I'm trying to debug Control Panel and I'd like to disassemble shell32.dll. Because control panel is a 64-bit executable, it loads the 64-bit version of the dll (contrary to the name). When I view the disassembled code in debug mode, I can confirm that it is indeed 64-bit. Ida claims that it's located at C:\WINDOWS\system32\shell32.dll; however this dll is entirely 32-bit. I also checked C:\WINDOWS\SysWOW64\shell32.dll, but it's also 32-bit.Can someone explain what's going on here?Thanks!
Where can I find the 64-bit version of shell32.dll on Windows?
windows;dll
What you are seeing is the result of WoW file-system redirection.  The effect occurs when a 32-bit executable requests a copy of a file in the Windows directory.  Since a 64-bit result would probably make no sense to a 32-bit executable, you get the 32-bit copy instead.If you use Explorer to copy the file from the system32 directory, and then examine the result, you will find that it is a 64-bit executable.