peass-ng/PEASS-ng · error · System.InvalidOperationException

Registry key not found.

Error message

Registry key not found.

What it means

ReadRegistryValue opens the requested subkey under HKLM read-only; if OpenSubKey returns null the key does not exist (or the caller lacks access) and an InvalidOperationException is thrown. The library cannot proceed to read the value without the key. Note this also fires when the path exists but access is denied, since OpenSubKey returns null in that case too.

Source

Thrown at winPEAS/winPEASexe/winPEAS/Native/Advapi32.cs:243

            out SID_NAME_USE peUse);

        // P/Invoke declaration for RegQueryValueExW
        [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
        public static extern int RegQueryValueExW(
            SafeRegistryHandle hKey,
            string lpValueName,
            IntPtr lpReserved,
            out uint lpType,
            byte[] lpData,
            ref uint lpcbData);

        public byte[] ReadRegistryValue(string keyPath, string valueName)
        {
            using (RegistryKey baseKey = Registry.LocalMachine) // Access HKLM
            using (RegistryKey subKey = baseKey.OpenSubKey(keyPath, writable: false))
            {
                if (subKey == null)
                    throw new InvalidOperationException("Registry key not found.");

                SafeRegistryHandle hKey = subKey.Handle;
                uint lpType;
                uint dataSize = 0;

                // First call to determine the size of the data
                int ret = RegQueryValueExW(
                    hKey,
                    valueName,
                    IntPtr.Zero,
                    out lpType,
                    null,
                    ref dataSize);

                if (ret != 0)
                    throw new System.ComponentModel.Win32Exception(ret);

                byte[] data = new byte[dataSize];

View on GitHub (pinned to 53fb989abc)

Solutions

  1. Verify the exact key path exists (reg query or Registry.LocalMachine.OpenSubKey in a check) before reading; adjust for browser version and 32/64-bit view
  2. Run the process elevated/SYSTEM — some keys are ACL-restricted to SYSTEM/Administrators
  3. If access-denied is the real cause, catch InvalidOperationException and distinguish it from a true missing key by testing existence first with OpenSubKey on the parent
  4. Skip gracefully when the software/browser is not installed instead of treating it as a hard failure

Example fix

// before
byte[] data = reader.ReadRegistryValue(keyPath, valueName);
// after
using (var probe = Registry.LocalMachine.OpenSubKey(keyPath))
    if (probe == null) { log.Warn($"Key {keyPath} missing or access denied; skipping."); return null; }
byte[] data = reader.ReadRegistryValue(keyPath, valueName);
Defensive patterns

Strategy: try-catch

Validate before calling

static bool RegistryKeyExists(string path)
{
    using (var k = Registry.LocalMachine.OpenSubKey(path))
        return k != null;
}

Try / catch

try { return reader.ReadRegistryValue(keyPath, valueName); }
catch (InvalidOperationException ex)
{
    log.Warn($"{keyPath} missing or access denied (run elevated/SYSTEM): {ex.Message}");
    return null;
}

Prevention

When it happens

Trigger: Calling encryptedEncodedAuthToken (or ReadRegistryValue directly) with a keyPath that does not exist under HKLM, a typo in the path, or reading browser app-bound keys on a machine/browser version that does not store them; also when the process runs without permission to open the key.

Common situations: Chrome/Edge version differences change the registry location of the app-bound encrypted key; running winPEAS unprivileged so the key cannot be opened; querying a 32-bit vs 64-bit registry view mismatch; probing software that is simply not installed.

Related errors

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/e1b971aaeac9ef5d. Report an issue: GitHub.