Running image viewer from Windows XP on modern Windows

I have a directory with old images which I collected in the noughties. I move it with all my other files from one computer to another on every upgrade. Every now and then, when I feel a bit nostalgic, I open it and look through the pictures. There are a few GIF files with animation, and every time I notice that the default image viewer from Windows 7 does not support it. I remembered, that the image viewer from Windows XP was able to play GIF animation properly. So, I spent a bit of time to overcome a few obstacles and to run the old image viewer on modern Windows, a small launcher was created for this purpose. Now I can watch these old images in authentic interface of the old image viewer from Windows XP.

Download: shimgvw_xp32.7z (includes a binary and source code of the launcher, and the shimgvw.dll from English Windows XP SP3).

How has it been done?

Default image viewer from Windows XP is not just an application. It is executed by the Windows Explorer from the shlimgvw.dll dynamic library. It is not possible to execute it directly, you need a mediator like rundll32 for this purpose (path to an existing image file is required):

rundll32 c:\windows\system32\shimgvw.dll,ImageView_Fullscreen c:\test.gif

But this trick doesn't work when you try to run shimgvw.dll from Windows XP on Windows 7, the shimgvw.dll requires Windows XP compatibility mode enabled. It is possible to do it by setting this compatibility mode for a copy of rundll32, but it is an ugly hack, and it will cause displaying of UAC dialog on every run of the viewer, so it is not appropriate.

After a short debugging session, I found the culprit. The shimgvw.dll implicitly imports some deprecated shell functions from the shunimpl.dll, and the latter library refuses to load if there is no ATOM "FailObsoleteShellAPIs" (otherwise it loads properly, but the obsolete functions return error codes). Windows XP compatibility mode adds this ATOM (in addition to a lot of other things), that's why the image viewer is able to run in this mode.

A lightweight loader for the shimgvw.dll was implemented. It adds ATOM "FailObsoleteShellAPIs", asks which image should be opened (if it wasn't passed as an argument), and then passes the execution to the shimgvw.dll. The viewer works properly, so I have not investigated what those obsolete shell functions are used for. At least, it is not something crucial.

  1. #1
    mudlord

    Thanks very much!
    Always wanted a decent image viewer since the Windows 10 image viewer apps are utter garbage. The Windows 7 one was good, but lacks features.

    Anyway, I was also wondering how you assembled the code patches for the S-YXG50 synth? Can FASM output raw code fragments as bytestreams or is there extra work involved (like assembling into a shell program and then disassembling the results to find the needed code fragment)? I know there is a x64dbg plugin for assembling code fragments into appended code sections, though (not sure if it also makes code caves).

  2. #2
    VEG Author

    mudlord, actually, you can run the image viewer from Windows 7 on Windows 10. You can use the same shimgvw.exe launcher, just remove the shimgvw.dll from the directory with the launcher. In this case, it will use the library from the system32 directory, and, in Windows 10, it is a bit improved version of the viewer from Windows 7.

    FASM is able to assemble raw binaries, so I use this ability, with set of custom macros.