4 ms·

Wow! This might actually make it possible for Actually Portable Executable to support running on Windows ARM. I'm already putting the ARM code inside all my bin

by jart 2y ago

Wow! This might actually make it possible for Actually Portable Executable to support running on Windows ARM. I'm already putting the ARM code inside all my binaries. There's just never been a way to encode that in the PE headers. But if my emulated WinMain() function for x86-64 could detect that it's being emulated and then simply ask a WIN32 API to jump to the ARM entrypoint instead, it'd be the perfect solution to my problems. I actually think I'm going to rush out and buy a Windows ARM computer right now.

yjftsjthsd-h 2y ago
And this kind of beautiful insanity is why you're one of my favorite developers of this era. Also, > I'm already putting the ARM code inside all my binaries. Wait, I thought CPU architecture was the one limitation that did affect APE - you mean on unix-likes APE binaries are already compatible across amd64 and aarch64? Edit: rereading https://justine.lol/cosmo3/ https://justine.lol/cosmo3/ it does say that, doesn't it - and ARM64 listing "Windows (non-native)" just means that one platform uses (for the next few hours-days, at least...) emulation. That's amazing:)
zorgmonkey 2y ago
I'm pretty sure the API you'll want to detect that is IsWow64Process2.
- szundi 2y ago
  I love the 2s and Exes at the end of Windows API call names
  - formerly_proven 2y ago
    wait/waitid/waitpid/wait3/wait4 dup/dup2/dup3 creat/open/openat/openat2 cough
    - skissane 2y ago
      Even more: clone3, __clone2 (only exists on Itanium), fchmodat2, preadv2, pwritev2, pipe2, sync_file_range2, mmap2 (only certain architectures; for x86, only 32-bit), renameat2, mlock2, faccessat2, epoll_pwait2 My personal prediction is sooner or later we'll see execveat2, to permit setting /proc/PID/comm when using execveat [0]. I doubt we'll ever see clone4, because clone3 is passed a structure argument with the structure size, so new fields can be supported just by increasing the structure size. If other syscalls had done that from the start, much of the 2/3/etc would have been avoided. It is actually a very common practice on Windows (since NT), it has only much more recently been adopted in the Linux kernel [0] see https://uapi-group.org/kernel-features/ https://uapi-group.org/kernel-features/
    - phaedrus 2y ago
      I work on a team that supports some equipment related to airplanes. An acronym for one piece of equipment that is decades old is "RCSU". When I got a support call talking about "RSCU", I assumed the person meant "RCSU". Nope. It turns out, when they made their next-generation piece of equipment, the vendor differentiated it by swapping the inner two letters in an already easy-to-say-wrong acronym. My reaction was, "WTF didn't they just call it the RCSU2?!"
  - Just_Harry 2y ago
    My favourite is MapViewOfFile3FromApp [0], which is one of the seven variants of MapViewOfFile. [0]: https://learn.microsoft.com/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile3fromapp https://learn.microsoft.com/windows/win32/api/memoryapi/nf-m...
- orthoxerox 2y ago
  IsWow64Process2ForRealThisTime
- ale42 2y ago
  wonder why they didn't call it IsWow64ProcessEx
  - layer8 2y ago
    The vague convention, as far as I understand, is that Ex denotes an extended variant of a function for more advanced use cases (e.g. with additional parameters/options) which is functionally a superset of the original function, whereas numbered versions are intended to be complete replacements and/or may change the semantics compared to the prior version.
    - throwaway2037 2y ago
      I agree. Examples: CreateWindowW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindoww https://learn.microsoft.com/en-us/windows/win32/api/winuser/... CreateWindowExW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindowexw https://learn.microsoft.com/en-us/windows/win32/api/winuser/...
lewurm 2y ago
> I actually think I'm going to rush out and buy a Windows ARM computer right now. If you have an Apple Silicon machine you can run a Windows Insider build via UTM in a VM.
mappu 2y ago
I found the http://www.emulators.com/docs/abc_arm64ec_explained.htm http://www.emulators.com/docs/abc_arm64ec_explained.htm article extremely helpful at understanding what the ABI is doing, you might like it too.
- adzm 2y ago
  This was a brilliant and informative read, deserving of its own post really. Thanks!
- KerrAvon 2y ago
  tl;dr: Microsoft reinvented the Mixed Mode Manager from Mac System 7.1.x circa 1993.
  - pjmlp 2y ago
    Or the Windows 3.1 Enhanced Mode with V86, more likely.
szundi 2y ago
Quickly create a donation page, you have this moment haha
dwattttt 2y ago
PE headers have a field for machine type, you're looking for Machine in FileHeader: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image https://learn.microsoft.com/en-us/windows/win32/debug/pe-for... and https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types https://learn.microsoft.com/en-us/windows/win32/debug/pe-for... EDIT: Or maybe what you're looking for is hybrid PEs? https://ffri.github.io/ProjectChameleon/new_reloc_chpev2/ https://ffri.github.io/ProjectChameleon/new_reloc_chpev2/
justinfrankel 2y ago
If you have an Apple Silicon mac you can install Win11 in UTM and it works great for dev purposes. Can get the free builds via Windows Insider, too.
- conradev 2y ago
  I would recommend getting an official consumer build to test all of the latest consumer features like Copilot Parallels has a Microsoft partnership and has an official AMR64 image which I was able to grab (and run in anything). I’m sure there are a lot more now, though!
dboreham 2y ago
> could detect that it's being emulated Down the rabbit hole... > buy a Windows ARM computer You can still get Surface Pro X (16G/LTE) on Amazon for $800
- officeplant 2y ago
  If you're lucky you can also find the snapdragon thinkpads for under $350 on amazon.
  - adastra22 2y ago
    Whoa
    - officeplant 2y ago
      unfortunately that time seems to have passed, the refurb units I can find now are back up to $650.
darby_nine 2y ago
It looks like this might be provided by "Arm64X", which does seem to encode the dual-arch nature at the binary level: https://learn.microsoft.com/en-us/windows/arm/arm64x-pe https://learn.microsoft.com/en-us/windows/arm/arm64x-pe

by jart 2y ago

yjftsjthsd-h 2y ago

And this kind of beautiful insanity is why you're one of my favorite developers of this era. Also, > I'm already putting the ARM code inside all my binaries. Wait, I thought CPU architecture was the one limitation that did affect APE - you mean on unix-likes APE binaries are already compatible across amd64 and aarch64? Edit: rereading https://justine.lol/cosmo3/ https://justine.lol/cosmo3/ it does say that, doesn't it - and ARM64 listing "Windows (non-native)" just means that one platform uses (for the next few hours-days, at least...) emulation. That's amazing:)

zorgmonkey 2y ago

I'm pretty sure the API you'll want to detect that is IsWow64Process2.

szundi 2y ago
I love the 2s and Exes at the end of Windows API call names
- formerly_proven 2y ago
  wait/waitid/waitpid/wait3/wait4 dup/dup2/dup3 creat/open/openat/openat2 cough
  - skissane 2y ago
    Even more: clone3, __clone2 (only exists on Itanium), fchmodat2, preadv2, pwritev2, pipe2, sync_file_range2, mmap2 (only certain architectures; for x86, only 32-bit), renameat2, mlock2, faccessat2, epoll_pwait2 My personal prediction is sooner or later we'll see execveat2, to permit setting /proc/PID/comm when using execveat [0]. I doubt we'll ever see clone4, because clone3 is passed a structure argument with the structure size, so new fields can be supported just by increasing the structure size. If other syscalls had done that from the start, much of the 2/3/etc would have been avoided. It is actually a very common practice on Windows (since NT), it has only much more recently been adopted in the Linux kernel [0] see https://uapi-group.org/kernel-features/ https://uapi-group.org/kernel-features/
  - phaedrus 2y ago
    I work on a team that supports some equipment related to airplanes. An acronym for one piece of equipment that is decades old is "RCSU". When I got a support call talking about "RSCU", I assumed the person meant "RCSU". Nope. It turns out, when they made their next-generation piece of equipment, the vendor differentiated it by swapping the inner two letters in an already easy-to-say-wrong acronym. My reaction was, "WTF didn't they just call it the RCSU2?!"
- Just_Harry 2y ago
  My favourite is MapViewOfFile3FromApp [0], which is one of the seven variants of MapViewOfFile. [0]: https://learn.microsoft.com/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile3fromapp https://learn.microsoft.com/windows/win32/api/memoryapi/nf-m...
orthoxerox 2y ago
IsWow64Process2ForRealThisTime
ale42 2y ago
wonder why they didn't call it IsWow64ProcessEx
- layer8 2y ago
  The vague convention, as far as I understand, is that Ex denotes an extended variant of a function for more advanced use cases (e.g. with additional parameters/options) which is functionally a superset of the original function, whereas numbered versions are intended to be complete replacements and/or may change the semantics compared to the prior version.
  - throwaway2037 2y ago
    I agree. Examples: CreateWindowW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindoww https://learn.microsoft.com/en-us/windows/win32/api/winuser/... CreateWindowExW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindowexw https://learn.microsoft.com/en-us/windows/win32/api/winuser/...

lewurm 2y ago

> I actually think I'm going to rush out and buy a Windows ARM computer right now. If you have an Apple Silicon machine you can run a Windows Insider build via UTM in a VM.

mappu 2y ago

I found the http://www.emulators.com/docs/abc_arm64ec_explained.htm http://www.emulators.com/docs/abc_arm64ec_explained.htm article extremely helpful at understanding what the ABI is doing, you might like it too.

adzm 2y ago
This was a brilliant and informative read, deserving of its own post really. Thanks!
KerrAvon 2y ago
tl;dr: Microsoft reinvented the Mixed Mode Manager from Mac System 7.1.x circa 1993.
- pjmlp 2y ago
  Or the Windows 3.1 Enhanced Mode with V86, more likely.

szundi 2y ago

Quickly create a donation page, you have this moment haha

dwattttt 2y ago

PE headers have a field for machine type, you're looking for Machine in FileHeader: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image https://learn.microsoft.com/en-us/windows/win32/debug/pe-for... and https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#machine-types https://learn.microsoft.com/en-us/windows/win32/debug/pe-for... EDIT: Or maybe what you're looking for is hybrid PEs? https://ffri.github.io/ProjectChameleon/new_reloc_chpev2/ https://ffri.github.io/ProjectChameleon/new_reloc_chpev2/

justinfrankel 2y ago

If you have an Apple Silicon mac you can install Win11 in UTM and it works great for dev purposes. Can get the free builds via Windows Insider, too.

conradev 2y ago
I would recommend getting an official consumer build to test all of the latest consumer features like Copilot Parallels has a Microsoft partnership and has an official AMR64 image which I was able to grab (and run in anything). I’m sure there are a lot more now, though!

dboreham 2y ago

> could detect that it's being emulated Down the rabbit hole... > buy a Windows ARM computer You can still get Surface Pro X (16G/LTE) on Amazon for $800

officeplant 2y ago
If you're lucky you can also find the snapdragon thinkpads for under $350 on amazon.
- adastra22 2y ago
  Whoa
  - officeplant 2y ago
    unfortunately that time seems to have passed, the refurb units I can find now are back up to $650.

darby_nine 2y ago

It looks like this might be provided by "Arm64X", which does seem to encode the dual-arch nature at the binary level: https://learn.microsoft.com/en-us/windows/arm/arm64x-pe https://learn.microsoft.com/en-us/windows/arm/arm64x-pe