Search notes:

WOW64

WOW64 = Windows on Windows 64 bit.

Purpose: WOW64 is an emulator that allows 32 bit applications to be run on a 64 bit Windows system.

This is necessary because a 64-bit kernel expects 64-bit pointers when its syscalls are called, but a 32-bit application can only provide 32-bit pointers.

The emulator runs in user mode and provides an interface between the 32-bit version of Ntdll.dll and the kernel of the processor, and it intercepts kernel calls.

Involved DLLs

DLLs:

	comment	platform
`wow64.dll`	Core infrastructure for the emulation / thunks for the `ntoskrnl.exe` entry-point functions.	all
`Wow64win.dll`	Entry points for `win32k.sys` for 32 bit applications	all
`wow64cpu.dll`	supports running x86 executables on x64 / switch CPU between 32 and 64 bit	x64
`IA32Exec.bin`	x86 software emulator	Intel Itanium
`Wowia32x.dll`	Interface between `IA32Exec.bin` and WOW64	Intel Itanium only
`xtajit.dll`	x86 software emulator	ARM64
`wowarmw.dll`	Running ARM32 programs on ARM64	ARM64
`Ntdll.dll`
etc. ?

These DLLs as well as the 64-bit version of ntdll.dll are the only 64-bit binaries that can be loaded into a 32-bit process.

Environment variables

The values of some environment variables are dependent on the bitness of process that uses them.

environment variable	32 bit process	64 bit process
`PROCESSOR_ARCHITECTURE`	`x86`	`AMD64` or `IA64` or `ARM64`
`PROCESSOR_ARCHITEW6432`	`%PROCESSOR_ARCHITECTURE%`	n/a
`ProgramFiles`	`%ProgramFiles(x86)%`	`%ProgramFiles%`
`ProgramW6432`	`%ProgramFiles%`	`%CommonProgramFiles%`
`CommonProgramFiles`	`%CommonProgramFiles(x86)%`	`%CommonProgramFiles%`
`CommonProgramW6432`	`%CommonProgramFiles%`	`%CommonProgramFiles%`

Here are two cmd.exe batch files that try to demonstrate the differences between these values.

WOW64

Involved DLLs

Environment variables

See also