Would it be better for a x64 installer to contain x86 binaries?

[wdhwg001]

In Windows, we have 2 versions of the original notepad.exe: a x64 version in "X:\Windows\notepad.exe" and "X:\Windows\System32\notepad.exe", another x86 version in "X:\Windows\SysWOW64\notepad.exe".

Also, there're two places in registry for Image Hijacking:
x86 version: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe
x64 version: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe

Therefore, in order to make the Image Hijacking perfect, should we bind the x86 notepad.exe to x86 Notepad3, and bind the x64 notepad.exe to a x64 Notepad3?

Installing both versions of Notepad3 is a solution, but in order to sync the settings I need to do some hacks like symbol linking. Will there be an official way to have both versions of Notepad3 installed and bind correctly at once in a single installer?

[RaiKoHoff]

Related issue #1424.

[hpwamr]

Hello @wdhwg001 ,
I always have the latest version of the "Notepad3 Installer" on my Windows 10 PRO x64.

Seriously, I see NO reason to have 2 versions of Notepad3 (x86 and x64) installed on my PC.🤔

[wdhwg001]

Hi @hpwamr ,

Regularly, having only a x64 Notepad3 will not be problematic as we usually only call Notepad3 in Explorer (which is x64, of course).

But things might get weird when we tried to call notepad.exe in a x86 application:

If we have not done the WOW6432Node Image Hijacking, it will start regular SysWOW64\notepad.exe which has poor functionalities.

If we have bound the WOW6432Node Image Hijacking to a x64 Notepad3, then the x64 Notepad3 will launch instead. In this scenario, any x86 process will be unable to inject any x86 DLL into a x64 Notepad3, including the IME mentioned in #1424 .

[hpwamr]

But things might get weird when we tried to call notepad.exe in a x86 application:

But an OS x64, and Explorer x64 run also x86 applications.

From my tests, installing only ONE Notepad3 x86, seems to run in all case, no ? 🤔

For a standalone Notepad3 x86 Installer, please, use this link: Notepad3_5.19.726.2515_x86_Setup

In addition, if you follow the issue #1105 , you will be able to update your x86 installation with the latest version BETA/RC2 x86 (see Notepad3 BETA-channel access #1129 ) . 😉

[wdhwg001]

@hpwamr It's not about Explorer, it's for other compatibility.

Yes, a Explorer x64 can run x86 applications, but if I install only x86 version, and x64 Image Hijack to x86 Notepad3, then any other x64 applications which try to launch notepad.exe and inject an x64 dll into it will simply fail (it will falsely launch x86 Notepad3 which cannot have any x64 dll loaded or injected).

Supporting Explorer is not all of our targets, right?

[blackcrack]

the x64 Binarys have a extension to run directly on a x86_64 CPU, a x86 have this extension not and execute not the x86_64 files, so should the installer be a x86 Executable.. and should see if this mashin exist a x86 only system or a x86_64 with this just enhanced 64bit commands.

We have already in Factorys a 32Bit systems like XP for CAD and other Programms, this can not easy kick out, because these mashins be allready in use.. and as 2nd, Reactos is come and many 32Bit Notebooks exist still on the world's where have not this x86_64 extension so runs on 32Bit only

and it is important to have a good notepad for rewrite text files and rewrite mashinscripts to works further very well.. .. and.. on this place to i say, Reactos is come, if some it want or not ..
because the expensive windows from MS is on short or long to much money.. also the huge code and binarys.. 2,5 or more Gigabyte on systeminstall... (what it is all inside damn! no body can see it and parts not viewable ! ) Reactos is Open Source and up to the Kernel under GPL2 and all can see and compile the whole system ! This makes for the Factory's very interesting , because they can make his own system and can make his own extension, without any cent to pay , more better, the Factory secrets be save.. in any case and be also save over network, because no other factory is involved (also not MS or not need Siemens for the own safety and security inside of the factory..).. if we looking on BMW, Daimler and VW/Audi and so on just a couple to count.

This is the reason why we need already a 32Bit/ x86 notepad3 but also a 64Bit/x86_64 with the _64 Enhancement for more faster mashins with just this extension.
That alone gives a raison d'être for beur different architects (or _64 enhancements or not) !

so:
x86 = 286,386,486,586,686
the 64 bit is a 64-extension for CPU's where works with 64Bit too and not alone in X86/32Bit
and use the double bandwidth inside of the CPU and the code have a 64Bit enhancement,
which meant, work in the double wight mode so instead 32bit with 64bit mode
normally should be write the normal CPU x86_32 bit and with the enhancement x86_64 bit
so :
x86_32 = 286,386,486,586,686
but nobody say x86_32Bit all say only 32Bit with a x86 Architecture

now it is so the old shool can read the young, it meants,
the x86 can run on the x86_64 but, the x86_32 have not the 64 Enhancement,
this is the reason, why the young school not able to run on oldschool ..
because the old shool have the 32bit enhancement only and not the 64Bit

best regards
Blacky

[RaiKoHoff]

Related Information: https://en.wikipedia.org/wiki/WoW64

[wdhwg001]

Updates:

I tried to modified the notepad3_setup.iss, trying to add WOW6432Node registry separately, but failed.

Then I found this document: https://docs.microsoft.com/en-us/windows/win32/winprog64/shared-registry-keys

Unfortunately it seems that Windows does not support Image Hijacking separately for WOW64.

I'll close this issue later.

[blackcrack]

just as hint, i have use this solution in a batch..

:arch

set parch=%PROCESSOR_ARCHITECTURE%
set xparch=%PROCESSOR_ARCHITEW6432%

If "%xparch%"=="AMD64" ( set arch=x64
                    ) else ( If "%parch%"=="x86" ( set arch=x86
                                                     goto :eof
                                                    ) else ( 
                                                    If "%parch%"=="AMD64" ( set arch=x64 
                                                                      ) else (
                                                                       set arch= 
                                                                       goto :eof )
                                                       )
                            )
goto :eof

so if the arch, use this picture, if not.. but therefore do you need an own programmed installer .. ;)

[wdhwg001]

@blackcrack This can be a solution, but the issue is: if we point this batch as the debugger target, then the immediately-closed cmd.exe will be the replaced process when trying to use kernel32!CreateProcess to start notepad.exe, this is also a bit problematic.

[hpwamr]

Hello @wdhwg001 ,
There is now an independent "x86" installer called: Notepad3_5.19.726.2515_x86_Setup. 😃
See the official download place : "Notepad3 - Release Candidate"

In addition, if you follow the issue #1105 , you will be able to update your x86 installation with the latest version BETA/RC2 x86 (see Notepad3 BETA-channel access #1129 ) . 😉

As far as I am concerned, this issue may be closed....

[wdhwg001]

Sorry I forgot to close it, will do now.

This issue was not looking for a x86 Notepad3. It was trying to hijack x86 and x64 original notepad.exe separately to x86 and x64 Notepad3, which is not possible.