IsWow64Process2 docs (parameters section) say the following:
pProcessMachine
On success, returns a pointer to an IMAGE_FILE_MACHINE_* value. The value will be IMAGE_FILE_MACHINE_UNKNOWN if the target process is not a WOW64 process; otherwise, it will identify the type of WoW process.
However, many of the Image File Machine Constants would not apply, I would not think, because they are 64 bit, and only a 32 bit process can run under WOW64. Also, I am thinking, for Windows 10, the possible architectures can only be Intel (including AMD) or ARM based from this quote (see here):
WOW64 is the x86 emulator that allows 32-bit Windows-based applications to run seamlessly on 64-bit Windows. This allows for 32-bit (x86) Windows applications to run seamlessly in 64-bit (x64) Windows, as well as for 32-bit (x86) and 32-bit (ARM) Windows applications to run seamlessly in 64-bit (ARM64) Windows.
Therefore, I am thinking only the following 32 bit machine type constants could possibly be returned via pProcessMachine if the process is indeed running under WOW64:
- IMAGE_FILE_MACHINE_I386
- IMAGE_FILE_MACHINE_ARM
Related links:
Am I correct in the above assumption and list of two possible architectures? Also, is there a place elsewhere in the Microsoft Windows docs (or any other blog, articles, books, etc.) that explains WOW64 and related topics more in-depth than the links I have shown above, perhaps explicitly addressing my question?
