Long description

The figure consists of three vertical blocks and one horizontal block, First block is labeled native process that contains three sub blocks which are labeled native application, native app, OS DLLs, and native Ntdll.dll. The second block is labeled Arm 32 process that contains six sub blocks which are labeled 32 bit application, 32 bit app, and OS DLLs, 32 bit Ntdll.dll, CPU emulation layer, which is shaded, WoW64 Abstraction layer, and Native Ntdll.dll. Shaded areas indicate emulated code. The third block is labeled x86 process that contains eight sub blocks which are labeled 32 bit application, 32 bit app and OS DLLs, CHPE Ntdll.dll, CPU emulation layer, CHPE DLLs, jitted code, and Native Ntdll.dll. The horizontal block is labeled windows kernel and drives.