diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 0873442..66999a5 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -106,12 +106,19 @@ class Process(utils.AutoHandle): # Syswow2 will exactly tell us the architecture if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2): process_machine, native_machine = self.is_wow_64_2 - try: - return utils.image_file_machine_to_processor_architecture(process_machine) - except KeyError as e: - raise ValueError("Unknown IsWow64Process2(process_machine:#x) -> {0}".format(process_machine)) + if process_machine != gdef.PROCESSOR_ARCHITECTURE_UNKNOWN: + try: + return utils.image_file_machine_to_processor_architecture(process_machine) + except KeyError as e: + raise ValueError("Unknown IsWow64Process2(process_machine:#x) -> {0}".format(process_machine)) - # No IsWow64Process2 -> No ARM64 + if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64: + # May be ARM64 or AMD64 as X64TA64 is not considered WOW64 + machine_archi = gdef.PROCESS_MACHINE_INFORMATION() + windows.winproxy.GetProcessInformation(self.handle, gdef.ProcessMachineTypeInfo, machine_archi) + return utils.image_file_machine_to_processor_architecture(machine_archi.ProcessMachine) + + # No IsWow64Process2 -> No ARM # So its up on x86 -> x64 based on process bitness if self.bitness == 32: return gdef.PROCESSOR_ARCHITECTURE_INTEL