Seek and hide x64 or where my Sound Recoder?

Everyone knows a useful Windows utilities, SoundRecorder.exe application. I believe, that most of you knows where this application in your disk. If not, it's always possible to look into shortcut.

 

So, let's go to %SystemRoot%\system32 and look for the application

 

So far so good. Now, let's look for this file by using File.Exist method of C#

File.Exists(@"%SystemRoot%\system32\SoundRecorder.exe");

It returns true. Of course, the file SoundRecorder.exe is there. As well as all other "smart" methods for seeking for system directories

File.Exists(Environment.SystemDirectory + @"\SoundRecorder.exe");
File.Exists(Environment.GetFolderPath(Environment.SpecialFolder.System) + @"\SoundRecorder.exe");

All those are true. Now let's compile the file not for "Any CPU", but for x64. It still works! Why now, it is there. Now, let's try to compile for x86 or, just run our process from other 32 bit process (emulation!). You'll get false. Sound Recorder just disappears in x86...

Actually, the problem is x64 file system and registry redirection. Actually, the file exists, but not in C:\Windows\System32. It is in C:\Windows\Sysnative directory, which actually not exists. According MSDN, it should be transparent for your applications. Actually, it's transparent for those applications, which works not in WOW64 mode.

In order to make it work, you should expand the actual location, by using

File.Exists(Environment.ExpandEnvironmentVariables(@"%systemroot%\Sysnative") + @"\SoundRecorder.exe");

Now, the file exists, but not in x64 mode. What to do? Check both locations? Probably yes (don't forget to check the target platform). You can either disable registry redirection, by using native method.

[DllImport("advapi32.dll", SetLastError = true)]
static extern int RegDisableReflectionKey(IntPtr hBase);

One thing is for sure. We should learn more about x64 applications. Maybe in this case, our programs begin to work much faster, by utilizing double power of x64 processors.

For your convenience, here the list of system programs, that can "fool you" in x64 platforms (Vista):

alg.exe
bcdedit.exe
BitLockerWizard.exe
bridgeunattend.exe
change.exe
chglogon.exe
chgport.exe
chgusr.exe
cofire.exe
CompMgmtLauncher.exe
consent.exe
csrss.exe
Defrag.exe
DeviceEject.exe
DFDWiz.exe
dfsr.exe
dispdiag.exe
dpinst.exe
dwm.exe
fsquirt.exe
fvenotify.exe
FXSCOVER.exe
FXSSVC.exe
FXSUNATD.exe
irftp.exe
Locator.exe
logoff.exe
lpksetup.exe
lpremove.exe
lsass.exe
mblctr.exe
MdRes.exe
MdSched.exe
mrt.exe
msconfig.exe
msdtc.exe
msg.exe
Narrator.exe
netcfg.exe
NetProj.exe
ntoskrnl.exe
nvcolor.exe
nvcplui.exe
nvudisp.exe
nvuninst.exe
p2phost.exe
PkgMgr.exe
plasrv.exe
PnPUnattend.exe
PnPutil.exe
poqexec.exe
PresentationSettings.exe
PrintBrmUi.exe
printfilterpipelinesvc.exe
PushPrinterConnections.exe
qappsrv.exe
qprocess.exe
query.exe
quser.exe
qwinsta.exe
rdpclip.exe
RelPost.exe
reset.exe
rstrui.exe
rwinsta.exe
sdclt.exe
setupcl.exe
shadow.exe
sigverif.exe
SLLUA.exe
SLsvc.exe
SLUI.exe
smss.exe
SnippingTool.exe
snmptrap.exe
SoundRecorder.exe
spoolsv.exe
srdelayed.exe
StikyNot.exe
tabcal.exe
tscon.exe
tsdiscon.exe
tskill.exe
ucsvc.exe
UI0Detect.exe
vds.exe
VSJitDebugger.exe
VSSVC.exe
wbadmin.exe
wbengine.exe
wercon.exe
WFS.exe
wiawow64.exe
winload.exe
winresume.exe
WinSAT.exe
wisptis.exe
wpcumi.exe
wpnpinst.exe
wsqmcons.exe
wuauclt.exe
WUDFHost.exe

Have a nice day