process

More documents

Recommendations

Info

Wow64 Components 24 Wow64.dll - provides core emulation infrastructure, and hooks exception dispatching and base system calls by Ntoskrnl.exe 32-bit EXE, DLLs 32-bit ntdll.dll Wow64win.dll - Intercepts GUI system calls exported by Win32k.sys Wow64cpu.dll Wow64.dll Wow64win.dll Wow64cpu.dll – manages thread contexts, supports mode-switch instructions 64-bit ntdll.dll Executive User Mode Win32k.sys Kernel Mode
25 Wow64 File Locations Location of system files 64-bit system files are in \windows\system32 32-bit system files are in \windows\syswow64 32-bit applications live in “\Program Files (x86)” 64-bit applications live in “\Program Files” File access to %windir%\system32 redirected to %windir%\syswow64 %PROGRAMFILES% set to the appropriate program directory Two areas of the registry redirected (see next slide)
Page 1 and 2: Core System Mechanisms and Windows
Page 3 and 4: 3 Object Manager (I) Executive comp
Page 5 and 6: 5 Executive Objects vs. Kernel Obje
Page 7 and 8: 7 Executive Objects (contd.) Object
Page 9 and 10: 9 Object Header Field Handle count
Page 11 and 12: 11 Object Methods Method Open Close
Page 13 and 14: 13 Handles and Security Process han
Page 15 and 16: 15 Handle and Reference Count handl
Page 17 and 18: 17 Interesting Object Directories i
Page 19 and 20: 19 System Worker Threads Created at
Page 21 and 22: 21 Port Objects ALPC exports port o
Page 23: 23 Wow64 Allows execution of Win32
Page 27 and 28: 27 Example: Cmd.exe on 64-bit Syste
Page 29 and 30: 29 Windows API - Overview APIs to W
Page 31 and 32: 31 Windows API Principles System re
Page 33 and 34: 33 Windows API Naming Conventions P
Page 35 and 36: 35 Differences from UNIX HANDLEs ar
Page 37 and 38: 37 Example Application Sequential f
Page 39 and 40: 39 Basic cp file copy program. UNIX
Page 41 and 42: 41 Basic cp file copy program. C li
Page 43 and 44: 43 Basic cp file copy program. Wind
Page 45 and 46: 45 Further Reading Mark E. Russinov
Page 47 and 48: Lab: 2013-9-23 Handles & ALPC
Page 49: ALPC Port Objects Use Winobj.exe to

process

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?