4 ms·

I'm pretty sure the API you'll want to detect that is IsWow64Process2.

by zorgmonkey 2y ago

szundi 2y ago
I love the 2s and Exes at the end of Windows API call names
- formerly_proven 2y ago
  wait/waitid/waitpid/wait3/wait4 dup/dup2/dup3 creat/open/openat/openat2 cough
  - skissane 2y ago
    Even more: clone3, __clone2 (only exists on Itanium), fchmodat2, preadv2, pwritev2, pipe2, sync_file_range2, mmap2 (only certain architectures; for x86, only 32-bit), renameat2, mlock2, faccessat2, epoll_pwait2 My personal prediction is sooner or later we'll see execveat2, to permit setting /proc/PID/comm when using execveat [0]. I doubt we'll ever see clone4, because clone3 is passed a structure argument with the structure size, so new fields can be supported just by increasing the structure size. If other syscalls had done that from the start, much of the 2/3/etc would have been avoided. It is actually a very common practice on Windows (since NT), it has only much more recently been adopted in the Linux kernel [0] see https://uapi-group.org/kernel-features/ https://uapi-group.org/kernel-features/
  - phaedrus 2y ago
    I work on a team that supports some equipment related to airplanes. An acronym for one piece of equipment that is decades old is "RCSU". When I got a support call talking about "RSCU", I assumed the person meant "RCSU". Nope. It turns out, when they made their next-generation piece of equipment, the vendor differentiated it by swapping the inner two letters in an already easy-to-say-wrong acronym. My reaction was, "WTF didn't they just call it the RCSU2?!"
- Just_Harry 2y ago
  My favourite is MapViewOfFile3FromApp [0], which is one of the seven variants of MapViewOfFile. [0]: https://learn.microsoft.com/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile3fromapp https://learn.microsoft.com/windows/win32/api/memoryapi/nf-m...
orthoxerox 2y ago
IsWow64Process2ForRealThisTime
ale42 2y ago
wonder why they didn't call it IsWow64ProcessEx
- layer8 2y ago
  The vague convention, as far as I understand, is that Ex denotes an extended variant of a function for more advanced use cases (e.g. with additional parameters/options) which is functionally a superset of the original function, whereas numbered versions are intended to be complete replacements and/or may change the semantics compared to the prior version.
  - throwaway2037 2y ago
    I agree. Examples: CreateWindowW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindoww https://learn.microsoft.com/en-us/windows/win32/api/winuser/... CreateWindowExW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindowexw https://learn.microsoft.com/en-us/windows/win32/api/winuser/...

I'm pretty sure the API you'll want to detect that is IsWow64Process2.

szundi 2y ago

I love the 2s and Exes at the end of Windows API call names

formerly_proven 2y ago
wait/waitid/waitpid/wait3/wait4 dup/dup2/dup3 creat/open/openat/openat2 cough
- skissane 2y ago
  Even more: clone3, __clone2 (only exists on Itanium), fchmodat2, preadv2, pwritev2, pipe2, sync_file_range2, mmap2 (only certain architectures; for x86, only 32-bit), renameat2, mlock2, faccessat2, epoll_pwait2 My personal prediction is sooner or later we'll see execveat2, to permit setting /proc/PID/comm when using execveat [0]. I doubt we'll ever see clone4, because clone3 is passed a structure argument with the structure size, so new fields can be supported just by increasing the structure size. If other syscalls had done that from the start, much of the 2/3/etc would have been avoided. It is actually a very common practice on Windows (since NT), it has only much more recently been adopted in the Linux kernel [0] see https://uapi-group.org/kernel-features/ https://uapi-group.org/kernel-features/
- phaedrus 2y ago
  I work on a team that supports some equipment related to airplanes. An acronym for one piece of equipment that is decades old is "RCSU". When I got a support call talking about "RSCU", I assumed the person meant "RCSU". Nope. It turns out, when they made their next-generation piece of equipment, the vendor differentiated it by swapping the inner two letters in an already easy-to-say-wrong acronym. My reaction was, "WTF didn't they just call it the RCSU2?!"
Just_Harry 2y ago
My favourite is MapViewOfFile3FromApp [0], which is one of the seven variants of MapViewOfFile. [0]: https://learn.microsoft.com/windows/win32/api/memoryapi/nf-memoryapi-mapviewoffile3fromapp https://learn.microsoft.com/windows/win32/api/memoryapi/nf-m...

orthoxerox 2y ago

IsWow64Process2ForRealThisTime

ale42 2y ago

wonder why they didn't call it IsWow64ProcessEx

layer8 2y ago
The vague convention, as far as I understand, is that Ex denotes an extended variant of a function for more advanced use cases (e.g. with additional parameters/options) which is functionally a superset of the original function, whereas numbered versions are intended to be complete replacements and/or may change the semantics compared to the prior version.
- throwaway2037 2y ago
  I agree. Examples: CreateWindowW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindoww https://learn.microsoft.com/en-us/windows/win32/api/winuser/... CreateWindowExW -> https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-createwindowexw https://learn.microsoft.com/en-us/windows/win32/api/winuser/...