Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 74 33 00 jmp far 0x33:0x7463271e ; system32\wow64cpu.dll
0x7463271e 67 44 8b 04 24 mov r8d, [esp] ; system32\wow64cpu.dll
...
The first instruction is something similar with X86SwitchTo64BitMode, the second one is a switch back to 64-bit mode. So wow64cpu.dll has been actually mapped into two different code segments: cs = 23 for compat mode (second instruction) and cs = 33 for 64-bit mode (third instruction).
However I cannot find the second instruction (jmp far...) in the corresponding dll. There are ea 1e 27 b6 78... at 0x74632320, not ea 1e 27 64... as being observed in the trace.
Was wow64cpu.dll modified when being mapped into the memory?
