for x64 call under wow64

hasherezade / tiny_tracer

A Pin Tool for tracing API calls etc

1.25k stars 138 forks source link

for x64 call under wow64 #7

Closed nblog closed 1 year ago

nblog commented 3 years ago

can it be monitored, for x64 call under wow64?

maybe like this

...;called: C:\Windows\SysWOW64\ntdll.NtQueryInformationProcess
... // Wow64Transition
...;called: C:\Windows\System32\ntdll.NtQueryInformationProcess

for some use wow64ext, it may be better.