64-Bit Ntdll Has x86 Instruction Set?

Question

I am trying to disassemble the 64-bit ntdll.dll using IDA. From my understand, this DLL is located in C:\Windows\System32 on a Windows 64-bit OS. When I disassemble this DLL, it shows 32-bit addresses and a 32-bit instruction set. However, in the debugger, when I load this library into a process from the same directory, it has a 64-bit instruction set during runtime.

How can I disassemble the 64-bit ntdll?

Answer 1

Please check whether IDA is a 32 bit application in Task Manager (on the Processes page 32 bit processes should have the suffix (32 bit). If you switch to the Details page in Task Manager perform a right click on the column header and choose Select columns from the context menu. Select Platform to display the bit-ness of a process and close the dialog. 32 bit processes are listed as 32 bit in the Platform column.

If IDA is a 32 bit application, use the path c:\windows\sysnative\ntdll.dll to open the DLL. If you specify sysnative instead of System32, Windows uses the SYSTEM32 directory instead of the SysWOW64 for 32 bit apps.