[excr4sh]

I know a lot more than you do, you are the one that doesn't know what you're talking about or you lack the comprehension skills to even read my posts properly. You act like this is advanced lol.

Yeah, you know so much you can even hook X86SwitchTo64BitMode or KiFastSystemCall on native 16-bit applications right? that why you're asking why I don't list 16-bit applications, which I already told you why I don't but you still don't get LOL.

This is not advaced, it's very simple and you don't understand it, but tell us why it would be useful to list 16-bit applications in this code.

[0xDEAD10CC]

He did say intercepting system service calls on WoW64 processes. This will not work on 64 bit architectures running 64 bit processes, or 32 bit architectures running 32 or 16 bit processes. The only reason the hook works is because the emulation code has to exit eventually and that's where the hook takes place. If it were to be implemented to work on 16, the concept would be the same, just the code would be slightly different; however, WoW64 process has nothing to do with a 32 bit OS or a 16 bit process on a 32 bit OS.

He did write this too though:

BTW, I did an update a while ago, it works from WIndows XP to Windows 8.1 32/64-bit:

[RISC]

He did write this too though:

But there are 64 bit Windows XP versions. Which also implement X86SwitchTo64Bit. The hook would work just fine on XP WoW64 processes.

[excr4sh]

He did write this too though:

RISC already explained it, additionally, If Windows doesn't use X86SwitchTo64BitMode or KiFastSystemCall then this method will not work and you'll need to hook the functions individually, which is the case with Windows 8 32 bit.

edited:
@0xDEAD10CC, If you still don't understand, # wrote an article about KiFastSystemCall, he explained it very well:: http://www.#.com/2015/04/intercepting-al...ls-by.html