From 43f3274be21c84be815b99d22888206ead581dc2 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Fri, 18 Dec 2009 10:55:51 +0000
Subject: [PATCH] dump: added WOW64 module information

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2456 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 1.x/trunk/ProcessHacker/Program/Dump.cs | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/1.x/trunk/ProcessHacker/Program/Dump.cs b/1.x/trunk/ProcessHacker/Program/Dump.cs
index ebf2b467a..5962b8847 100644
--- a/1.x/trunk/ProcessHacker/Program/Dump.cs
+++ b/1.x/trunk/ProcessHacker/Program/Dump.cs
@@ -488,8 +488,13 @@ namespace ProcessHacker
             {
                 if (pid != 4)
                 {
+                    bool isWow64 = false;
+
                     using (var phandle = new ProcessHandle(pid, Program.MinProcessQueryRights | ProcessAccess.VmRead))
                     {
+                        if (OSVersion.Architecture == OSArch.Amd64)
+                            isWow64 = phandle.IsWow64();
+
                         phandle.EnumModules((module) =>
                             {
                                 DumpProcessModule(modules, module);
@@ -516,6 +521,25 @@ namespace ProcessHacker
                                 return true;
                             });
                     }
+
+                    if (isWow64)
+                    {
+                        try
+                        {
+                            using (var buffer = new ProcessHacker.Native.Debugging.DebugBuffer())
+                            {
+                                buffer.Query(pid, RtlQueryProcessDebugFlags.Modules32);
+
+                                buffer.EnumModules((module) =>
+                                    {
+                                        DumpProcessModule(modules, module);
+                                        return true;
+                                    });
+                            }
+                        }
+                        catch
+                        { }
+                    }
                 }
                 else
                 {