Accessing files from System32 directory using 32 bit application on 64 bit machine

Question

Hi,
I am trying to access few files from C:\Windows\System32\Winevt on Windows 7 - 64 bit machine through .net application.

When I build my application in 32 bit , I am not able to access this Winevt directory. It complians about directory not found.
But If I build my application in 64 bit mode, I am able to access this directory without any problem.

Do I have to do anything special to access this directory using 32 bit application on 64 bit machine?

Answer 1

Hello BabiDesai,

This is called SysWOW64 File System redirection.

When we run 32 bit application in 64 machine, 32 bit application cannot use all 64bit system dlls and components. So we put 32bit system dlls and components in another folder C:\Windows\SysWOW64. So in 32 bit application, if we want to access files in C:\Windows\System32, it is redirected to C:\Windows\SysWOW32. The error we saw is complaining that there is no Winevt subfolder that SysWOW32.

So the solution is, if we want to support 32 bit application. We should also create Winevt folder and files under SysWOW32 to be used.

You can find more information from the KB article,
http://support.microsoft.com/default.aspx/kb/896456


Best regards,
Ji Zhou
MSDN Subscriber Support in Forum

---

Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 2

 

Hi,

As you seen, on a computer that is running a 64-bit version of Windows Server 2003 or of Windows XP, a 32-bit application cannot access the following folder: %WinDir%\System32

This behavior occurs because Windows on Windows 64-bit (WOW64) provides file system redirection.
In a 64-bit version of Windows Server 2003 or of Windows XP, the %WinDir%\System32 folder is reserved for 64-bit applications. When a 32-bit application tries to access the System32 folder, access is redirected to the following folder:

    %WinDir%\SysWOW64

By default, file system redirection is enabled.

As a walk-around solution, 32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access.

So, if we want to access C:\Windows\System32\Winevt folder from 32-bit application, we can use C:\Windows\Sysnative\Winevt instead.

 

See also:

This link provides a hot fix for this issue.

This link discussed more about File System Redirector.

---

Sincerely,
Eric

Please remember to mark helpful replies as answers.

Answer 3

Hi,

Thanks you for the replay. I have an other issue around this situation.

My application suport 32 and 64 bit version. 

Consider thwe following case:

1. Install 32 bit version of application on 64 bit machine.

2. Read the event log registry key. at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application

3. Read File value. It appears as %SystemRoot%\system32\winevt\Logs\Application.evtx

Now If I am runnig as 32 bit process. I won't be able to access this directory and I won't be able get the copy of the application event log file.

In this case I have to add a explicit code that states  if I am runnig as 32 bit process on 64 bit machine then replace system32 with sysnative. This doesn't seem clean approach.

Any other betetr solution to acheive this?

I can move the event log to C:\test\Application.evtx but I am nto sure if this is the right way to do.

 

Please help