Why are 32-bit processes started under 64-bit processes in Windows?

Question

When I run a 32-bit program in Windows 7 64-bit often times a 64-bit process is started with a 32-bit process underneath it. For instance, if I start iexplorer.exe (Internet Explorer) from C:\Program Files (x86)\Internet Explorer it starts a 64-bit process with a 32-bit process underneath it.

This can be seen in Process Explorer as well as Task Manager.

Why is this? What's going on here? Also, if I go to C:\Program Files\Internet Explorer and start iexplorer.exe from there, again, both a 64-bit and a 32-bit process is started. The executable in this folder is supposed to start a 64-bit version of the program.

Solution 1

Internet Explorer (starting with version 7 on Windows Vista), as well as Chrome, and Firefox, use separate processes for each tab. Internet Explorer termed this "Protected Mode".

You have your main browser process, that handles the main frame UI, as well as all network and disk access. Each tab is then run in a separate Low Integrity Level process (which you can see in Process Explorer).

• iexplore.exe (Medium Mandatory Integrity Level)
  • iexplore.exe (Low Mandatatory Integrity Level)
  • iexplore.exe (Low Mandatatory Integrity Level)
  • iexplore.exe (Low Mandatatory Integrity Level)

Processes marked with Low integrity level are very limited in what they can do.

That is why you see multiple processes of iexplore, chrome, and firefox.

Solution 2

If the 64bit application needs (or thinks it may need) to interface with 32bit applications, modules, or processes, it'll spawn a 32bit process to manage that interaction.

In the case of IE, as was mentioned in @and31415's comment, it needs to interact with add-ons (such as Flash, ActiveX etc.) as well as other applications that may be needed, based upon the content you browse).

Comments

[and31415]

That's by design to ensure 32-bit add-ons (e.g. Browser Helper Objects (BHOs), toolbars, and ActiveX controls) work as expected. The main manager process always matches the operating system bitness, but tabs can be either 32-bit or 64-bit processes. If you want IE to be fully 64-bit you can enable the Enhanced Protected Mode.