WOW64
At startup, Wow64.dll loads the x86 version of Ntdll.dll and runs its
initialization code, which loads all necessary 32-bit DLLs. Nearly all
32-bit DLLs are unmodified copies of 32-bit Windows XP binaries. However,
some of these DLLs have knowledge of WOW64, usually because they share
memory with 64-bit processes.
Instead of using the x86 system-service call sequence; 32-bit binaries
making system calls are rebuilt to use a custom calling sequence. This new
sequence is inexpensive for WOW64 to intercept because it remains entirely
in user mode. When the new calling sequence is detected, the WOW64 CPU
transitions back to native 64-bit mode and calls into (Wow64.dll). Thunking
is done in user mode to reduce the impact on the 64-bit kernel, and to
reduce the risk of a bug in the thunk causing a kernel-mode crash, data
corruption, or a security hole. The thunks extract arguments from the 32-bit
stack, extend them to 64 bits, and then make the native system call.
WOW64 enables 32-bit applications to take advantage of the 64-bit kernel.
Therefore, 32-bit applications can use a larger number of kernel handles and
window handles. However, 32-bit applications cannot create as many threads
under WOW64 as they can on x86, because there is less virtual address space
available, and each thread contains a 64-bit stack (usually 512K).
Now you should understand why 32 bit applications are able to run on 64 bit
Windows.
--
Andre
Extended64 |
http://www.extended64.com
Blog |
http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm
"JP" <> wrote in message
news:%...
> How do I run 32 bit applications on x64? I can't find much on "WOW"? Every
> 32 bit program that I try to install fails. Thanks JP
>