I need to determine what architecture a process (not my own) is. With IsWow64Process2 I can get the process architecture and the native architecture. The documentation says of pProcessMachine:
The value will be IMAGE_FILE_MACHINE_UNKNOWN if the target process is not a WOW64 process; otherwise, it will identify the type of WoW process.
So my code checks
if (usProcessMachine == IMAGE_FILE_MACHINE_UNKNOWN)
usProcessMachine = usNativeMachine;
This all works great on i686, x86_64, and released ARM64 versions of Windows with i686, x86_64, ARM32, and ARM64 processes.
BUT, on the ARM64 Insider Preview version, which supports x86_64 processes via emulation, IsWow64Process2 returns pProcessMachine = IMAGE_FILE_MACHINE_UNKNOWN, pNativeMachine = IMAGE_FILE_MACHINE_ARM64, just like it does for ARM64 processes. How can I tell the difference between an ARM64 process and and x86_64 process on ARM64 Windows?