How to debug a crash in wow64.dll in 32bit process

Question

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have a tool that injects code into the application process and starts new thread. My problem is that sometimes I'm getting an exception. The application is 32bit so I'm using 32bit debugger. From what I can see the exception comes from memory region that is supposed to be wow64.dll. Wow64.dll has some 64bit code. Due to this I have problems debugging the reason for this exception. My questions are:

1. When exception is thrown from wow64.dll 64bit code, can I depend on the exception info reported by 32bit debugger or the fields will contain wrong values (is there a difference between 64bit exception struct and 32bit one)?

2. Is there any reliable way of debugging pieces of 64bit code inside 32bit processes?

Answer 1

Your problem is so strange. As I knew, 64bit exe loads only 64bit dlls and 32bit exe loads only 32bit dlls. I don't know well about wow64.dll, but if your exe is for 32bit, os will automatically lead your exe to load 32 bit dll. Therefore, system drive includes system32 and syswow64 directories under the Windows directory.

And furthermore, 32bit dll can't contain 64bit assembly code. If it still needs, 32bit executables can contain 64bit assembly code as data.

I hope my answer helps you to understand your problem.