Registry - Getting key value based on multiple "contains" statements

Reporting
1

As many of you know Adobe Flash has several different versions, a PlugIn and ActiveX control. I can get the values of both of these using:

( values "DisplayVersion" of it) of keys whose (value "DisplayName" of it as string as lowercase contains "flash") of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" of registry

Which will return both the ActiveX and NPAPI. I want to break this in to two separate properties Flash NPAPI Version and Flash ActiveX Version. I am trying to do that with this code:

( values "DisplayVersion" of it) of keys whose (value "DisplayName" of it as string as lowercase contains "flash") AND (value "DisplayName" of it as string as lowercase contains "npapi" )of key "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" of registry

However, I get the error that the operator keys is not defined.

Can someone give me some pointers on where I am going wrong, or even propose the proper relevance code?

Thanks!

2

It looks like there is an issue with the ()'s

I don’t recommend using this, because it only works on 64bit systems:

This should do what you want: https://bigfix.me/relevance/details/3004752

values "DisplayVersion" of keys whose(value "DisplayName" of it as string as lowercase contains "flash" AND value "DisplayName" of it as string as lowercase contains "npapi") of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of (x64 registries; x32 registries)

This is related: https://bigfix.me/analysis/details/2994778

1 Like
3

Exactly what I was looking for. Thanks jg!