Windows 10 Compatibility for Windows XP/2003 (WIP) - extras for ADVAPI32.DLL#



Implementation of some ADVAPI32.DLL functions, available in Windows versions released after Windows XP/2003, to get software to that is compatible with Windows 2003R2/Vista/2008/2008R2/7/8/8.1/2016/10/2019 to run in Windows XP/2003, where the latest status can be seen in the table under Status & History.

You're welcome to contribute to speed this process up.

Status & History#

The current implementation of C code compiles and links fine with the existing ADVAPI32.DLL code, but is a work in progress.

This is not intended to be a secure implementation for now, just intended to provide compatibility. Some functions are being tested now, more information here Wine-on-Windows

New files implementing functions start with an _. Missing functions in applications can be found out by loading the executable into Dependency Walker (depends.exe). This code can be used to to further with this test harness.

Needs help as they are many functions to be back-ported!

Function Status Functionality Last updated
EventRegister Implemented redirected to NTDLL.DLL 2020/11/30
EventUnregister Implemented redirected to NTDLL.DLL 2020/11/30
EventWrite Implemented redirected to NTDLL.DLL 2020/11/30
EventWriteTransfer Implemented redirected to NTDLL.DLL 2020/11/30
EventWriteEx Implemented redirected to NTDLL.DLL 2020/11/30
EventSetInformation Implemented redirected to NTDLL.DLL 2020/11/30


  1. A x86 version of Windows 2003 / XP SP1 with source code available: see build-win2k3
  2. Disable Windows File Protection when DLL's replacing after installation, see
  3. Ability to execute executables built for newer versions than Windows XP SP2 / Windows Server 2003 RTM (NT 5.2):


Changes only happen in \mergedcomponents\advapi32

  1. (Included in the patched files) In \mergedcomponents\advapi32\advapi32.def: add these two lines
    EventRegister = ntdll.EtwEventRegister
    EventUnregister = ntdll.EtwEventUnregister
    EventWrite = ntdll.EtwEventWrite
    EventWriteTransfer = ntdll.EtwEventWriteTransfer
    EventWriteEx = ntdll.EtwEventWriteEx
    EventSetInformation = ntdll.EtwEventSetInformation
  2. Run bcz in \mergedcomponents\advapi32
  3. Overwrite the created \mergedcomponents\advapi32\obj\i386\ADVAPI32.DLL in the C:\WINDOWS\SYSTEM32 folder of your Windows XP installation.
Pub: Nov 30 2020 19:53 UTC
Edit: Dec 04 2020 00:22 UTC
Views: 360