Why is the NTOSKRNL.exe IMAGE_MACHINETYPE header field set to x86 on only certain editions of Windows 7 x64?

前端 未结 1 1133
死守一世寂寞
死守一世寂寞 2021-01-12 23:51

I am using windows 7 home premium x64. I was wondering why exactly the IMAGE_MACHINETYPE field in the header of ntoskrnl in my system32 directory specifies x86. IDA will eve

1条回答
  •  猫巷女王i
    2021-01-13 00:46

    My guess is on x64 architecture with a BIOS boot ntoskrnl.exe's main() entry point is called before the switch to long mode (64bit). Thus it would be an x86 application in so far as its entry point, but the remainder of the kernel image in the exe would be 64bit.

    0 讨论(0)
提交回复
热议问题