wow64.c File Reference

#include <rtl.h>
#include <debug.h>

Include dependency graph for wow64.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
NTSTATUS NTAPI	RtlWow64GetProcessMachines (_In_ HANDLE ProcessHandle, _Out_ PUSHORT ProcessMachine, _Out_opt_ PUSHORT NativeMachine)

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 12 of file wow64.c.

Function Documentation

RtlWow64GetProcessMachines()

NTSTATUS NTAPI RtlWow64GetProcessMachines	(	_In_ HANDLE	ProcessHandle,
		_Out_ PUSHORT	ProcessMachine,
		_Out_opt_ PUSHORT	NativeMachine
	)

Definition at line 17 of file wow64.c.

{
    NTSTATUS Status;
    ULONG_PTR Wow64Info;
 
    /* Check if the caller wants the current process */
    if (ProcessHandle == NtCurrentProcess())
    {
        /* Easy: process machine is current architecture */
        *ProcessMachine  = IMAGE_FILE_MACHINE_NATIVE;
    }
    else if (SharedUserData->ImageNumberLow == IMAGE_FILE_MACHINE_AMD64)
    {
        /* Kernel architecture is AMD64, query whether the process is WOW64 */
        Status = NtQueryInformationProcess(ProcessHandle,
                                           ProcessWow64Information,
                                           &Wow64Info,
                                           sizeof(Wow64Info),
                                           NULL);
        if (!NT_SUCCESS(Status))
        {
            return Status;
        }
 
        *ProcessMachine = Wow64Info ? IMAGE_FILE_MACHINE_I386 : IMAGE_FILE_MACHINE_AMD64;
    }
    else
    {
        /* kernel is something else, assume no WOW64 */
        *ProcessMachine  = IMAGE_FILE_MACHINE_NATIVE;
    }
 
    if (NativeMachine != NULL)
    {
        /* The kernel stores it's native architecture in this field */
        *NativeMachine = SharedUserData->ImageNumberLow;
    }
 
    return STATUS_SUCCESS;
}