hasherezade/tiny_tracer

for x64 call under wow64

nblog opened this issue · 0 comments

nblog commented

can it be monitored, for x64 call under wow64?

maybe like this

...;called: C:\Windows\SysWOW64\ntdll.NtQueryInformationProcess
... // Wow64Transition
...;called: C:\Windows\System32\ntdll.NtQueryInformationProcess

for some use wow64ext, it may be better.