Question

我遇到Wow64DisableWow64FsRedirection()的问题。

当我在Visual Studio 2010中编译64位平台时，它在Window 10中不起作用，它返回错误1。

但是，当我编译为32位平台时，该功能在Window 10中运行。

typedef BOOL(__stdcall *tFSRED)(HMODULE );

HMODULE hKernel = LoadLibrary(_T("Kernel32.dll")); // Get Kernel module handle
if (hKernel == NULL)
{
    return 2;
}

tFSRED pFunc;
pFunc = (tFSRED) GetProcAddress(hKernel, "Wow64DisableWow64FsRedirection");
ret = pFunc(&oldValue);  // Turn the file the file system redirector off
if (ret == FALSE)
{
    _tprintf(_T("\nFile System Redirection could not be turned off. Reason: %d"), GetLastError());
    return 4;
}
// ret is always TRUE when compile through 32-bit platform
// but ret return FALSE when compile through 64-bit platform

在Visual Studio中，如果我为64位平台编译，那么在编译之后如果我在depends.exe中打开生成的EXE，它会在EXE前面显示64位。

选择32位平台后，生成的EXE为32位。 EXE在我的情况下工作，但我希望我的EXE是64位，所以我选择64位平台，我得到一个64位EXE，但它不能像我上面解释的那样工作。

Answer 1

WOW64仿真仅适用于在64位系统上运行的32位可执行文件。 64位EXE 不应该尝试使用WOW64函数（可能只有IsWow64Process()），因为EXE将不会在WOW64内部运行。这就是您在64位EXE中获得错误代码1（ERROR_INVALID_FUNCTION）的原因。

所以，要么：

如果代码在64位编译中跳过WOW64函数：

#ifndef _WIN64
typedef BOOL (WINAPI *tFSDisable)(PVOID*);
typedef BOOL (WINAPI *tFSRevert(PVOID);

HMODULE hKernel = GetModuleHandle(_T("Kernel32"));
tFSDisable pDisableFunc = (tFSDisable) GetProcAddress(hKernel, "Wow64DisableWow64FsRedirection");
tFSRevert pRevertFunc = (tFSRevert) GetProcAddress(hKernel, "Wow64RevertWow64FsRedirection");

PVOID oldValue;

if ((pDisableFunc) && (pRevertFunc))
{
    if (!pDisableFunc(&oldValue))  // Turn off the file system redirector
    {
        _tprintf(_T("\nFile System Redirection could not be turned off. Reason: %d"), GetLastError());
        return 4;
    }
}
#endif

// do file system operations as needed...

#ifndef _WIN64
if ((pDisableFunc) && (pRevertFunc))
{
    if (!pRevertFunc(oldValue))  // Restore the file system redirector
    {
        _tprintf(_T("\nFile System Redirection could not be restored. Reason: %d"), GetLastError());
        return 5;
    }
}
#endif

省略ifdef并仅在IsWow64Process()报告当前进程实际在WOW64内运行时调用WOW64函数：

typedef BOOL (WINAPI tW64P)(HANDLE, PBOOL);
typedef BOOL (WINAPI *tFSDisable)(PVOID*);
typedef BOOL (WINAPI *tFSRevert(PVOID);

HMODULE hKernel = GetModuleHandle(_T("Kernel32"));

tW64P pIsWow64Func = (tW64P) GetProcAddress(hKernel, "IsWow64Process");
tFSDisable pDisableFunc = NULL;
tFSRevert pRevertFunc = NULL;

BOOL bIsWow64 = FALSE;
if (pIsWow64Func)
{
    pIsWow64Func(GetCurrentProcess(), &bIsWow64);
    if (bIsWow64)
    {
        pDisableFunc = (tFSDisable) GetProcAddress(hKernel, "Wow64DisableWow64FsRedirection");
        pRevertFunc = (tFSRevert) GetProcAddress(hKernel, "Wow64RevertWow64FsRedirection");
    }
}

PVOID oldValue;

if ((pDisableFunc) && (pRevertFunc))
{
    if (!pDisableFunc(&oldValue))  // Turn off the file system redirector
    {
        _tprintf(_T("\nFile System Redirection could not be turned off. Reason: %d"), GetLastError());
        return 4;
    }
}

// do file system operations as needed...

if ((pDisableFunc) && (pRevertFunc))
{
    if (!pRevertFunc(oldValue))  // Restore the file system redirector
    {
        _tprintf(_T("\nFile System Redirection could not be restored. Reason: %d"), GetLastError());
        return 5;
    }
}

在Window 10中的Visual Studio中为64位编译时，Wow64DisableWow64FsRedirection（）函数不起作用

1 个答案: