32位系统上的Wow64 :恢复

Question

这个线程解释了如何管理Wow64DisableWow64FsRedirection函数以在32位和64位系统上工作：Wow64DisableWow64FsRedirection on 32-bit Windows XP

但是，在禁用Wow64后，它们似乎不会恢复。

通常，代码为：

PVOID pOldValue = NULL;
Wow64DisableWow64FsRedirection(&pOldValue);
std::string path = C:/Windows/system32/prog.exe;
ShellExecuteA(NULL, ("open"), LPCSTR(path.c_str()), NULL, NULL, SW_SHOWNORMAL);
Wow64RevertWow64FsRedirection(pOldValue);

但是，使用另一个线程中显示的代码，不是“恢复”：

typedef BOOL WINAPI fntype_Wow64DisableWow64FsRedirection(PVOID *OldValue);
auto pfnWow64DisableWow64FsRedirection = (fntype_Wow64DisableWow64FsRedirection*)GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64DisableWow64FsRedirection");

if (pfnWow64DisableWow64FsRedirection) {
   // function found, call it via pointer
   PVOID arg;
   (*pfnWow64DisableWow64FsRedirection)(&arg);
    std::string path = C:/Windows/system32/prog.exe;
ShellExecuteA(NULL, ("open"), LPCSTR(path.c_str()), NULL, NULL, SW_SHOWNORMAL);
}

我认为我应该做以下事情，但我不确定所有的*和&

typedef BOOL WINAPI fntype_Wow64DisableWow64FsRedirection(PVOID *OldValue);
auto pfnWow64DisableWow64FsRedirection =(fntype_Wow64DisableWow64FsRedirection*)GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64DisableWow64FsRedirection");

typedef BOOL WINAPI fntype_Wow64RevertWow64FsRedirection(PVOID OldValue);
auto pfnWow64RevertWow64FsRedirection = (fntype_Wow64RevertWow64FsRedirection*)GetProcAddress(GetModuleHandleA("kernel32.dll"), "Wow64RevertWow64FsRedirection");

if (pfnWow64DisableWow64FsRedirection) 
{
    // function found, call it via pointer
    PVOID arg;
    (*pfnWow64DisableWow64FsRedirection)(&arg);
    std::string path = C:/Windows/system32/prog.exe;
    ShellExecuteA(NULL, ("open"), LPCSTR(path.c_str()), NULL, NULL, SW_SHOWNORMAL);
    ShellExecuteA(NULL, ("open"), LPCSTR(path.c_str()), NULL, NULL, SW_SHOWNORMAL);
    (*pfnWow64RevertWow64FsRedirection)(arg);
}

非常感谢,

亚历克斯

Answer 1

无论函数是否可用，都必须检测运行时。

这可以通过调用LoadLibrary + GetProcAddress来获取函数地址来完成。通常情况下，delay loading是一种替代方案，但是在kernel32.dll上不支持它。

typedef BOOL (WINAPI*W64DW64FR)(PVOID *OldValue);
W64DW64FR w64dw64fr = (W64DW64FR) GetProcAddress(LoadLibraryA("kernel32"), "Wow64DisableWow64FsRedirection");

if (w64dw64fr) 
{
   PVOID old;
   w64dw64fr(&old);
}