Wow64EncodeApcRoutine - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers

#ifndef _NTPSAPI_H
//
// Threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Encodes an APC routine pointer for use in a WOW64 environment.
 * 
 * @param ApcRoutine The APC routine pointer to be encoded.
 * @return PVOID The encoded APC routine pointer.
 */
#define Wow64EncodeApcRoutine(ApcRoutine) \
    ((PVOID)((0 - ((LONG_PTR)(ApcRoutine))) << 2))

#endif
#endif
View code on GitHub

This macro encodes the function pointer and indicates to NtQueueApcThread, NtQueueApcThreadEx, or NtQueueApcThreadEx2 that the APC should be executed in the WoW64 mode.

To decode the pointer back, use Wow64DecodeApcRoutine.

See also