D
Dev10110110
Guest
I have a 32 bit process running in Admin mode. A second process running in non-admin mode then queries its WOW64 state. The data return by IsWow64Process() indicate the Admin mode process is not a WOW64 process implying it's a 64 bit process. This is highly disruptive. Is there a way round this problem other than to elevate the query'er process? Thanks.
Pretend the following is c++ code
PHandle = Win32.OpenProcess ( Win32.PROCESS_QUERY_INFORMATION | Win32.PROCESS_VM_READ, false, Pid );
Win32.IsWow64Process ( PHandle, out Is32Bit );
On an un-elevated query'er, Is32Bit receives a FALSE.
On an elevated query'er, Is32Bit receives a TRUE.
Continue reading...
Pretend the following is c++ code
PHandle = Win32.OpenProcess ( Win32.PROCESS_QUERY_INFORMATION | Win32.PROCESS_VM_READ, false, Pid );
Win32.IsWow64Process ( PHandle, out Is32Bit );
On an un-elevated query'er, Is32Bit receives a FALSE.
On an elevated query'er, Is32Bit receives a TRUE.
Continue reading...