Why is it not supported for 32-bit programs to call 64-bit target processes.

[edsky]

Is there any difficulty here?

[OpenByteDev]

It should be possible to do it, as there are also some other injectors that support it, but i have not looked into how they do it.

To extend the current implementation as is, there are some problems:

• EnumProcessModulesEx does not support iterating x64 modules from an x32 (wow64) process. (Currently used to get addresses of win32 API functions in target process and to confirm that the injection succeeded)
• CreateRemoteThread will truncate arguments and return value when doing x32->x64.
• maybe others

[edsky]

You can refer to the implementation of yapi, which supports injection of 32-bit processes into 64-bit processes under C++.

Confirm whether the injection is successful can be determined by remote LoadLibrary,

• EnumProcessModulesEx the yapi method can call this function under 32 bits.
• CreateRemoteThread the parameter problem can be done in assembly form.
  The assembly parameters under 64-bit are very fixed, and you only need to write the registers as they are.

[OpenByteDev]

EnumProcessModulesEx can be called but will not return x64 modules (see the remarks section).
I dont follow with what you are suggesting for CreateRemoteThread.

[edsky]

This problem of EnumProcessModulesEx can be easily solved.

One way is to call NtQueryInformationProcess through wow64, and the other way is to directly call NtWow64QueryInformationProcess64.

For related codes, please refer to https://www.52pojie.cn/forum.php?mod=viewthread&tid=872501 and https://stackoverflow.com/questions/3801517/how-to-enum-modules-in-a-64bit -process-from-a-32bit-wow-process?answertab=trending#tab-top

[OpenByteDev]

I just want to mention that while I may implement this, I will not work on it in the near future.

[OpenByteDev]

I rewrote listing processes and modules using ntdll in OpenByteDev/processes@31435c7 but without using the WoW64 methods.

[raeisimv]

The documentation says something else:

On 64-bit Windows, a 64-bit process cannot load a 32-bit dynamic-link library (DLL). Additionally, a 32-bit process cannot load a 64-bit DLL.

at: https://learn.microsoft.com/en-us/windows/win32/winprog64/process-interoperability

[OpenByteDev]

@raeisimv Yes, but we are talking about about the injector process and target process here, not the payload dll.