title: Trapping HANDLE creation in WOW64
body: <p>I'm trying to troubleshoot slow startup of a third-party binary (no source).  It is a 32-bit application running on 64-bit Windows 7.</p>
  
  <p>I've used a debugger to break into the application while it's hung with 0% CPU usage during startup, and it appears to be waiting for <code>ReadFile</code> to return.  The first argument to <code>ReadFile</code> is the handle value, 000000f0.  windbg's <code>!handle</code> command tells me:</p>
  
  <blockquote>
  <pre><code>Handle f0
    Type            File
    Attributes      0
    GrantedAccess   0x120189:
           ReadControl,Synch
           Read/List,ReadEA,ReadAttr,WriteAttr
    HandleCount     2
    PointerCount    4
    No Object Specific Information available
  </code></pre>
  </blockquote>
  
  <p>I want to know what device this corresponds to.  But Sysinternals Process Explorer doesn't include this handle in its list of process handles.</p>
  
  <p>I've used windbg to trace all calls to <code>ntdll!NtCreateFile</code> and printed the path and returned handle: This handle is not among them.  Breakpoints on <code>kernel32!CreateNamedPipeW</code>, <code>kernel32!CallNamedPipeW</code>, and <code>kernel32!WaitNamedPipeW</code> are never triggered (which is odd because Process Explorer did show another handle with path <code>\Device\NamedPipe\</code>).</p>
  
  <p>For reference, here is the command to trace <code>NtCreateFile</code> (akak <code>ZwCreateFile</code>) on Windows x64:</p>
  
  <pre><code>bp ntdll!NtCreateFile "!ustr poi(@r8+10) ; r $t0 = @rcx ; gu ; dd @$t0 L1 ; gc"
  </code></pre>
  
  <p><a href="http://www.nynaeve.net/?p=144">Thanks to Skywing for pointing me in the right direction on that</a>.</p>
  
  <p>Where else can a HANDLE of type <code>File</code> come from?  Don't the other HANDLE creation functions delegate to <code>NtCreateFile</code> for the actual syscall (I guess not)?</p>