{"action":"created","issue":{"url":"https://api.github.com/repos/quasar/QuasarRAT/issues/352","labels_url":"https://api.github.com/repos/quasar/QuasarRAT/issues/352/labels{/name}","comments_url":"https://api.github.com/repos/quasar/QuasarRAT/issues/352/comments","events_url":"https://api.github.com/repos/quasar/QuasarRAT/issues/352/events","html_url":"https://github.com/quasar/QuasarRAT/issues/352","id":102985014,"number":352,"title":"[Client only] WOW64 and the problems","user":{"login":"MaxXor","id":7271470,"avatar_url":"https://avatars.githubusercontent.com/u/7271470?v=3","gravatar_id":"","url":"https://api.github.com/users/MaxXor","html_url":"https://github.com/MaxXor","followers_url":"https://api.github.com/users/MaxXor/followers","following_url":"https://api.github.com/users/MaxXor/following{/other_user}","gists_url":"https://api.github.com/users/MaxXor/gists{/gist_id}","starred_url":"https://api.github.com/users/MaxXor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MaxXor/subscriptions","organizations_url":"https://api.github.com/users/MaxXor/orgs","repos_url":"https://api.github.com/users/MaxXor/repos","events_url":"https://api.github.com/users/MaxXor/events{/privacy}","received_events_url":"https://api.github.com/users/MaxXor/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-25T09:13:00Z","updated_at":"2015-08-26T07:24:54Z","closed_at":null,"body":"Some weeks ago we've switched Quasar's Client to compile for `x86`, instead of `AnyCPU`.\r\n\r\n`AnyCPU` had the advantage that it would run the Client as 64-bit process on 64-bit systems and as 32-bit process on 32-bit systems.\r\n\r\nNow after the switch it runs on 32- and 64-bit systems as a 32-bit process (on 64-bit system in WOW64 environment). We needed the switch for loading 32-bit DLLs required for the Firefox Password Recovery.\r\n\r\n**These are the new problems we're facing now on 64-bit systems:**\r\n- Problems with accessing Registry Keys at `HKEY_LOCAL_MACHINE\\\\SOFTWARE`\r\n- `Environment.SpecialFolder.System` returning wrong directory (fixed with https://github.com/quasar/QuasarRAT/commit/5e868eb05e953c26591df99524996c9f9c9b83f9)\r\n- Reference: https://en.wikipedia.org/wiki/WoW64#Registry_and_file_system\r\n\r\n**What can we do to solve it?**\r\n- **Solution 1**: Implement this: http://www.rhyous.com/2011/01/24/how-read-the-64-bit-registry-from-a-32-bit-application-or-vice-versa/\r\n- **Solution 2**: Change target framework to .NET Framework 4.0 (Client Profile) (many benefits overall!)\r\n  - More options for `Environment.SpecialFolder`, see [this](http://bit.ly/1PP1aqM), i.e. `SystemX86` or `ProgramFilesX86`\r\n  - Fixes the problems with registry access, see [this](http://bit.ly/1JTnv7M)\r\n- **Solution 3**: Remove support for Firefox Password Recovery and change back to `AnyCPU`\r\n\r\n<h1>Please vote for your preferred solution!</h1>\r\nOr if you have another solution, don't hesitate to post it here!"},"comment":{"url":"https://api.github.com/repos/quasar/QuasarRAT/issues/comments/134874926","html_url":"https://github.com/quasar/QuasarRAT/issues/352#issuecomment-134874926","issue_url":"https://api.github.com/repos/quasar/QuasarRAT/issues/352","id":134874926,"user":{"login":"SandPox","id":8336751,"avatar_url":"https://avatars.githubusercontent.com/u/8336751?v=3","gravatar_id":"","url":"https://api.github.com/users/SandPox","html_url":"https://github.com/SandPox","followers_url":"https://api.github.com/users/SandPox/followers","following_url":"https://api.github.com/users/SandPox/following{/other_user}","gists_url":"https://api.github.com/users/SandPox/gists{/gist_id}","starred_url":"https://api.github.com/users/SandPox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SandPox/subscriptions","organizations_url":"https://api.github.com/users/SandPox/orgs","repos_url":"https://api.github.com/users/SandPox/repos","events_url":"https://api.github.com/users/SandPox/events{/privacy}","received_events_url":"https://api.github.com/users/SandPox/received_events","type":"User","site_admin":false},"created_at":"2015-08-26T07:24:54Z","updated_at":"2015-08-26T07:24:54Z","body":"@Vigorian server is fine... it does not need change...\r\nsame with 3.5, not all windows 8 have it"}}