On Thu Oct 17 03:43:17 2024 +0000, Alex Henrie wrote:
Ah, that is a problem. wow64_NtWow64QueryInformationProcess64 shouldn't be calling NtQueryInformationProcess like that, but it can't call NtWow64QueryInformationProcess64 because NtWow64QueryInformationProcess64 is only defined on 32-bit. What is the right way to handle this situation? Should we just expose NtWow64QueryInformationProcess64 on 64-bit too, even though Windows doesn't? Or should I copy the implementation into wow64_NtWow64QueryInformationProcess64 but change it to use NtQueryInformationProcess instead of SERVER_START_REQ/SERVER_END_REQ?
Calling NtQueryInformationProcess is the right thing to do (except you'd need to check the info class).