WOW64 processes

You can now easily understand how a 32-bit process gets loaded in an x86 environment as well as a 64-bit process in an x64 environment. So, how about a 32-bit process in an x64 environment?

For this special case, Windows has created what's called the WOW64 emulator. This emulator consists of the following three DLLs:

• wow64.dll
• wow64cpu.dll
• wow64win.dll

These DLLs basically create a simulated environment for the 32-bit process, which includes a 32-bit ntdll.dll and a 32-bit kernel32.dll.

These DLLs, rather than connecting directly to the Windows kernel, call an API X86SwitchTo64BitMode, which then switches to x64 and calls the 64-bit ntdll.dll, which communicates directly to the kernel, as shown in the following diagram:

Figure 14: WOW64 architecture

Also, WOW64-sandboxed processes (x86 processes running in x64 environment) introduced new APIs, such as IsWow64Process, which is used by malware to identify if it's running as a 32-bit process in an x64 environment...