XeNTaX

Riley Pizt wrote:I disagree. For example, many programs which would otherwise run on Windows 9X will not simply because the developer chose to use "GlobalMemoryStatusEx" instead of "GlobalMemoryStatus". Hooking Kernel32.dll on Windows 9X systems to handle the slight differences between these two functions would seem trivial.

SEEM trivial, and ARE trivial, are 2 different things though. Not only do you have to write the functions that are missing, you have to "fool" the calling programs into thinking its an NT version. Which developers use GetVersion/GetVersionEx and some even use the DLL version numbers, which can be messy, cuz you don't know what dll its getting a version from. It may even make calls to NTDLL.DLL, in which case, you have to recreate that DLL, which isn't on non NT kernels. Like I said, It would be work than its worth.

Riley Pizt wrote:True, but how do you write a DLL to pass all function calls that you don't want to modify (or possibly don't even know exist since some functions in Windows DLL's like Kernel32.dll are undocumented) to the real DLL when you don't have the source code to the original DLL?

(example is in Delphi, but you can do it in C++ too)
1) Use a program, such as "depends.exe". This will list ALL exported functions the DLL provides.

2) Get the address for the function (for sample purposes, i'll use CreateFileA)

var CFAPointer: Pointer;

CFAPointer := GetProcAddress(OriginalKernel32Handle, "CreateFileA");

3) Make a function (remember you don't know the calling convention or whats passed it or EVEN what it returns)

procedure CreateFileA();
asm
JMP CFAPointer
end;

4) Export Your New function.

This is exact how an import table USUALLY is

Program calls into the Import Table, the import table JUMPs to the real function.

Riley Pizt wrote:

Then again, there are alright projects out there that does this for you.

Such as?

Wine is one of them. Which is a cross platform emulation of the system dlls.

Use the toll DLL to LIB. Forget NT =)

Rahly wrote:Which developers use GetVersion/GetVersionEx and some even use the DLL version numbers, which can be messy, cuz you don't know what dll its getting a version from. It may even make calls to NTDLL.DLL, in which case, you have to recreate that DLL, which isn't on non NT kernels. Like I said, It would be work than its worth.

It would depend on how many missing functions the program uses. Right now Kernel32.dll functions seem to be the only thing standing in the way of the couple of programs I have in mind.

Wine is one of them. Which is a cross platform emulation of the system dlls.

Thanks, I'll take a look at it.

Riley Pizt wrote:It would depend on how many missing functions the program uses. Right now Kernel32.dll functions seem to be the only thing standing in the way of the couple of programs I have in mind.

Unfortunately, there is no 100% way to find every function a program uses, except to execute the program for 100% of its worth. I've seen some CRAZY programming too, anything from LoadLibrary'ing everything instead of static importing to Loading the library themselves to calling the RING 0 functions themselves.

Anonymous wrote:Unfortunately, there is no 100% way to find every function a program uses, except to execute the program for 100% of its worth.

I agree, but that comment was based upon following the error messages displayed.