Wow64 = 32 bit ?

The Windows documentation describes Wow64 as follows “WOW64 is the x86 emulator that allows 32-bit Windows-based applications to run seamlessly on 64-bit Windows.

A lay understanding of the writeups about the drive:\Windows\SysWow64 folder on a 64-bit OS (Windows 10, 11 etc.) leads one to believe that executing a binary (e.g. Notepad / Calculator etc.) in this directory should launch the 32 bit version of the app.

Let’s run the 64 bit version of Notepad.exe to verify this.

the Task Manager, as expected, displays a 64-bit process running.

Let’s now launch the 32-bit version that lives in drive:\Windows\SysWow64.

Task Manager still displays a 64-bit process, which seems counter-intuitive.

When we look at the properties of this process, something interesting emerges.

The Location field is reproduced here for easier reading.

C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2408.12.0_x64__8wekyb3d8bbwe\Notepad

Clearly a different 64 binary is being invoked when the drive:\Windows\SysWow64\notepad.exe binary is executed.

Let’s uninstall this app from the machine and rerun the Notepad.exe app in the drive:\Windows\SysWow64 folder.

This time, the Task Manager displays an x86 (32-bit) version of the running Notepad.exe.

Redirection How ?

Windows has an App Execution Alias setting, that if turned on redirects the app execution to the UWP app stored at the location pointed to by the registry entry below.

Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\notepad.exe

Conclusion

Clearly the naive assumption that every binary that is run from the drive:\Windows\SysWow64 folder is 32-bit is incorrect. Several common applications such as Notepad, Calculator have their 64-bit UWP versions installed from the Microsoft Store. The App Execution Alias settings point to a location on disk where the UWP app is stored.

Interestingly when the UWP version of Calculator (calc.exe) is removed from the system, the app vanishes completely and neither the x86 nor the x64 versions are able to execute.

REFERENCES

Leave a comment