WOW64 Architecture in Windows XP x64 Edition

Windows XP Professional x64 Edition introduced the WOW64 (Windows 32-bit on Windows 64-bit) subsystem to allow legacy 32-bit x86 binaries to execute seamlessly alongside native 64-bit code. Rather than relying on performance-heavy software emulation, the operating system leveraged the AMD64 hardware architecture's native compatibility mode combined with an innovative user-mode translation layer. By virtualizing system interfaces, redirecting file and registry access, and managing CPU execution contexts, Windows XP x64 created an isolated, high-performance environment that made 32-bit applications perceive the underlying operating system as a standard 32-bit Windows system.

Hardware-Level Compatibility Mode

The foundational shift enabling WOW64 on Windows XP x64 was the adoption of the AMD64 (x86-64) architecture rather than Intel's IA-64 (Itanium). The AMD64 processor architecture operates in two sub-modes under its primary "Long Mode":

  • 64-Bit Mode: Supports native 64-bit flat linear addressing, extended general-purpose registers (RAX through R15), and wider pointer sizes.
  • Compatibility Mode: Executes existing 16-bit and 32-bit x86 protected-mode code directly at the hardware instruction level.

Because the CPU executes 32-bit instructions natively without binary translation, 32-bit applications run at full hardware speed. WOW64’s primary role was not instruction interpretation, but managing the operating system boundary when these applications made calls to the OS.

The WOW64 User-Mode Translation Layer

WOW64 is implemented entirely in user mode through a set of core dynamic link libraries (DLLs) that sit between a 32-bit application and the 64-bit kernel:

  • Wow64.dll: The core emulation management library that handles execution control, transitions between modes, and the interception of system calls.
  • Wow64win.dll: Provides system call conversion for the Windows GUI subsystem (user32.dll and gdi32.dll).
  • Wow64cpu.dll: Manages the CPU architecture transition, switching the processor context between 32-bit compatibility mode and 64-bit mode.

When a 32-bit process loads, the 64-bit kernel loads these WOW64 DLLs alongside a 32-bit version of ntdll.dll. When the 32-bit application executes an API call, it links to 32-bit user-mode DLLs, which ultimately call the 32-bit ntdll.dll. Instead of sending interrupts or SYSENTER instructions to the kernel, the 32-bit ntdll.dll invokes Wow64cpu.dll.

System Call Thunking and Context Switching

Because the Windows XP x64 kernel (ntoskrnl.exe) only accepts 64-bit pointers and 64-bit data structures, 32-bit system calls cannot pass directly to the kernel. WOW64 resolves this through "thunking":

  1. Interception: Wow64.dll intercepts the 32-bit system service request.
  2. Argument Conversion: 32-bit pointers and structured types are expanded into their 64-bit counterparts.
  3. Mode Switching (Heaven's Gate): Wow64cpu.dll switches the processor code segment selector from 32-bit mode (0x23) to 64-bit mode (0x33).
  4. Invocation: A native 64-bit ntdll.dll call executes the native system call instruction (SYSCALL) into the 64-bit kernel.
  5. Return Conversion: Upon return from the kernel, the 64-bit output parameters are translated back into 32-bit formats, the processor is switched back to 32-bit compatibility mode, and execution resumes in the 32-bit application thread.

File System Redirection

To maintain backward compatibility, legacy applications expect system binaries and drivers to reside in C:\Windows\System32. Windows XP x64 restructured directory mappings using a file system redirector:

  • %SystemRoot%\System32: Reserved strictly for native 64-bit libraries and executables.
  • %SystemRoot%\SysWOW64: Contains the 32-bit system binaries ("Windows-On-Windows 64").
  • C:\Program Files (x86): Dedicated installation path for 32-bit software, distinct from the 64-bit C:\Program Files.

When a 32-bit application requests access to \System32, the WOW64 file system redirector transparently intercepts the I/O request and reroutes it to \SysWOW64. This prevents 32-bit applications from inadvertently loading incompatible 64-bit DLLs.

Registry Redirection and Reflection

The system registry was also split to prevent architecture collisions. Windows XP x64 introduced:

  • Registry Redirection: 32-bit applications writing to or reading from HKEY_LOCAL_MACHINE\Software are automatically redirected to HKEY_LOCAL_MACHINE\Software\Wow6432Node.
  • Registry Reflection: Key components (such as COM registrations and file associations) are mirrored dynamically between the 32-bit and 64-bit registry trees, ensuring interoperability between 32-bit applications and native OS components like the 64-bit Windows Explorer shell.

Virtual Address Space Expansion

In standard 32-bit Windows, the 4 GB virtual address space was split into 2 GB for the application and 2 GB for the kernel (or 3 GB/1 GB using the /3GB switch).

Under WOW64 on Windows XP x64, the kernel resides entirely in 64-bit address space. Consequently, 32-bit applications compiled with the IMAGE_FILE_LARGE_ADDRESS_AWARE flag gain access to a full 4 GB of user-mode virtual memory without requiring kernel memory concessions. Applications without this flag remain restricted to the standard 2 GB address space.