A method that determines whether a specified process is x64 (Ntdll determines if a x64 function exists)

[CPP]View PlainCopy 

2. BOOL iswow64processex (HANDLE hprocess)
4. {
6. //If the system is x86, then the process cannot have x64
8. bool isX86 = false;
10. #ifndef _win64
12. isX86 = GetProcAddress (GetModuleHandle (TEXT ("Ntdll")), "ntwow64debuggercall") = = nullptr?  True:false;
14. #endif
16. if (isX86)
18. return FALSE;
22. //Process architecture is unknown, the system is x64, you can use the Iswow64process function to determine
24. typedef BOOL (WINAPI *iswow64process) (HANDLE, pbool);
26. Iswow64process fniswow64process;
28. BOOL isWow64 = TRUE;
30. Fniswow64process = (iswow64process) GetProcAddress (GetModuleHandle (TEXT ("kernel32")), "iswow64process");
32. if (fniswow64process! = nullptr)
34. Fniswow64process (hprocess, &ISWOW64);
36. return!iswow64;
38. }

First use OpenProcess to open the target process, and then pass the handle in the OK.

http://blog.csdn.net/aqtata/article/details/18361209

A method that determines whether a specified process is x64 (Ntdll determines if a x64 function exists)