Observing a trace of Wow64 switching on Windows 7, the following situation makes me confused

0x77491dbe  64 ff 15 c0 00 00 00  call fs:[0xc0]          ; syswow64\ntdll.dll
0x74632320  ea 1e 27 63 74 33 00  jmp far 0x33:0x7463271e ; system32\wow64cpu.dll
0x7463271e  67 44 8b 04 24        mov r8d, [esp]          ; system32\wow64cpu.dll

The first instruction is something similar with X86SwitchTo64BitMode, the second one is a switch back to 64-bit mode. So wow64cpu.dll has been actually mapped into two different code segments: cs = 23 for compat mode (second instruction) and cs = 33 for 64-bit mode (third instruction).

However I cannot find the second instruction (jmp far...) in the corresponding dll. There are ea 1e 27 b6 78... at 0x74632320, not ea 1e 27 64... as being observed in the trace.

Was wow64cpu.dll modified when being mapped into the memory?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.