> In order to be able to run 32bit binaries on a 64bit windows version, there has to be an extra layer between usermode and kernelmode. This is because a 64bit kernel expects 64bit pointers as parameter, whereas the 32bit application provides 32bit pointers.
This brings us to segments, on WOW64 there are two code segments, the code from our 32bit binary will run in segment 0×23, which tells the CPU to emulate a 32bit CPU. However, when a syscall is made, the CPU has to switch to segment 0×33, which makes the CPU use the 64bit instruction set.