Win32 32-bit process loads 64-bit kernel32.dll

Question

I am experiencing that 32-bit Win32 console applications are loading the 64-bit version of kernel32.dll on one specific machine which is running Windows Server 2012 R2 Standard.

Using Dependency Walker with a simple HelloWorld application it looks like this:

It correctly loads the 32-bit kernel32 on other machines.

The value of PATH seems to be if not identical so at least including the relevant paths in exactly the same order on the different machines.

According to this page from Microsoft, the search order for DLLs is:

The directory where the executable module for the current process is located.
The current directory.
The Windows system directory. The GetSystemDirectory function retrieves the path of this directory.
The Windows directory. The GetWindowsDirectory function retrieves the path of this directory.
The directories listed in the PATH environment variable.

I am guessing that on this specific machine GetSystemDirectory returns the path to Windows/system32 instead of Windows/SysWOW64 or that the mapping from system32 to SysWOW64 for 32-bit processes are not working properly but these are only qualified guesses.

Any idea what is causing this behaviour?

this is only mistake of Dependency Walker - nothing more. and 32bit app never load 64 bit version of kernel32.dll by static import. and paths/ GetSystemDirectory - not related here at all, because always exist \KnownDlls32\kernel32.dll section. it will be used — RbMm
The last time Dependency Walker worked somewhat reliably was on Windows Vista. Be prepared to see confusing/misleading information out of Dependency Walker on any OS starting with Windows 7. A better way to diagnose DLL issues is to enable loader snaps. — IInspectable

David Heffernan David Heffernan · Accepted Answer · 2017-12-15T09:56:11

Dependency Walker is reporting the dependencies incorrectly. Its static analysis sometimes gets confused between 32 and 64 bit modules. Typically this is when you run a 64 bit version of Dependency Walker against a 32 bit target executable, or vice versa.

Rest assured that your 32 bit program is loading the 32 bit version of kernel32.

Win32 32-bit process loads 64-bit kernel32.dll

1 Answers