How does the registry configuration differ when hiding processes on a 64-bit Windows 7 system?
On 64-bit Windows 7, you must configure two registry locations: the standard path for 64-bit processes (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows`) and the Wow6432Node path for 32-bit processes (`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows`). Without both, your hook DLL won't be injected into all processes. This detail is critical, as emphasized in Using global API hooks to hide processes on Windows 7 systems.
x64Wow6432Noderegistry redirection32-bit and 64-bitWindows 7 x64