Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
...
0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll
0x74632320 ea 1e 27 63 74 33 00 jmp far 0x33:0x7463271e ; system32\wow64cpu.dll
0x7463271e 67 44 8b 04 24 mov r8d, [esp] ; system32\wow64cpu.dll
...
The first instruction is something similar with X86SwitchTo64BitMode, the second one is a switch back to 64-bit mode. So wow64cpu.dll
has been actually mapped into two different code segments: cs = 23
for compat mode (second instruction) and cs = 33
for 64-bit mode (third instruction).
However I cannot find the second instruction (jmp far...
) in the corresponding dll. There are ea 1e 27 b6 78...
at 0x74632320
, not ea 1e 27 64...
as being observed in the trace.
Was wow64cpu.dll
modified when being mapped into the memory?