechanism. My quick test confirmed we can modify this value to load our DLL of choice when the aforementioned software starts. <\/p>\n\n\n\n<p>Now&#8230; this entry is not software-specific. In fact, the tested software does talk to the databases a lot. And after a quick googling exercise I discovered why I saw this artifact in my logs &#8211; the key is documented and is used for <a href=\"https:\/\/social.msdn.microsoft.com\/Forums\/en-US\/2c3beec5-3fba-4644-a496-1bddb944e246\/adonet-tracing?forum=adodotnetdataset\">ADO.NET<\/a> <a href=\"https:\/\/blogs.msdn.microsoft.com\/spike\/2010\/10\/22\/simplified-steps-for-creating-bid-etw-traces-for-ado-net-and-sqlncli\/\">Tracing<\/a>.<\/p>\n\n\n\n<p>Of course, it works in a non-WOW set up too:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>HKLM\\SOFTWARE\\Microsoft\\BidInterface\\Loader<br> :Path=?<\/p><\/blockquote>\n\n\n\n<p>So you can either do the tracing, or load a badness. Your choice.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I came across this entry by a pure chance. I was testing some software (sorry, can&#8217;t reveal which one) and noticed that at some stage it tried to read the following WOW6432Node entry from the Registry: HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\BidInterface\\Loader:Path=? Of course, anytime &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/07\/13\/beyond-good-ol-run-key-part-111\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6538"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6538"}],"version-history":[{"count":6,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6538\/revisions"}],"predecessor-version":[{"id":10273,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6538\/revisions\/10273"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}