Windows 10 Compatibility for Windows XP/2003 (WIP) - extras for NTDLL.DLL

ntdll-extras

Purpose

Implementation of some NTDLL.DLL functions, available in Windows versions released after Windows XP/2003, to get software to that is compatible with Windows 2003R2/Vista/2008/2008R2/7/8/8.1/2016/10/2019 to run in Windows XP/2003, where the latest status can be seen in the table under Status & History.

You're welcome to contribute to speed this process up.

Status & History

The current implementation of C code compiles and links fine with the existing NTDLL.DLL code, but is a work in progress.

This is not intended to be a secure implementation for now, just intended to provide compatibility. Some functions are being tested now, more information here Wine-on-Windows

New files implementing functions start with an _. Missing functions in applications can be found out by loading the executable into Dependency Walker (depends.exe). This code can be used to to further with this test harness.

Needs help as they are many functions to be back-ported!

Function Status Functionality Last updated
RtlRunOnceExecuteOnce Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/02
RtlRunOnceComplete Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/02
RtlInitializeConditionVariable Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlWakeByAddressAll Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlWakeAllConditionVariable Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlWakeConditionVariable Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlInitializeSRWLock Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlAcquireSRWLockExclusive Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlAcquireSRWLockShared Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlTryAcquireSRWLockExclusive Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlReleaseSRWLockExclusive Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlReleaseSRWLockShared Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
RtlInitializeCriticalSectionEx Implemented Wine - untested - redirected from KERNEL32.DLL 2020/12/01
EtwEventRegister Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
EtwEventUnregister Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
EtwEventWrite Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
EtwEventWriteTransfer Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
EtwEventWriteEx Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
EtwEventSetInformation Implemented stub returning ERROR_SUCCESS should use EVENTLOG.DLL - redirected from ADVAPI32.DLL 2020/11/30
DecodePointer Tested redirected from KERNEL32.DLL, see kernel32-obfuscated-pointers 2020/11/28
EncodePointer Tested redirected from KERNEL32.DLL, see kernel32-obfuscated-pointers 2020/11/28

Requirements

  1. A x86 version of Windows 2003 / XP SP1 with source code available: see build-win2k3
  2. Disable Windows File Protection when DLL's replacing after installation, see https://www.technipages.com/enable-disable-wfp
  3. Ability to execute executables built for newer versions than Windows XP SP2 / Windows Server 2003 RTM (NT 5.2): https://rentry.co/kernel32-version-unlock

Changes

Changes only happen in \base\ntdll

  1. Place _*.c & _*.h files from the <date>__NTDLL.DLL.zip archive, see Download below
  2. (Included in the patched files) In \base\ntdll\ntdlldef.src: add these two lines
    EtwEventRegister
    EtwEventUnregister
    EtwEventWrite
    EtwEventWriteTransfer
    EtwEventWriteEx
    EtwEventSetInformation
    RtlInitializeConditionVariable
    RtlWakeByAddressAll
    RtlWakeAllConditionVariable
    RtlWakeConditionVariable
    RtlInitializeSRWLock
    RtlAcquireSRWLockExclusive
    RtlAcquireSRWLockShared
    RtlTryAcquireSRWLockExclusive
    RtlReleaseSRWLockExclusive
    RtlReleaseSRWLockShared
    RtlInitializeCriticalSectionEx
    RtlRunOnceExecuteOnce
    RtlRunOnceComplete
    
  3. (Included in the patched files) In \base\ntdll\daytona\sources & \base\ntdll\wow6432\sources add to SOURCES macro:
    1
    2
    3
    ..\_obfuscated_pointers.c \
    ..\_synchapi.c \
    ..\_eventlog.c \
    
  4. Run bcz in \base\ntdll
  5. Overwrite the created \base\ntdll\daytona\obj\i386\NTDLL.DLL in the C:\WINDOWS\SYSTEM32 folder of your Windows XP installation.

Download implementations

Date Filename Link
2020/12/02 20201202__NTDLL.DLL.v2.zip https://gofile.io/d/DH9dZL
Edit
Pub: 28 Nov 2020 19:28 UTC
Edit: 06 Jan 2021 09:57 UTC
Views: 730