IsWow64Process实现

使用IsWow64Process可以检测当前进程是否运行在WOW64环境下(WOW64 is the x86 emulator that allows Win32-based applications to run on 64-bit Windows),有些人也把它用来检测CPU位数(这用法是错误的)
在MSDN上也有这个函数的使用方法,当然我还是写了个,注意的是IsWow64Process第一个参数是一个有QUERY权限的进程句柄.

BOOL IsWow64Current()
{
	FARPROC fnIsWow64Process;
	BOOL bIsWow64;


	bIsWow64 = FALSE;
	fnIsWow64Process = GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "IsWow64Process");


	if(fnIsWow64Process)
		if(((BOOL (WINAPI *)(HANDLE, PBOOL))fnIsWow64Process)(GetCurrentProcess(), &bIsWow64))
			return bIsWow64;
	return FALSE;
}

嗯哼~那么来看看IsWow64Process的实现吧~

KERNELBASE!IsWow64Process:
759f8c8e 8bff            mov     edi,edi
759f8c90 55              push    ebp
759f8c91 8bec            mov     ebp,esp
759f8c93 56              push    esi
759f8c94 6a00            push    0 //ReturnLength
759f8c96 6a04            push    4 //ProcessInformationLength
75