I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit).
I came across some indirect call inside the process module (module created by the app and not Windows), and started following it.
Stepping into this call gets me to an
(*) address which doesn't match any loaded module:
Tried to search manually with
lm, didn't see a match.
!address command with that address, and it says the page is committed but the protection is
Also the stack trace gives me a warning "frame ip not in any known module".
Stepping one more, I get again an indirect call to
fs[0c0h] which is a stub for
WOW32Reserved (after some more single stepping I get into
ntdll.dll. So it's obviously some WOW64 code).
The question is, where did the code in
(*) came from? Who's responsible for it? Why isn't it mapped to any module?