Function (Procedure Entry Point) replacement list

Have a method to get an application work on an older unsupported Windows version? Post it here.
User avatar
Lazy Owner
Posts: 759
Joined: 11 Jan 2021, 07:40
OS: Windows 8.1 x64
Has thanked: 385 times
Been thanked: 178 times
United States of America

Function (Procedure Entry Point) replacement list

Unread post by K4sum1 »

If you've ever encountered "The procedure entry point x could not be located in the dynamic link library y", it could be possible to swap the missing function/procedure entry point with one that exists to make the application run.

To replace a function, you need CFF Explorer.
It will be faster to use Dependency Walker to figure out what all is missing instead of going one by one.
Open the application in CFF Explorer and click Import Directory.
Find the dll the error is from.
Find the function you want to replace.
Double click its name and replace it with the new function.
(Optional) Go to Rebuilder, untick Update PE Header and tick Update Checksum, then rebuild. (Required for drivers)

The list:

Multiple dlls:
  • anything2 (IsWow64Process2 for example) can have the 2 removed and likely work
    (Anywhere from 10+ to XP and maybe earlier compatibility)
  • Most anythingEx functions have alternatives, can be as simple as removing the Ex or as complex as K32GetModuleFileNameExA > GetModuleFileNameA.
    (Anywhere from 10+ to XP and maybe earlier compatibility)
  • CredReadA/CredWriteA > CredFree
    (XP+ -> 2000 (extended kernel) compatibility)
  • CM_Register_Notification > CMP_RegisterNotification
    (8+ -> XP compatibility)
  • K32EnumProcessModules > GetProcAddress
    (7+ -> XP compatibility)
  • K32GetModuleFileNameExA > GetModuleFileNameA
    (7+ -> XP compatibility)
  • LoadPackagedLibrary > LoadLibraryExW
    (8+ -> XP compatibility)
  • NdisSetCoalescableTimerObject > NdisSetTimerObject
    (7+ -> Vista (RTM) compatibility)
  • NtReleaseKeyedEvent > NtReleaseSemaphore
    (XP+ -> 2000 (extended kernel) compatibility)
  • NtWaitForKeyedEvent > NtWaitHighEventPair
    (XP+ -> 2000 (extended kernel) compatibility)
  • anything_s (memcpy_s for example) can have the _s removed and likely work
    (7+(?) -> XP compatibility(?))
  • KeQueryLogicalProcessorRelationship > KeQueryMaximumProcessorCount
    (7+ -> Vista compatibility)
  • strnlen > strlen
    (7+ -> XP compatibility(?))
  • PowerDeterminePlatformRoleEx > PowerDeterminePlatformRole
    (8+ -> Vista compatibility)
This list is nowhere near complete and there are many other functions that could be added. If you know or find any, please let me know and I will add them.
R3n who?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests