[0xDEAD10CC]

The problem it's unsafe that's what it is .
//
maltech answered :/

Thanks for bumping an old thread and pretending that you edited your post even though it shows no edit was made. 😅

[excr4sh]

The problem it's unsafe that's what it is .

in what sense? just saying that it's unsafe makes no sense.

BTW, I did an update a while ago, it works from WIndows XP to Windows 8.1 32/64-bit:
[img]http://s28.postimg.org/6tmld3899/image.png[/img]

[0xDEAD10CC]

^ how come the type is blank on the rest of those? If it works from XP, you should be able to list everything from 16-bit to 64-bit.

[excr4sh]

^ how come the type is blank on the rest of those? If it works from XP, you should be able to list everything from 16-bit to 64-bit.

I call IsWow64Process function to determinate the type of the process ( 32 or 64-bit ), IsWow64Process requires a handle to the process with PROCESS_QUERY_(LIMITED)_INFORMATION access, but you cannot open a handle with that access right to a process with higher integrity (UAC enabled) than the process is running, that is why it is unable to determinate the type of the process. It's not an error/problem, If I run it with admin rights, it shows the type. I took that screenshot from Windows 7 64-bit.

BTW, 16-bit of what?

[swag1337]

Just hook LSTAR and CSTAR

[He B TeMy]

I call IsWow64Process function to determinate the type of the process ( 32 or 64-bit ), IsWow64Process requires a handle to the process with PROCESS_QUERY_(LIMITED)_INFORMATION access, but you cannot open a handle with that access right to a process with higher integrity (UAC enabled) than the process is running, that is why it is unable to determinate the type of the process. It's not an error/problem, If I run it with admin rights, it shows the type. I took that screenshot from Windows 7 64-bit.

BTW, 16-bit of what?

He meant 16-bit applications, but you can't run them on x64 systems.

[excr4sh]

He meant 16-bit applications, but you can't run them on x64 systems.

Even if I can run them with an emulator, it will not show "16-bit" because Windows doesn't create any process for 16-bit applications, on x86 systems they are emulated by NTVDM.

[0xDEAD10CC]

Even if I can run them with an emulator, it will not show "16-bit" because Windows doesn't create any process for 16-bit applications, on x86 systems they are emulated by NTVDM.

And your point? How does this prevent you from detecting 16-bit applications? Taskmanager can do it: https://support.microsoft.com/en-us/kb/320127

[excr4sh]

And your point? How does this prevent you from detecting 16-bit applications? Taskmanager can do it: https://support.microsoft.com/en-us/kb/320127

And yours? What is the relevance of detecting 16-bit applications on my application? Here it is how to list them:
https://msdn.microsoft.com/en-us/library...s.85).aspx
easy, right? I could add it to my code, but again, how could it be relevant on this application?

[0xDEAD10CC]

And yours? What is the relevance of detecting 16-bit applications on my application? Here it is how to list them:
https://msdn.microsoft.com/en-us/library...s.85).aspx
easy, right? I could add it to my code, but again, how could it be relevant on this application?

The relevance? Maybe XP perhaps? Since you mentioned it supports XP? Is that not clear?

[excr4sh]

The relevance? Maybe XP perhaps? Since you mentioned it supports XP? Is that not clear?

perhaps? are you sure what you are talking about? You should go to OP and reading what this thread is for. this application is not intended to work with 16-bit applications, so why should I list 16-bit applications? and no, the fact that this does not list 16-bit applications does not mean it will not work for Windows XP.

how can you even say that if an application does not list 16-bit applications then will not work on Windows XP?

[0xDEAD10CC]

perhaps? are you sure what you are talking about? You should go to OP and reading what this thread is for. this application is not intended to work with 16-bit applications, so why should I list 16-bit applications? and no, the fact that this does not list 16-bit applications does not mean it will not work for Windows XP.

how can you even say that if an application does not list 16-bit applications then will not work on Windows XP?

Did I say it won't work for XP? Show me where that was mentioned exactly. Additionally, what's the point of listing whether it's 32 or 64 bit if that's not relevant to the program? Otherwise, it clearly is used for some kind of information, so why should 16 be excluded? I never said it was broken, I said that it was missing some functionality that could be added.

[excr4sh]

Did I say it won't work for XP? Show me where that was mentioned exactly. Additionally, what's the point of listing whether it's 32 or 64 bit if that's not relevant to the program? Otherwise, it clearly is used for some kind of information, so why should 16 be excluded? I never said it was broken, I said that it was missing some functionality that could be added.

You clearly do not even know what you're talking about. I bet you do not even know how it works.

[0xDEAD10CC]

You clearly do not even know what you're talking about. I bet you do not even know how it works.

I know a lot more than you do I'd bet, you are the one that doesn't know what you're talking about or you lack the comprehension skills to even read my posts properly. You act like this is advanced for a reason I do not know...

[RISC]

I know a lot more than you do, you are the one that doesn't know what you're talking about or you lack the comprehension skills to even read my posts properly. You act like this is advanced lol.

He did say intercepting system service calls on WoW64 processes. This will not work on 64 bit architectures running 64 bit processes, or 32 bit architectures running 32 or 16 bit processes. The only reason the hook works is because the emulation code has to exit eventually and that's where the hook takes place. If it were to be implemented to work on 16, the concept would be the same, just the code would be slightly different; however, WoW64 process has nothing to do with a 32 bit OS or a 16 bit process on a 32 bit OS.