Даже и не думайте пользоваться функцией Wow64DisableWow64FsRedirection!

  • Article

?????? ???????????, ????????? ??????? ????? ???? ??????? Wow64DisableWow64FsRedirection. ??? ??????? ????????? ???????? ????????? ??????????????? ???????? ??????? ? Wow64. ??? ????? ???????????, ??? ???? ????? ???? ????????????? ??????????? ?????? ???? ???, ???? ????? ?????????? ??????????, ? ???, ??????????, ????????.

? ??? ??????? ?????????? ??-??????, ??? ??????????? ??????????????? ???????? ??????? ?? ???????? ???????? 32-? ?????? ????????? ?????????. ???, ??? ???????, ??????????? ?? system32 ? ?????? ??????????????? ?????/?????? ??????? ????????. ??-??????, ? ??? ????? ???????, ??????????? ????? ????? ????????? ???????????? ???? ????-????? ?? ??????? ????? Wow64DisableWow64FsRedirection ? Wow64RevertWow64FsRedirection.

«??? ??? ?????????» - ???????? ??, «???? ??? ??? ??????? ???? – ??? ???, ??? ?? ??????». ????? ??????. ??? ???????? ?????? ???????, ????? ????? ??????????? ??????? ???????? ????:

  • ??????? ????? LoadLibrary. ?????? ??????? Win32 ???????? LoadLibrary. ???? ?? ???????? – Multimedia API. ?? ?? ????? ?????? ? ?????? ??????????, ???????? ??, ??? ???????????? ???????.

  • ?????????? ???????? ????????? (Delayed Loading) – ??? ??????? ?????? ???????? ???????? ??????????. ???????? ?????? ? ???, ??? ???????? ????? ????????? ? ?????, ? ??? ????? ????? ???????????? ??????. ??? ??????????, ??? ??? ?????, ?????????? ?????????? ????????, ??? ??? ?? ?????????? ???????? ????????? ??????????.

  • ??? ?????????? «DLL import forwarders» ????????? ??????? ??????????, ??? ??????? «Foo», ?????????????? ?? «Foo.dll», ?? ????? ???? ??????????? ? «Bar.dll». ? ?????????? ??? ??????? ???????? ????? ??????? «Foo», ????????? ?????????? ????????? «Bar.dll». ????????:

     link /dump /exports c:\Windows\System32\kernel32.dll | findstr forwarded
          1    0          AcquireSRWLockExclusive (forwarded to NTDLL.RtlAcquireSRWLockExclusive)
          2    1          AcquireSRWLockShared (forwarded to NTDLL.RtlAcquireSRWLockShared)
         14    D          AddVectoredContinueHandler (forwarded to NTDLL.RtlAddVectoredContinueHandler)
         15    E          AddVectoredExceptionHandler (forwarded to NTDLL.RtlAddVectoredExceptionHandler)
         70   45          CancelThreadpoolIo (forwarded to NTDLL.TpCancelAsyncIoOperation)
         86   55          CloseThreadpool (forwarded to NTDLL.TpReleasePool)
         87   56          CloseThreadpoolCleanupGroup (forwarded to NTDLL.TpReleaseCleanupGroup)
         88   57          CloseThreadpoolCleanupGroupMembers (forwarded to NTDLL.TpReleaseCleanupGroupMembers)
         89   58          CloseThreadpoolIo (forwarded to NTDLL.TpReleaseIoCompletion)
         90   59          CloseThreadpoolTimer (forwarded to NTDLL.TpReleaseTimer)
         91   5A          CloseThreadpoolWait (forwarded to NTDLL.TpReleaseWait)
         92   5B          CloseThreadpoolWork (forwarded to NTDLL.TpReleaseWork)

  • ?????????????? ? COM ????????? ????? ????? ???????? ? ???????? ?????????????? ?????????. ? ???????, ??? ???? ????? QueryInterface ??? ????? ?????? ????? ???????????? ????????? ?? COM ?????????.

  • ????????? ???? ? ?????? ??????? – ??????? ???? ? Windows. ?????????? ??? ????? ??????? LoadLibrary ? ????? ???????????? ??????. ? ???? ?????? ??????? ?? ??? ???, ?? ? ????? ?????? ???????????? ?????? ?????? ???? ??????????.

  • ? ?.?. ? ?.?.

???????? ??? ? ? ???, ??? ???, ???????????? Wow64DisableWow64FsRedirection, ? ?????-??, ???????? ? ??????????? ???????. ??? ??? ??????????? ?? ????? ???????? ?? ??? ???, ???? ??? ?? ????? ??????? ? ?????????? ????????? ?? ?????? ?????????. ??? ???? ?? ?????? ????? ?????? ??, ???????????? ?????????? ??? ????????????? ??????, ??????? ????? ?????? ????????? ??? ? ??? ?????, ??? ?????? ?????? ?????? ?? ???????????.

PS. ? ????? ????? ???????????? Wow64DisableWow64FsRedirection? ???????????? ?????????????? ???????? – ????? CreateFile, ????????? ? Wow64DisableWow64FsRedirection ? Wow64RevertWow64FsRedirection.

Cross-posted from blog.not-a-kernel-guy.com.