Re: Enumerating 32-bit modules from 32-bit processes in WOW64

"Jochen Kalmbach [MVP]" <nospam-Jochen.Kalmbach@xxxxxxxxx> wrote in message
news:%23z5mT59bFHA.3464@xxxxxxxxxxxxxxxxxxxxxxx

> > I've looked at a few different methods for enumerating modules in a
process;
> > so far, this mix of system32/syswow64 paths appears via calls to the
> > Toolhelp functions, the PSAPI functions, and also calling NTDLL
functions.
>
> I think the problem is the result of "GetModuleFileName(Ex)"...

Hi Jochen,

Thanks for verifying the behavior for me and for the suggestion of mapping
the load addresses back to the real filename. I may implement that for the
short term, but I've been trying to avoid directly crossing process
boundaries to keep the invasiveness minimal and your example appears to
require execution from the source process itself (aside from system
libraries, which probably have the same process-independent load addresses).
Of course, many of the system routines I'm calling already do this, but then
they have a larger QA staff than I do.

I guess I'm hoping that this inconsistency is not a requirement of WOW64,
but rather something that can be changed. I'm new to x64 and haven't had
the opportunity to use any IA-64 boxes...

Do you or anyone know if this behavior is also the same for WOW64 running on
IA-64 systems? Given the longer "in-service" time for the IA-64 version(s)
of Windows, if this behavior is the same there, then I would presume it's
less likely to change.

Thanks again,

Philip Sloss


.

Loading