For a 32bit process, running in the "old" wow64 configuration, the filename of loaded (32 bit) ntdll.dll is reported as ..\system32\ntdll.dll instead of being in the wow64 directory.
This affects: - filename used for image mapping - filename entry in LdrData
(Note all the others DLLs in this configuration are correctly exposed in wow64 directory).
Signed-off-by: Eric Pouech eric.pouech@gmail.com