V2 pushed: from tests (for a wow64 process only): - loading DLL from absolute path under syswow64 is stored with system32 in LdrData (test included) - loading DLL from absolute path under syswow64\foobar is stored with system32 in LdrData (test not included) - identical behavior whether redirection is enabled or not - main module (if process creation from syswow64<exec>) is however stored in LdrData under syswow64 - when exec is from syswow64<exec> (or subdirectories of syswow64) => the application search path is reported from the Ldr* functions from syswow64 (no unredirection involved)
V1 -> V2: - changed trigger condition to be at module insertion time in LdrData, and perform a path based unredirection (that still looks strange, but that matches with above tests results) - move unredirection helper into ntdll.so