Why copying to system32 automatically copies to sysWOW64 instead?

Question

I\'m trying to copy a file to C:\\windows\\system32 by calling CopyFileA - debugging shows that indeed the string \"C:\\windows\\system32\\filename\" is sent to CopyFileA, b

Answer 1

this solution seems better for me: credit to Bevan Collins.

BOOL changeWow64Redirection(PVOID& param, BOOL toDisable = true)
{
#ifdef WIN64
  UNREFERENCED_PARAMETER(OldValue);
  return TRUE;
#else
  typedef BOOL (WINAPI * LPWOW64CHANGEWOW64FSREDIRECTION)(PVOID *);
  LPWOW64CHANGEWOW64FSREDIRECTION     fnWow64ChangeWow64FsRedirection;
  HMODULE                             kernelMod;
  BOOL                                success = FALSE;
  kernelMod = GetModuleHandle(_T("kernel32"));
  if (kernelMod)
  {
    if (toDisable)
      fnWow64ChangeWow64FsRedirection = (LPWOW64CHANGEWOW64FSREDIRECTION)GetProcAddress(kernelMod, "Wow64DisableWow64FsRedirection");
    else
      fnWow64ChangeWow64FsRedirection = (LPWOW64CHANGEWOW64FSREDIRECTION)GetProcAddress(kernelMod, "Wow64RevertWow64FsRedirection");
    if (fnWow64ChangeWow64FsRedirection)
      success = fnWow64ChangeWow64FsRedirection(¶m);
  }
  return success;
#endif //WIN64
}