4

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on Windows 10. Recently, I upgraded to Windows 11 and now it won't start anymore, it crashes instantly. Compatibility mode doesn't fix the issue. I really like this application, it shows you the face of the earth with the correct day/night cycle, seasons, clouds, city lights at night, etc. - I don't feel at home on my Desktop without this background. And I can't find an adequate replacement for this app. So I want to try and fix it.

Here's what the Windows application log is saying (sorry, couldn't figure out how to change the language, it's in German):

Name der fehlerhaften Anwendung: DesktopEarth.exe, Version: 3.2.42.0, Zeitstempel: 0x553f6b3b
Name des fehlerhaften Moduls: ntdll.dll, Version: 10.0.22621.755, Zeitstempel: 0x42b70e75
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000653f5
ID des fehlerhaften Prozesses: 0x0x435C
Startzeit der fehlerhaften Anwendung: 0x0x1D90E747D1A2A1D
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\DesktopEarth\DesktopEarth.exe
Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll
Berichtskennung: 1b12aa9f-2912-4517-8b57-dfa6f8eeb950
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Looks like it crashes in ntdll.dll... maybe if I revert that to an older version, it will work again? So I downloaded an older version of ntdll.dll from the internet (hopefully not some randomware), placed it next to DesktopEarth.exe and... same error. It's still using C:\Windows\SYSTEM32\ntdll.dll. So I added C:\Program Files (x86)\DesktopEarth to my PATH, hoping that this would make DesktopEarth.exe prefer my custom ntdll.dll but still nothing. Is the path to the dll hardcoded in the exe? I was kinda getting my hopes up, because someone on the internet had a similar issue and placing an old version of ntdll.dll seemed to have helped. But I don't want to replace C:\Windows\SYSTEM32\ntdll.dll, it will probably break some other stuff on my system...

How can I make DesktopEarth.exe use my custom ntdll.dll? I heard there's a thing called dll hijacking that may help here? Does anyone know how to do that?

Improve this question
9
  • Hi and welcome to RE.SE. 1.) the message suggests ntdll.dll is the culprit, but you don't seem to be aware just how many times this has been wrong in general (further investigation such as with a memory dump will be required) 2.) ntdll.dll is a known DLL, which means the session manager preloads it and keeps it around as a section object unter \KnownDlls\ntdll.dll or \KnownDlls32\ntdll.dll respectively 3.) in general DLL hijacking is difficult with known DLLs, but with ntdll.dll it may be outright impossible. This DLL gets loaded into a process extremely early.
    – 0xC0000022L ♦
    Dec 13, 2022 at 9:19
  • ... and last but not least, this isn't really on-topic, although I'll concede that you'd be likely to find plenty of people around here who are equipped to help out.
    – 0xC0000022L ♦
    Dec 13, 2022 at 9:20
  • 2
    tried to ask the author? maybe he releases the code or creates fresh build for you?
    – llm
    Dec 13, 2022 at 9:23
  • One more comment: the linked report seems hogwash. It makes no sense that ntdll.dll would get loaded from next to the binary without any other change. Not even if you placed an ntdll.dll.local file next to it. In fact that description suggests that there is a difference if that particular application gets launched from within its own directory as opposed to from elsewhere. I think that something on that other system was modified (e.g. list of known DLLs or the DLL search order) or that the placed ntdll.dll isn't even used and my above hunch is true.
    – 0xC0000022L ♦
    Dec 13, 2022 at 9:25
  • 2
    Could be a DEP Violation (cannot tell without parameter 0 of the crash), did you try disable DEP for that process? (In PowerShell: Set-ProcessMitigation DesktopEarth.exe -Disable DEP
    – Remko
    Dec 13, 2022 at 10:11

2 Answers 2

Reset to default
4

How can I make DesktopEarth.exe use my custom ntdll.dll? I heard there's a thing called dll hijacking that may help here? Anyone know how to do that?

there is no need for this. A cursory analysis showed that this screensaver was written in MFC and OpenGL. And he takes the wallpaper from the NASA Blue Marble project.

So you can simply grab wallpapers and videos from the NASA media library

NASA Blue Marble

Improve this answer
2
  • what made DesktopEarth special is that it gave you a real-time view of the current day/night cycle, cloud cover and snow on the ground according to the current season. Also, it's not a screensaver, it updates your desktop background every few minutes. That's not what a static image can provide, but thanks for the link to the source images.
    – klamann
    Dec 13, 2022 at 22:10
  • no need to be condescending like this. You can download the application from archive.org and install it (in a VM) on Windows 10 or lower and see for yourself. There is a separate alpha layer for clouds that is updated from a webservice. Yes, the ground textures are static (including the snow), and they are stretched over a sphere, but the sphere rotates in sync with earth and shows the correct day/night cycle. There's some more post processing going on to make it seem like the sphere has an atmosphere and so on. If it were that trivial to re-implement, I might give it a try myself.
    – klamann
    Dec 14, 2022 at 7:57
3

A tool like Enigma Virtual Box might help, since it can be used to pack DLL-dependencies into a single executable. I would use it on a system where everything works to pack the system's DLLs (including at least ntdll.dll) into a new DesktopEarth.exe, so they are virtually in the same directory (and DLLs are first loaded from the local directory).

If ntdll.dll is only loaded from DesktopEarth.exe and not indirectly, it would be possible to simply put a working version of the DLL into the directory of the executable. (But I highly doubt that's the case.)

It depends on the dependency tree and which of Win11's DLLs are incompatible with Win10's DLLs, on how many files you'd have to include. It would be trial and error.

Dependencies can for example be checked with shell scripts like

objdump -p DesktopEarth.exe | grep "DLL Name"  
for FILE in *.dll; do objdump -p $FILE | grep "DLL Name"; done

or by using a PE viewer, such as PEExplorerV2.
Good luck.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.