0

Notes: (1) I'm working in Windows 7 64-bit and (2) I've already seen How can I test a Windows DLL file to determine if it is 32 bit or 64 bit?.

I'm trying to write a C program that checks a DLL's bitness. Using the Windows API and the Debug Help Library, I am able to get to the NT Header's FileHeader.Machine.

My program seems to work for 32-bit DLLs, but misrecognizes C:\Windows\System32\KERNEL32.DLL as 32-bit (Why do 64-bit DLLs go to System32 and 32-bit DLLs to SysWoW64 on 64-bit Windows?).

I've looked at Dependency Walker, but I get inconsistent results between the 32- and 64-bit versions of depends.exe -- C:\Windows\System32\KERNEL32.DLL is recognized by the 32-bit version of depends.exe as 32-bit (CPU: x86), but is recognized by the 64-bit version as 64-bit (CPU: x64).

Is FileHeader.Machine not the way to go? How is the 64-bit version of depends.exe able to recognize a DLL as 64-bit?

Community
  • 1
  • 1
apfhmxf
  • 1
  • You already linked to the answer, your program is loading c:\windows\syswow64\kernel32.dll instead. So build a 64-bit version instead. – Hans Passant Jul 21 '14 at 17:47
  • Sorry, I'm still confused. My program uses [CreateFile](http://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx) on "C:\Windows\System32\kernel32.dll" and creates a mapping from that. Does Windows somehow open "C:\Windows\SysWOW64\KERNEL32.DLL" instead? – apfhmxf Jul 21 '14 at 18:46
  • http://msdn.microsoft.com/en-us/library/windows/desktop/aa384187%28v=vs.85%29.aspx – Hans Passant Jul 21 '14 at 18:51
  • Wow. I stopped reading the answer after clearing up the whole System32 v. SysWOW64 confusion. Thanks! – apfhmxf Jul 21 '14 at 19:02

0 Answers0