I came accross a code snippet which detects whether app is running in x32 emulated environment on x64 PC here
Generally I understand that code but there is one thing I don’t get:
1) typedef BOOL (WINAPI *LPFN_ISWOW64PROCESS) (HANDLE, PBOOL);
Why does WINAPI have to be there? Why is it so important to know that pointer doesn’t point to my-defined function but to WINAPI one? Would these 2 pointers be different? (in way of size, place they are created etc.)
Thanks,
Kra
WINAPI expands to __stdcall (in most cases — you shouldn’t rely on that calling convention specifically), which is a different calling convention than the default, __cdecl. The difference is that in __stdcall, the function called cleans the stack, while in __cdecl, the caller cleans the stack. __stdcall does not support varadic (Variable argument length) functions like __cdecl does, but __stdcall can be faster and reduce code size in some cases.