x64 modules in a wow64 process?
问题 I have a small 32bit process I'm debugging on win7 x64 and I see that it loads "C:\windows\sysWow64\ntdll.dll" as expected, but also "C:\windows\system32\ntdll.dll" . I know that x64 modules and x86 modules do not mix, but here they are... mixing... How can it be? 回答1: This is a special 'feature' of WOW64, see this article on MSDN. the relevant part is: The WOW64 emulator runs in user mode. It provides an interface between the 32-bit version of Ntdll.dll and the kernel of the processor, and