Tell if process archtitecture is "ARM64 (x64 compatible)" or "x64" on Windows 11

Question

I'm writing an COM-Addin for PowerPoint and need to find out the exact process architecture of the host.

On Windows 11 for ARM, it's possible to run an old x64 PowerPoint (this is reported in Task Manger as "x64"), or the upcoming 64-Bit Office for Windows on ARM ("ARM64 (x64 compatible)" in Task Manager).

From my plugin I want to distinguish the two.

IsWow64Process2 yields 0 for process machine and IMAGE_FILE_MACHINE_ARM64 ( 0xAA64) for native machine in both cases.

GetProcessInformation with ProcessMachineTypeInfo (as described here) yields IMAGE_FILE_MACHINE_AMD64 ( 0x8664) in both cases.

ImageNTHeader (as described here) also yields IMAGE_FILE_MACHINE_AMD64 ( 0x8664) in both cases.

Yet there must be some way to find out programmatically, the task manager tells them apart in its detail view.

Answer 1

The behavior I see is that GetProcessInformation(ProcessMachineTypeInfo) returns IMAGE_FILE_MACHINE_AMD64 in the AMD64(x64) build of the application and IMAGE_FILE_MACHINE_ARM64 in the ARM64 build. This differs from what is described in the problem description. What Windows 11 build are you running? What behavior do they see after upgrading to the latest Windows 11 build?

Microsoft Windows [Version 10.0.22000.160]
(c) Microsoft Corporation. All rights reserved.

C:\>\davean1\scratch\IsWow64Process2\win32\release\IsWow64Process2.exe
IsWow64Process2 returned
ProcessMachine: IMAGE_FILE_MACHINE_I386 (0x14c)
NativeMachine: IMAGE_FILE_MACHINE_ARM64 (0xaa64).
GetProcessInformation returned
ProcessMachine: IMAGE_FILE_MACHINE_I386 (0x14c)
MachineAttributes: 5 ( UserEnabled Wow64Container )

C:\>\davean1\scratch\IsWow64Process2\x64\release\IsWow64Process2.exe
IsWow64Process2 returned
ProcessMachine: IMAGE_FILE_MACHINE_UNKNOWN (0x0)
NativeMachine: IMAGE_FILE_MACHINE_ARM64 (0xaa64).
GetProcessInformation returned
ProcessMachine: IMAGE_FILE_MACHINE_AMD64 (0x8664)
MachineAttributes: 1 ( UserEnabled )

C:\>\davean1\scratch\IsWow64Process2\arm\release\IsWow64Process2.exe
IsWow64Process2 returned
ProcessMachine: IMAGE_FILE_MACHINE_ARMNT (0x1c4)
NativeMachine: IMAGE_FILE_MACHINE_ARM64 (0xaa64).
GetProcessInformation returned
ProcessMachine: IMAGE_FILE_MACHINE_ARMNT (0x1c4)
MachineAttributes: 5 ( UserEnabled Wow64Container )

C:\>\davean1\scratch\IsWow64Process2\arm64\release\IsWow64Process2.exe
IsWow64Process2 returned
ProcessMachine: IMAGE_FILE_MACHINE_UNKNOWN (0x0)
NativeMachine: IMAGE_FILE_MACHINE_ARM64 (0xaa64).
GetProcessInformation returned
ProcessMachine: IMAGE_FILE_MACHINE_ARM64 (0xaa64)
MachineAttributes: 3 ( UserEnabled KernelEnabled )