[vs2099]

Hi,
Everyone knows that if a process call kernel32!GetThreadContext, it will through nt!NtGetContextThread.
But I found that if wow64 process call kernel32!GetThreadContext, it will not through nt!NtGetContextThread.
I use BP(WINDBG) even KERNEL INLINE HOOK and try to catch something, but I failed.
It only can catch the call of native (64-bit) process.
Who can tell me the reason.

Best regards,
VS2099.

[Brock]

If you disasm kernel32!GetThreadContext it does call ntdll!NtGetContextThread which in turn will call into fs:[0xC0] (wow64cpu!X86SwitchTo64BitMode). It's handled by the WOW layer before the native system call is issued

[myid]

bp PspGetContextThreadInternal
Maybe this is the answer. :D