WoW64 仿真层有什么作用？
所有 WoW64 应用程序都经过 WoW64 模拟层。
我想知道这一层发生了什么。（特别是他们如何转换地址空间）
请给我一些重要的观点。
All WoW64 apps go through WoW64 emulation layer.
I'd like to know what happen in this layer.(especially, how they can convert address space)
Please give me some important points.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
既然您已经发布了图表，那么很明显您知道 WOW64 存在的原因。现在回答你的问题：
我想你想知道它是如何实现的。
进程启动：加载程序照常加载 64 位用户模式部分“Ntdll.dll”，但如果进程用于 32 位执行，也会加载 32 位 Ntdll.dll。现在，加载程序负责使用 Wow64.dll 进行初始化，它在 32 位 Ntdll 中设置进程和线程上下文，并“将 CPU 切换到 32 位模式”以执行。
系统调用：现在一切都在 32 位模式下运行，直到发生系统调用。我们知道系统调用要经过Ntdll.dll、User32.dll、Gdi32.dll等；在本例中为 32 位版本。这些库有一个单独的 32 位版本，位于 \Windows\Syswow64 位文件夹中。这些只是存根，它们实际上在 Wow64.dll 中调用，而不是发出“本机系统调用”。现在，Wow64.dll 可以轻松转换到 64 位模式、将参数转换为其 64 位对应项、使用 64 位版本发出系统调用、获取结果并将输出重新转换为 32 位。然后它将 CPU 转换回 32 位模式并返回输出。
异常分派、用户回调、文件系统和注册表操作以及 I/O 都以相同的方式处理，只是在某处使用钩子。阅读下面规定的书。
64 位地址空间是 32 位地址空间的超集。另外，32 位/64 位中的相同指针（实际上是 PTE）不用于引用整个地址空间，但用户空间和系统空间有单独的页表。
要了解 Windows，我能给你的最重要的一点是阅读《Windows 内部原理》——Russinovich
Since you have already posted the diagram it is clear that you know why WOW64 exists. Now to answer your question:
I think you want to know how it is implemented.
Process startup: The loader loads 64-bit user-mode part 'Ntdll.dll' as usual, but also loads 32-bit Ntdll.dll in case the process is for 32-bit execution. It is now the loaders responsibility to initialize using Wow64.dll, which sets up process and thread contexts in 32-bit Ntdll and 'switches the CPU to 32-bit mode' for execution.
System Call: Everything is now running in 32-bit mode, until a system call. We know that system calls go through Ntdll.dll, User32.dll, and Gdi32.dll etc; in this case the 32-bit versions. There is a separate 32-bit version of these libraries located in \Windows\Syswow64 bit folder. These are just stubs that instead of issuing 'native system calls,' actually call in Wow64.dll. Now, it's simple for Wow64.dll to transition to 64-bit mode, convert parameters to their 64-bit counterparts, issue the system call using 64-bit versions, get the result, and reconvert the output to 32-bit. It then transitions CPU back to 32-bit mode and returns the output.
Exception dispatching, user callbacks, file system and registry operations, and I/O is handled in the same way, using hooks somewhere down the line. Read the book prescribed below.
64-bit address space is a superset of 32-bit address space. Plus, the same pointer (actually PTE) in 32-bit/64-bit isn't used to refer to the whole address space, but there are separate page tables for user-space and for system space.
To know windows, the most important point I can give you is to read 'Windows Internals' -- Russinovich
MSDN 说：
您具体不明白什么？您是否已经阅读过有关 WoW64 子系统的维基百科文章？我想您会发现它提供了相当全面的概述。
Microsoft 在此提供了一些其他详细信息：WOW64 实施详细信息
MSDN says:
What specifically do you not understand? Have you already read the Wikipedia article on the WoW64 subsystem? I think you'll find that it provides a fairly comprehensive overview.
And Microsoft provides some additional details here: WOW64 Implementation Details
“特别是，他们如何转换地址空间”，
关键是要知道 AMD 和 intel x64 处理器支持并行运行 32 位和 64 位代码。这允许操作系统（运行本机 x64 时）为具有 32 位寻址的 32 位线程创建一个上下文，该上下文与 64 位线程
以类似的方式共存，当主机操作系统运行 32 位时，它可以创建 16 位线程来运行 win16 和 dos应用程序。
请注意，我不认为在 64 位操作系统中运行时它可以创建 32 位和 16 位线程 - 我猜 amd 认为这太向后兼容了:-)
"especially, how they can convert address space"
the key to that is knowing that amd and intel x64 processors have support for running 32bit and 64bit code side by side. this allows the os (when running native x64) to create a context for a 32bit thread that has 32bit addressing that coexists with the 64bit threads
in a similar way when the host os is running 32bit, it can create 16bit threads for running win16 and dos applications.
note, I don't think when running in the os 64bit that it can create 32bit AND 16bit threads - I guess amd decided that was just too much backwards compatability :-)