VS 2008 works to target Windows 2000 out of the box, as you said. You don't need anything extra. If you prefer to use a newer version of the IDE, installing multiple versions of Visual Studio simultaneously (always install the oldest versions first, working "forward" in time) will allow you to, e.g., work in VS 2010 but tell it to build using the VS 2008 toolchain. You obviously won't be able to benefit from compiler features introduced with VS 2010, but you will get to use the newer IDE.
You can use VS 2010 to target Windows 2000 with the EncodePointer/DecodePointer trick. The issue here is that the VS 2010 C runtime library (CRT) requires these functions (it calls them internally), but these functions do not exist on versions of the OS prior to Windows XP SP2. However, if you write stubs and link your executable against those (while also statically linking to the CRT, so it will actually find and use those stubs), then you can run a VS 2010-compiled EXE on Windows 2000. Note that you will also need to set the minimum required version to 5.0 in the linker settings. (You'll get a link-time warning that this is not a valid, supported version when you do so, but you can simply ignore this warning. It does work, and the field does get properly set in the PE header.) This is undoubtedly a dirty trick, but I know that it works very well; I do it in several of my projects. My stubs dynamically call the real EncodePointer/DecodePointer functions if they are available on the current OS, and if not, fall back to basically a no-op (giving up the security benefits on these downlevel OSes). Suma has already covered this trick quite well in an answer to a related question.
The WINVER
and _WIN32_WINNT
defines really don't have anything to do with this. They just control which function prototypes the Windows SDK headers actually define. The idea is that you set these to your target Windows version, and then you will only be able to statically link to functions that actually exist on that version of Windows. You can still dynamically call (via GetModuleHandle/LoadLibrary → GetProcAddress) newer functions when running on an appropriate version of Windows, and gracefully fall back if they are not supported. If you try to statically link to functions that do not exist, the loader will generate an error when you try to run your application. This is easy, though, because this is something that is entirely within your control as a developer. The problem is when the CRT (a library that you don't control) calls functions that don't exist, like EncodePointer. That's why the above-described workaround is required. The values of WINVER
and _WIN32_WINNT
have no actual effect on the compiler or the linker.
You can probably get away with a similar trick for VS 2012. I started working on this a while back with VS 2015 using the built-in XP-targeting support, and I did manage to get a "Hello world" app running on Windows 2000. If anything, it should be easier with VS 2012 than VS 2015. But it was not easy, and it would probably be a support nightmare for any real-world application. Still, it was a fun experiment, and it confirms what everyone already knows: the problem here is not the compiler or the linker. The PE format is still the same; any compiler or linker that targets Win32 can build binaries that run on any version of Windows NT. The problem is just the C runtime library attempting to call functions that do not exist on downlevel operating systems.
The way to go about testing this is to compile an EXE with VS 2012 using the above-described trick for EncodePointer/DecodePointer. You will also, of course, need to make sure that you've set the minimum required version to 5.0 in the linker settings. (If this doesn't work, and it might not, you will need to manually change it as a post-build step using editbin.exe
.) Then, simply try running that executable on Windows 2000. You will undoubtedly get an error message indicating that the application cannot start because of a missing statically-linked function. You'll then need to research that function and stub it out, just as you had to do for EncodePointer/DecodePointer. Chances are, it will be more difficult, because it is probably going to be a function that does meaningful work, which means that you can't simply NOP it out. Once you've fixed the dependency on that function, repeat the process again for each function that the W2K loader complains about. (You can also use Dependency Walker or equivalent utilities to obtain this information.) Once you work through all of the non-existent functions, you'll finally have an EXE that runs.
For VS 2015, I had to write stubs for InitializeSListHead, GetModuleHandleEx, and SystemFunction036 (which is the export name for RtlGenRandom), in addition to EncodePointer and DecodePointer. I expect you'll have a similar experience with VS 2012. Replacing the first two is actually relatively straightforward. For InitializeSListHead, I just reverse-engineered the corresponding functions on Windows XP, and wrote my own implementation for downlevel OS versions. For GetModuleHandleEx, it's only called by the CRT in a context that enables support for managed apps. Since I didn't care about those, I just turned it into a no-op that returns failure. SystemFunction036 (RtlGenRandom) is more difficult, but if you're not using rand (and you probably shouldn't be), then you don't need it either. I just stubbed it as a breakpoint (int 3
). You could also stub it to call CryptGenRandom. If you do better with code than prose, here is an approximation of the stubs I used in my "Hello world" app:
.386
.MODEL flat, stdcall
.DATA
;; Override the import symbols from kernel32.dll
__imp__InitializeSListHead@4 DWORD DownlevelInitializeSListHead
__imp__GetModuleHandleExW@12 DWORD DownlevelGetModuleHandleExW
EXTERNDEF STDCALL __imp__InitializeSListHead@4 : DWORD
EXTERNDEF STDCALL __imp__GetModuleHandleExW@12 : DWORD
;; Declare functions that we will call statically
EXTRN STDCALL _imp__GetModuleHandleW@4 : DWORD
EXTRN STDCALL _imp__GetProcAddress@8 : DWORD
CONST SEGMENT
kszKernel32 DB 'k', 00H, 'e', 00H, 'r', 00H, 'n', 00H, 'e', 00H, 'l', 00H, '3', 00H, '2', 00H, 00H, 00H
kszAdvApi32 DB 'a', 00H, 'd', 00H, 'v', 00H, 'a', 00H, 'p', 00H, 'i', 00H, '3', 00H, '2', 00H, 00H, 00H
kszInitializeSListHead DB "InitializeSListHead", 00H
kszGetModuleHandleExW DB "GetModuleHandleExW", 00H
; Windows XP and Server 2003 and later have RtlGenRandom, which is exported as SystemFunction036.
; If needed, we could fall back to CryptGenRandom(), but that will be much slower
; because it has to drag in the entire crypto API.
; (See also: https://blogs.msdn.microsoft.com/michael_howard/2005/01/14/cryptographically-secure-random-number-on-windows-without-using-cryptoapi/)
kszSystemFunction036 DB "SystemFunction036", 00H
CONST ENDS
.CODE
; C++ translation:
; extern "C" VOID WINAPI DownlevelInitializeSListHead(PSLIST_HEADER pHead)
; {
; const HMODULE hmodKernel32 = ::GetModuleHandleW(L"kernel32");
; typedef decltype(InitializeSListHead)* pfnInitializeSListHead;
; const pfnInitializeSListHead pfn = reinterpret_cast<pfnInitializeSListHead>(::GetProcAddress(hmodKernel32, "InitializeSListHead"));
; if (pfn)
; {
; // call WinAPI function
; pfn(pHead);
; }
; else
; {
; // fallback implementation for downlevel
; pHead->Alignment = 0;
; }
; }
DownlevelInitializeSListHead PROC
;; Get a handle to the DLL containing the function of interest.
push OFFSET kszKernel32
call DWORD PTR _imp__GetModuleHandleW@4 ; Returns the handle to the library in EAX.
;; Attempt to obtain a pointer to the function of interest.
push OFFSET kszInitializeSListHead ; Push 2nd parameter (string containing function's name).
push eax ; Push 1st parameter (handle to the library).
call DWORD PTR _imp__GetProcAddress@8 ; Returns the pointer to the function in EAX.
;; Test for success, and call the function if we succeeded.
test eax, eax ; See if we successfully retrieved a pointer to the function.
je SHORT FuncNotSupported ; Jump on failure (ptr == 0), or fall through in the most-likely case.
jmp eax ; We succeeded (ptr != 0), so tail-call the function.
;; The dynamic call failed, presumably because the function isn't available.
;; So do what _RtlInitializeSListHead@4 (which is what we jump to on uplevel platforms) does,
;; which is to set pHead->Alignment to 0. It is a QWORD-sized value, so 32-bit code must
;; clear both of the DWORD halves.
FuncNotSupported:
mov edx, DWORD PTR [esp+4] ; get pHead->Alignment
xor eax, eax
mov DWORD PTR [edx], eax ; pHead->Alignment = 0
mov DWORD PTR [edx+4], eax
ret 4
DownlevelInitializeSListHead ENDP
; C++ translation:
; extern "C" BOOL WINAPI DownlevelGetModuleHandleExW(DWORD dwFlags, LPCTSTR lpModuleName, HMODULE* phModule)
; {
; const HMODULE hmodKernel32 = ::GetModuleHandleW(L"kernel32");
; typedef decltype(GetModuleHandleExW)* pfnGetModuleHandleExW;
; const pfnGetModuleHandleExW pfn = reinterpret_cast<pfnGetModuleHandleExW>(::GetProcAddress(hmodKernel32, "GetModuleHandleExW"));
; if (pfn)
; {
; // call WinAPI function
; return pfn(dwFlags, lpModuleName, phModule);
; }
; else
; {
; // fallback for downlevel: return failure
; return FALSE;
; }
; }
DownlevelGetModuleHandleExW PROC
;; Get a handle to the DLL containing the function of interest.
push OFFSET kszKernel32
call DWORD PTR _imp__GetModuleHandleW@4 ; Returns the handle to the library in EAX.
;; Attempt to obtain a pointer to the function of interest.
push OFFSET kszGetModuleHandleExW ; Push 2nd parameter (string containing function's name).
push eax ; Push 1st parameter (handle to the library).
call DWORD PTR _imp__GetProcAddress@8 ; Returns the pointer to the function in EAX.
;; Test for success, and call the function if we succeeded.
test eax, eax ; See if we successfully retrieved a pointer to the function.
je SHORT FuncNotSupported ; Jump on failure (ptr == 0), or fall through in the most-likely case.
jmp eax ; We succeeded (ptr != 0), so tail-call the function.
;; The dynamic call failed, presumably because the function isn't available.
;; The basic VS 2015 CRT (used in a simple Win32 app) only calls this function
;; in try_cor_exit_process(), as called from common_exit (both in exit.cpp),
;; where it uses it to attempt to get a handle to the module mscoree.dll.
;; Since we don't care about managed apps, that attempt should rightfully fail.
;; If this turns out to be used in other contexts, we'll need to revisit this
;; and implement a proper fallback.
FuncNotSupported:
xor eax, eax ; return failure
ret 12
DownlevelGetModuleHandleExW ENDP
DownlevelSystemFunction036 PROC
int 3 ; break --- stub unimplemented
ret 8
DownlevelSystemFunction036 ENDP
END
Roy points out in a comment that Microsoft has provided an MIT-licensed implementation of SList that only requires InterlockedCompareExchange(). This will make your job slightly easier, as you won't have to reverse-engineer any of the SList functions as I did.
It goes without saying that you should avoid at all costs MFC, ATL, and other libraries whose source code is outside of your control. They will drag in dependencies on functions that are not available on downlevel versions of the operating system, causing even more work for you. You will really need to limit yourself to raw Win32, meaning that the only library you'll have to worry about is the CRT.
Whew! That should get you started. If, instead of being intrigued, you're massively intimidated by this, you almost certainly have no business with hacks such as this. Use an older version of the compiler.