MSI Node in Registry

[PTNL]

Whenever a MSI is installed in Windows, a registry node is created here:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products

The node exists as a 32 alphanumeric guid (sans hyphens), and has subkeys with various installation and MSI action hints.

What I am trying to figure out is where that node's 32 character value exists within a MSI. When looking through a MSI using "orca.exe", I cannot find where that value exists. But that value is consistent when the MSI package is installed across different machines.

Thoughts?

 

[Snowknight26]

http://stackoverflow.com/questions/11251034/find-guid-from-msi-file

 

[PTNL]

http://stackoverflow.com/questions/11251034/find-guid-from-msi-file

Let me try explaining this again... When you drill into the hive path I gave earlier with "regedt32", you will see many keys on the left side. Each key will have a subkey, and many will have subkeys (one of which called "InstallProperties") containing the GUIDs described in that SO link. But it is those earlier key names from the path I gave that I am interested in.

 

[Snowknight26]

That's the Squished GUID for Product which is derived from the ProductCode GUID.

For example, PDFtk Server's ProductGUID, as seen with Orca is as follows:

ProductCode	{1E25A554-0153-45A7-B342-49003A36367C}

In the registry the ProductSQUID is 455A52E135107A543B249400A36363C7, derived from:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\455A52E135107A543B249400A36363C7

Each of the GUID's fields almost looks like it needs to have its endianness changed to be converted to the other 'format':

 

[PTNL]

That's the Squished GUID for Product which is derived from the ProductCode GUID.

Ah, thanks for this. I was unaware of the term "squished guid". This pushed me down the correct path, and I later found this SO link that showed a working conversion from the MSI's Product Code to the squished guid.

Thanks again for the help!