Detours icon indicating copy to clipboard operation
Detours copied to clipboard

32bit Parent process is not able to load dll in 64bit process using DetourCreateProcessWithDllEx

Open ankitbtrivedi opened this issue 7 years ago • 2 comments

On 64bit Windows, My 32bit Detouring DLL "intercept_32.dll" is loaded in 32-bit process "c:\Windows\SysWOW64\notepad.exe". I have detoured "CreateProcessW" API. When I select "Print" from Notepad's menu then "CreateProcessW" in my "intercept_32.dll" is called to launch 64bit process "c:\Windows\splwow64.exe". In detoured "CreateProcessW" if process is "splwow64", I call "DetourCreateProcessWithDllEx" and ask it to load a 64bit "intercept_64.dll" in "splwow64.exe". "splwow64.exe" starts but "intercept_64.dll" is not loaded in it.

Note: On 64bit machine, "intercept_64.dll" is loaded in 64bit "explorer.exe" and if I launch "c:\Windows\splwow64.exe" from 64bit explorer (from Run) then "intercept_64.dll" gets loaded in it.

ankitbtrivedi avatar Oct 17 '18 15:10 ankitbtrivedi

Can you provide a simple, zipped test project to demonstrate your issue?

NoMoreFood avatar Oct 19 '18 10:10 NoMoreFood

@ankitbtrivedi, this is an old issue at this point. I'm assuming you still aren't working on this. If you can share more details please do, otherwise I guess we can try to put together a test case from the series of events you described.

bgianfo avatar Aug 21 '20 10:08 bgianfo