locked
Accessing files from System32 directory using 32 bit application on 64 bit machine

    Question

  • Hi,
    I am trying to access few files from C:\Windows\System32\Winevt on Windows 7 - 64 bit machine through .net application.

    When I build my application in 32 bit , I am not able to access this Winevt directory. It complians about directory not found.
    But If I build my application in 64 bit mode, I am able to access this directory without any problem.

    Do I have to do anything special to access this directory using 32 bit application on 64 bit machine?


    Friday, January 08, 2010 3:20 PM

Answers

  •  

    Hi,

    As you seen, on a computer that is running a 64-bit version of Windows Server 2003 or of Windows XP, a 32-bit application cannot access the following folder: %WinDir%\System32


    This behavior occurs because Windows on Windows 64-bit (WOW64) provides file system redirection.
    In a 64-bit version of Windows Server 2003 or of Windows XP, the %WinDir%\System32 folder is reserved for 64-bit applications. When a 32-bit application tries to access the System32 folder, access is redirected to the following folder:

        %WinDir%\SysWOW64

    By default, file system redirection is enabled.


    As a walk-around solution,
    32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access.

    So, if we want to access C:\Windows\System32\Winevt folder from 32-bit application, we can use C:\Windows\Sysnative\Winevt instead.

     

    See also:

    This link provides a hot fix for this issue.

    This link discussed more about File System Redirector.


    Sincerely,
    Eric

    Please remember to mark helpful replies as answers.
    • Marked as answer by BabiDesai Monday, January 11, 2010 4:27 PM
    Monday, January 11, 2010 2:49 AM
  • Hello BabiDesai,

    This is called SysWOW64 File System redirection.

    When we run 32 bit application in 64 machine, 32 bit application cannot use all 64bit system dlls and components. So we put 32bit system dlls and components in another folder C:\Windows\SysWOW64. So in 32 bit application, if we want to access files in C:\Windows\System32, it is redirected to C:\Windows\SysWOW32. The error we saw is complaining that there is no Winevt subfolder that SysWOW32.

    So the solution is, if we want to support 32 bit application. We should also create Winevt folder and files under SysWOW32 to be used.

    You can find more information from the KB article,
    http://support.microsoft.com/default.aspx/kb/896456


    Best regards,
    Ji Zhou
    MSDN Subscriber Support in Forum
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    • Marked as answer by BabiDesai Monday, January 11, 2010 4:28 PM
    Monday, January 11, 2010 2:37 AM

All replies

  • Hello BabiDesai,

    This is called SysWOW64 File System redirection.

    When we run 32 bit application in 64 machine, 32 bit application cannot use all 64bit system dlls and components. So we put 32bit system dlls and components in another folder C:\Windows\SysWOW64. So in 32 bit application, if we want to access files in C:\Windows\System32, it is redirected to C:\Windows\SysWOW32. The error we saw is complaining that there is no Winevt subfolder that SysWOW32.

    So the solution is, if we want to support 32 bit application. We should also create Winevt folder and files under SysWOW32 to be used.

    You can find more information from the KB article,
    http://support.microsoft.com/default.aspx/kb/896456


    Best regards,
    Ji Zhou
    MSDN Subscriber Support in Forum
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.
    • Marked as answer by BabiDesai Monday, January 11, 2010 4:28 PM
    Monday, January 11, 2010 2:37 AM
  •  

    Hi,

    As you seen, on a computer that is running a 64-bit version of Windows Server 2003 or of Windows XP, a 32-bit application cannot access the following folder: %WinDir%\System32


    This behavior occurs because Windows on Windows 64-bit (WOW64) provides file system redirection.
    In a 64-bit version of Windows Server 2003 or of Windows XP, the %WinDir%\System32 folder is reserved for 64-bit applications. When a 32-bit application tries to access the System32 folder, access is redirected to the following folder:

        %WinDir%\SysWOW64

    By default, file system redirection is enabled.


    As a walk-around solution,
    32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access.

    So, if we want to access C:\Windows\System32\Winevt folder from 32-bit application, we can use C:\Windows\Sysnative\Winevt instead.

     

    See also:

    This link provides a hot fix for this issue.

    This link discussed more about File System Redirector.


    Sincerely,
    Eric

    Please remember to mark helpful replies as answers.
    • Marked as answer by BabiDesai Monday, January 11, 2010 4:27 PM
    Monday, January 11, 2010 2:49 AM
  • Hi,

    Thanks you for the replay. I have an other issue around this situation.

    My application suport 32 and 64 bit version. 

    Consider thwe following case:

    1. Install 32 bit version of application on 64 bit machine.

    2. Read the event log registry key. at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application

    3. Read File value. It appears as %SystemRoot%\system32\winevt\Logs\Application.evtx

    Now If I am runnig as 32 bit process. I won't be able to access this directory and I won't be able get the copy of the application event log file.

    In this case I have to add a explicit code that states  if I am runnig as 32 bit process on 64 bit machine then replace system32 with sysnative. This doesn't seem clean approach.

    Any other betetr solution to acheive this?

    I can move the event log to C:\test\Application.evtx but I am nto sure if this is the right way to do.

     

    Please help

     

    Friday, June 11, 2010 6:32 PM
  • Hi BaiDesai,

    As specified this is called folder redirection.

    So implement a logic to identify the architecture of the machine.

    If it is 64 bit it should access,

    you check in c:\windows\Sysnative\Winevt

    else

    check in c:\windows\system32\Winevt

    End if.

    It should work. Sysnative is an alias for system32 in 64 bit machines which 32 bit apps can look.


    Sai.

    Friday, December 07, 2012 7:43 PM
  • It was actually an atrociously terrible design decision (vs. a NEW directory named something like System64).  New apps could have used it by design, no 32 bit app would require changing, and for 64 bit apps it could have been put PRIOR to 32-bit version on the path.

    BUT this design mistake goes far beyond accessing merely running EXEs and DLLs, since INFORMATION is also stored in these locations.  The first to come to mind are:

            %SystemRoot%\System32\drivers\etc            -- which is ONLY accessible from 64-bit editors etc.

            %SystemRoot%\WindowsPowerShell\v1.0      -- which exists in both locations separately (multiple places to keep up to date)

    There are certainly more such problems.

    --

    HerbM



    • Edited by HerbMartin Sunday, December 30, 2012 4:07 PM
    Sunday, December 30, 2012 4:06 PM