Debugging WOW64

Applications running under WOW64 can be debugged two ways:

• Use an x86-hosted debugger such as NTSD, WinDbg, or Visual Studio. The 32-bit NTSD is installed to %systemroot%\syswow64 on retail installations. Note that x86 debuggers can be used to debug x86 code, but cannot be used to disassemble or set breakpoints within the WOW64 thunk layer because it is 64-bit native code.
• Use a native debugger such as CDB, NTSD, or WinDbg and the WOW64 debugger extension, Wow64exts.dll. If the native debugger breaks while the processor is in x86 mode, the debugger presents the process as an x86 process. If the processor is in native mode, the debugger presents the process as native.

CDB, NTSD, and WinDbg are included in Debugging Tools for Windows. For more information, see theDebugging Tools for Windowsdocumentation.

The Wow64exts debugger extension is installed with WinDbg. Use the !load wow64exts command to load the debugger extension. The following table lists the !wow64exts debugger extension commands.

Command Description

!wow64exts.sw	Switches between x86 and native mode.
!wow64exts.kcount	Dumps a combined 32-bit/64-bit stack trace. Ifcountis specified, the command dumps the firstcountaddresses in each stack trace.
!wow64exts.info	Dumps basic information about the PEB of the process, the TEB of the current thread, and thread local storage (TLS) slots used by WOW64.
!wow64exts.raddress	Dumps context for the specified address. Ifaddressis not specified, the command dumps context for the processor.

http://msdn.microsoft.com/en-us/library/windows/desktop/aa384163(v=vs.85).aspx