32-bit on Windows 64-bit
For the most part, 32-bit applications just work on the 64-bit version of Windows. However, I was curious about how it all works behind the scenes.
In this post, I go down a rabbit hole exploring what makes 32-bit applications work on Windows 64-bit.
WoW64
When Microsoft transitioned from 16-bit to 32-bit, they created a compatibility layer emulator named WoW (Windows on Windows). WoW made 16-bit applications run effortlessly on Windows 32-bit. As part of creating WoW, Microsoft also created the System32 folder %windir%\System32 aka C:\Windows\System32 for all the 32-bit libraries and executables, and WoW would keep using the System folder %windir%\System aka C:\Windows\System as the location for the 16-bit libraries and executables.
Logically, for the transition from 32-bit to 64-bit, Microsoft would create a System64 folder for all the 64-bit libraries and executables. That did not happen. Instead, Microsoft created the SysWOW64 folder %windir%\SysWOW64 aka C:\Windows\SysWOW64. The SysWOW64 folder is the location for the 32-bit libraries and executables, and the System32 folder is the location for the 64-bit libraries and executables. That is not a typo that is actually the way it is. The SysWOW64 folder is just one part that makes up WoW64, which stands for Windows (32-bit) on Windows 64-bit.
WoW64 is another compatibility layer emulator that comes with the 64-bit version of Windows that helps 32-bit applications run on Windows 64-bit. If you want to run the 32-bit version of CMD, you can by launching CMD from C:\Windows\SysWOW64\cmd.exe, and you can run the 64-bit version of CMD by launching CMD from C:\Windows\System32\cmd.exe.
Keeping the 32-bit and 64-bit files isolated helps keep everything compatible, as many 64-bit libraries have the same name as their 32-bit counterparts.
File System Redirector
Another component that helps 32-bit applications run on Windows 64-bit is the File System Redirector.
When a 32-bit application accesses the %windir%\System32 folder, the File System Redirector redirects it to %windir%\SysWOW64. This ensures that the 32-bit applications access the correct 32-bit libraries and executables. The 32-bit application has no idea this is happening. As far as the application is concerned, it is accessing the System32 folder, but in reality, it is actually using the SysWOW64 folder. It is similar to how 32-bit programs end up in the Program Files (x86) folder and 64-bit programs end up in the Program Files folder.
We can show the File System Redirector in action by opening the 32-bit and 64-bit versions of CMD and changing directories to %ProgramFiles%. The 32-bit version of CMD will be sent to C:\Program Files (x86), and the 64-bit version of CMD will be sent to C:\Program Files.
Registry Redirector
Another element that helps 32-bit applications work on Windows 64-bit is the Registry Redirector.
If a 32-bit application accesses the HKLM:\SOFTWARE registry path, the Registry Redirector instead redirects it to the HKLM:\SOFTWARE\WOW6432Node registry path. It is transparent to the application and done to avoid possible registry key collisions.
If we open the 32-bit version of CMD and launch PowerShell, we will get the 32-bit version. We can confirm that we are running in 32-bit space by checking the variable $env:ProgramFiles. In 32-bit space, it will be C:\Program Files (x86). In 64-bit space, it will be C:\Program Files.
To show the registry redirector in action, we will use the 32-bit version of CMD to call the 32-bit version of PowerShell, and we will create a new registry entry in HKLM:\SOFTWARE named theDXT.
The PowerShell command we will use is New-Item -Path 'HKLM:\Software\theDXT'.
If we check the registry path HKLM:\SOFTWARE, we will see that the new registry entry theDXT does not exist.
If we expand WOW6432Node, we see that theDXT registry entry exists.
If we use the 64-bit version of PowerShell, we can confirm that the registry path does not exist by using the command Get-Item -Path 'HKLM:\Software\theDXT'
In the 64-bit version of PowerShell, if we run the same PowerShell command New-Item -Path 'HKLM:\Software\theDXT', the registry entry will be created in HKLM:\SOFTWARE and not redirected.
If we check the registry path HKLM:\SOFTWARE, we will see that our new registry entry, theDXT, exists.
SysNative
The File System Redirector and the Registry Redirector are essential to making 32-bit applications work on Windows 64-bit. But what happens if you have a 32-bit application that needs to access 64-bit space? Fortunately, there’s a way to do that with SysNative.
SysNative is a virtual directory for 32-bit applications to bypass the File System Redirector and access the native 64-bit files.
The full path to call PowerShell is %windir%\System32\WindowsPowerShell\v1.0\powershell.exe
When a 32-bit application calls PowerShell, the File System Redirector will launch the 32-bit version of PowerShell from the disk path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
When a 64-bit application calls PowerShell, the 64-bit version of PowerShell will launch from the disk path C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
To use SysNative, a 32-bit application replaces %windir%\System32 with %windir%\SysNative. This allows the 32-bit application to bypass the File System Redirector and use the native System32 folder instead of the redirected SysWOW64 folder.
If we use SysNative, we can have the 32-bit version of CMD launch the 64-bit version of PowerShell by using the following SysNative command %windir%\SysNative\WindowsPowershell\v1.0\PowerShell.exe
Now that the 32-bit version of CMD can escape 32-bit space and call the 64-bit version of PowerShell, we can create a registry entry with PowerShell without being redirected by the Registry Redirector because, as far as Windows is concerned, the PowerShell instance we are running is in 64-bit space so WOW64 is not involved.
We will create the following registry entry HKLM:\Software\theDXT-32-bit-access with the following PowerShell command New-Item -Path 'HKLM:\Software\theDXT-32-bit-access'
If we check HKLM:\SOFTWARE, we will see that our new registry entry, theDXT-32-bit-access, exists.
Summary
WoW64, File System Redirector, and Registry Redirector are just a few components that make 32-bit applications work seamlessly on Windows 64-bit. SysNative is a great way to escape 32-bit space into 64-bit space when needed.
If you want to read more about the File System Redirector, here is the Microsoft documentation. There isn’t a lot of documentation about SysNative. However, you can read a bit more about it in the File System Redirector documentation. If you want to read more about the Registry Redirector, here is the Microsoft documentation. If you want to read more about WOW64, here is the Microsoft documentation.
Leave a comment