1

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have a tool that injects code into the application process and starts new thread. My problem is that sometimes I'm getting an exception. The application is 32bit so I'm using 32bit debugger. From what I can see the exception comes from memory region that is supposed to be wow64.dll. Wow64.dll has some 64bit code. Due to this I have problems debugging the reason for this exception. My questions are:

  1. When exception is thrown from wow64.dll 64bit code, can I depend on the exception info reported by 32bit debugger or the fields will contain wrong values (is there a difference between 64bit exception struct and 32bit one)?

  2. Is there any reliable way of debugging pieces of 64bit code inside 32bit processes?

-1

Your problem is so strange. As I knew, 64bit exe loads only 64bit dlls and 32bit exe loads only 32bit dlls. I don't know well about wow64.dll, but if your exe is for 32bit, os will automatically lead your exe to load 32 bit dll. Therefore, system drive includes system32 and syswow64 directories under the Windows directory.

And furthermore, 32bit dll can't contain 64bit assembly code. If it still needs, 32bit executables can contain 64bit assembly code as data.

I hope my answer helps you to understand your problem.

  • 2
    wow64 is a special beast and does contain both 32-bit and 64-bit code in a single DLL. – Igor Skochinsky Aug 20 '18 at 17:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.