Question

Looking at Microsoft’s page on Wow64DisableWow64FsRedirection, I see some C code. What if you want to call this function and it’s revert from VB.net?

So far I have done this:

 <Runtime.InteropServices.DllImport("KERNEL32.DLL",  EntryPoint:="Wow64DisableWow64FsRedirection")> _
Public Shared Function DisableWow64Redirection() As Boolean
End Function

And I do likewise for the Revert brother function.

I call it like so:

DisableWow64Redirection()

This seems to work, as the shell command I call after actually finds its exe in system32, but I am not sure about the Revert, does it need a parameter? This Revert page seems to want me to take the output from disable and plug it into the revert call. Does that sound right? How do I change my DLLimport to take in a boolean and actually use it in the Kernal32.DLL function?

Thanks!

Answer 1

You could change your function definition to

<DllImport("kernel32.dll", EntryPoint := "Wow64DisableWow64FsRedirection")> _
Public Shared Function DisableWow64Redirection(ByRef output As IntPtr) As Boolean

and define Revert() like so:

<DllImport("kernel32.dll", EntryPoint := "Wow64RevertWow64FsRedirection")> _
Public Shared Function RevertWow64Redirection(ByRef handle As IntPtr) As Boolean

You’d invoke these like so:

Dim handle As IntPtr
DisableWow64Redirection(handle)
RevertWow64Redirection(handle)

I’m not a VB.NET guy, so maybe some syntax is incorrect – the important thing is that you provide a reference parameter of IntPtr type, which maps to the PVOID native type. You’ll want to hang on to it, and pass the same value to Revert().