32bit Parent process is not able to load dll in 64bit process using DetourCreateProcessWithDllEx
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 6.4k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
On 64bit Windows, My 32bit Detouring DLL "intercept_32.dll" is loaded in 32-bit process "c:\Windows\SysWOW64\notepad.exe". I have detoured "CreateProcessW" API. When I select "Print" from Notepad's menu then "CreateProcessW" in my "intercept_32.dll" is called to launch 64bit process "c:\Windows\splwow64.exe". In detoured "CreateProcessW" if process is "splwow64", I call "DetourCreateProcessWithDllEx" and ask it to load a 64bit "intercept_64.dll" in "splwow64.exe". "splwow64.exe" starts but "intercept_64.dll" is not loaded in it.
Note:
On 64bit machine, "intercept_64.dll" is loaded in 64bit "explorer.exe" and if I launch "c:\Windows\splwow64.exe" from 64bit explorer (from Run) then "intercept_64.dll" gets loaded in it.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the 32-bit notepad.exe to 64-bit splwow64.exe scenario on 64-bit Windows, focusing on the CreateProcessW detour and DetourCreateProcessWithDllEx entry points named in the report. Compare this with launching splwow64.exe from 64-bit explorer.exe; done means identifying why intercept_64.dll is not loaded in the former case and verifying the corrected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100