Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused
... 0x77491dbe 64 ff 15 c0 00 00 00 call fs:[0xc0] ; syswow64\ntdll.dll 0x74632320 ea 1e 27 63 74 33 00 jmp far 0x33:0x7463271e ; system32\wow64cpu.dll 0x7463271e 67 44 8b 04 24 mov r8d, [esp] ; system32\wow64cpu.dll ...
The first instruction is something similar with X86SwitchTo64BitMode, the second one is a switch back to 64-bit mode. So
wow64cpu.dll has been actually mapped into two different code segments:
cs = 23 for compat mode (second instruction) and
cs = 33 for 64-bit mode (third instruction).
However I cannot find the second instruction (
jmp far...) in the corresponding dll. There are
ea 1e 27 b6 78... at
ea 1e 27 64... as being observed in the trace.
wow64cpu.dll modified when being mapped into the memory?