64-bit Insider

Volume I, Issue 11

The 64-bit Advantage Inside the WOW64

The computer industry is
changing, and 64-bit technology
is the next, inevitable step. The Last year saw the release of Microsoft® Windows
64-bit Insider newsletter will help Server™ 2003 x64 Editions and Microsoft Windows®
you adopt this technology by
providing tips and tricks for a
XP 64-bit Edition operating system, both of which run
successful port. on the new 64-bit chips from Intel and AMD. This new
Windows technology was created because, although
Development and migration of 64- 32-bit Windows applications can run on most 64-bit
bit technology is not as processors, they could not— until now— take
complicated as the 16-bit to 32-bit
advantage o f the pro cessors’ ex panded features, such as
transition. However, as with any
new technology, several areas do increased memory. A subsystem of the operating
require close examination and system called Windows 32-bit on Windows 64-bit
consideration. The goal of the 64- (WOW64 or WOW) allows 32-bit applications to run
bit Insider newsletter is to identify in the 64-bit Windows environment. This issue of the
potential migration issues and
64-bit Insider Newsletter discusses why WOW64 is
provide viable, effective solutions
to these issues. With a plethora of important and how it keeps 32-bit applications separate
Web sites already focused on 64- from the 64-bit operating system.
bit technology, the intention of
this newsletter is not to repeat
previously published information.
Instead, it will focus on 64-bit
issues that are somewhat isolated
yet extremely important to
understand. It will also connect
you to reports and findings from
64-bit experts.

64-bit Insider Newsletter

Volume 1, Issue 11
Page 1/5
Comparing 32-bit and 64-bit
Windows
The differences between 32-bit Windows and 64-
bit Windows make running 32-bit applications on
64-bit Windows challenging. The issues are
related to the 64-bit processors and Windows
itself.

The processors run in two modes: 32-bit and 64-

bit. In the 64-bit mode, the memory pointers are larger than in the 32-bit mode. While
this gives the 64-bit applications access to more memory, the execution contexts and
data are incompatible with 32-bit applications. As a result, 64-bit and 32-bit code cannot
be mixed within a single process. For example, if a 64-bit process loads a 32-bit
Dynamic Link Library (DLL), or vice versa, an error results, saying that the DLL
format is incorrect. Consequently, 32-bit applications cannot use the 64-bit system
DLLs. Also, in-process Component Object Model (COM) objects must have the same
“bit-ness” as their clients. But the standard 32-bit registry does not distinguish 32-bit
and 64-bit DLLs.

WOW64 solves these and other problems.

Working with WOW64

WOW64 was designed to solve the issues that occur with running a 32-bit application
on 64-bit Windows. It presents 32-bit applications with a controlled view of the
operating system so that the application thinks it is running on a standard 32-bit
Windows operating system. WOW64 also supports console and graphical user interface
(GUI) applications, as well as 32-bit services.

To do this, WOW64 uses a combination of techniques that are transparent to the

application. Smart 32-bit applications can verify if they are running inside WOW64 and
bypass much of WOW64, if necessary. But under normal circumstances, the 32-bit
application is unaware of WOW64 and runs almost
seamlessly alongside the 64-bit application.
“ [WOW64] presents the
To feign a 32-bit operating system for the 32-bit 32-bit application that is
applications, WOW64 uses several techniques. For running with a controlled
example, WOW64 transparently directs file system and view of the operating
registry accesses away from system areas that contain 64- system so that the
bit information and directs both file system and registry application thinks it is
toward special areas that contain the 32-bit equivalents. running on a standard 32-
In very select circumstances, WOW64 can also use 32-bit bit Windows operating
system calls to jump into the 64-bit kernel and back out system.”
again. This process involves translating o r “thunking”
parameters and exceptions so that the 32-bit application
continues to work as expected. On IA64 (Intel Itanium), WOW64 emulates the x86
instruction set, and cannot run 32-bit applications as efficiently when compared to other
x64 systems, like Intel’s X eon and A M D 64 p rocessors.

64-bit Insider Newsletter

Volume 1, Issue 11
Page 2/5
The rest of this newsletter takes a more detailed look at the techniques used by
WOW64.

Binary Compatibility
WOW64 provides a set of 32-bit system binaries in a directory called SysWOW64. This
directory contains DLLs, EXEs, OCXs (Object Linking and Embedding custom
controls), and other files that 32-bit applications expect to find. Most of these binaries
are identical to their counterparts on 32-bit Windows and do not talk directly to the
kernel.
Some of these binaries require specific knowledge
of WOW64 because they need to share memory
with 64-bit areas of the operating system. As a
result, they were modified slightly from their 32-bit
Windows counterpart. Among these modified
libraries are kernel32.dll, ntdll.dll, user32.dll,
imm32.dll, gdi32.dll, and rpcrt4.dll.

Other binaries have been thunked and are only

shells of their former selves. All calls to them
convert into 64-bit calls and forward to the
appropriate 64-bit DLL.

Figure 1 shows a simplified picture of the 64-bit

Windows application stack. The 32-bit applications
call the Win32 API, which calls 32-bit ntdll.dll. This
DLL has been modified from the original 32-bit
version and interacts with WOW64 to talk to the 64-
bit ntdll.dll and the kernel.

The 64-bit applications talk to the renamed Figure 1 64-bit Windows

application stack
Windows API, which is identical to the original
API. The renamed Windows API talks directly to
the 64-bit ntdll.dll.

File System Redirection

In the 64-bit Windows operating system, the new 64-bit system DLLs reside in the
system32 directory, while the 32-bit system DLLs reside in a new directory,
SysWOW64. This feature can be confusing.

To prevent 32-bit applications from linking with 64-bit applications, WOW64 intercepts
all file system accesses and redirects any that are made to the system32 directory. This
process works very well because every call will be intercepted, so even hardcoded
references to DLLs will be redirected to the correct 32-bit library.

Similarly, though using a different technique, 32-bit applications and 64-bit applications
are installed by default to different versions of the Program Files directory. 64-bit

64-bit Insider Newsletter

Volume 1, Issue 11
Page 3/5
applications are installed to the well-known Program Files directory, but 32-bit
applications are installed to the Program Files (x86) directory. Users of 32-bit installers
will try to install their application into a directory specified by a system variable called
XXX, which will contain the value Program Files (x86) by default. However, this
policy is not strictly enforced. A user can often change the installation directory before
the installation occurs, and sometimes the user hardcodes a different installation
directory. In these cases, the installation will not be redirected.

Issues 5 and 6 of the 64-bit Insider newsletter discuss file system redirection in more
detail.

Registry Redirection
The registry contains information about many
aspects of the operating system. In particular,
the registry contains lists of all the COM
objects registered with the operating system.
WOW64 separates the 32-bit and 64-bit COM
registrations by maintaining two distinct
branches of some registry parts. However,
because some COM objects can be loaded out-
of-process, registry accesses must be carefully redirected.
Registry redirection happens when a 32-bit application tries to load a COM object in-
process. If there is no registered 32-bit version of the COM object, the application is
told that no such object exists— even if a 64-bit version is available. The same thing
happens when a 64-bit application tries to load a COM
object. During registration, the COM object will be
“ Registry redirection registered in the correct branch of the registry, depending
happens when a 32-bit on whether it is a 32-bit or 64-bit COM object.
application tries to load a
COM object in-process. If Registry redirection is not enough when out-of-process
there is not a registered COM objects have been registered or loaded by an
32-bit version of the COM application. An out-of-process COM object can be loaded
object, the application is by any application, regardless of whether it is 32-bit or
told that no such object 64-bit. A 32-bit application can safely load a 64-bit COM
exists— even if a 64-bit object out-of-process because, now, all communication is
version is available.” through remote procedure calls. Branches can now be
copied between the 32-bit and 64-bit branches as
required. Issue 7 of this newsletter discusses he clever
logic that makes this copying possible when we talk
about how COM works in 64-bit Windows.

WOW64 and Microsoft .NET

WOW64 also protects software applications built on the 32-bit Microsoft .NET
Framework connected software from the 64-bit environment in precisely the same way
that it protects native 32-bit applications. The 64-bit editions of Windows contain two
versions of the .NET runtime: one for running 32-bit .NET applications and another for
running 64-bit .NET applications. At first, it may seem odd to need two versions of

64-bit Insider Newsletter

Volume 1, Issue 11
Page 4/5
.NET, but the ability of .NET applications to load and execute native libraries
effectively creates a similar set of issues for .NET applications as exists for native 32-bit
applications.

Special flags inside the assembly of .NET applications indicate the following:
 If the application contains any native code.
 If the application loads any 32-bit libraries.
 If the application needs to run as a 32-bit application.

You can mark an assembly as any one of the following:

 64-bit assembly (target x64 or IA64 in Microsoft Visual Studio® 2005)
 32-bit assembly (target x86)
 Neutral assembly that can run on either (target AnyCPU).

If the assembly does not explicitly (through the flags mentioned here) or implicitly
(through the format of the executable) specify which runtime it needs, then the
operating system will assume that the assembly is not aware of 64-bit Windows and will
load it into the 32-bit runtime. Many assemblies that were compiled with older versions
of the .NET compilers did so. With newer compilers, the assembly is run in 64-bit
runtime unless it is marked explicitly as requiring the 32-bit runtime.

The Global Assembly Cache (GAC) is aware of the differences between 32-bit and 64-
bit assemblies. Consequently, the GAC allows you to have two DLLs that have the
same name and the same GUID, but have been compiled for different architectures.
When you load an assembly from the GAC, it will use the most suitable DLL depending
on the architecture of the client application.

Summary
WOW64 provides a transparent layer between 32-bit Windows applications and the 64-
bit operating system. This layer allows 32-bit applications to run seamlessly in 64-bit
Windows. WOW64 provides special system libraries so that the 32-bit applications can
run, and also provides alternative sections, both in the registry and in the file system, to
keep 32-bit and 64-bit applications working without conflicts.

64-bit Insider Newsletter

Volume 1, Issue 11
Page 5/5