DLL Initialization and Thread Local Storage

[Ximonite]

It is well known that Windows NT 5 cannot run modern browsers like Firefox Quantum and modern versions of Chromium. People may expect the reason behind this to be missing functions that are difficult to add, but this is not the case. The real reason is actually a difference in how Windows loads DLLs between NT 5 and 6.

On Windows NT 6, the preparation of Thread Local Storage (abbreviated to TLS) happens during the DLL loading process. Meanwhile, TLS preparation on Windows NT 5 is done independently with functions that programs can call when needed.

There is TLS preparation code present inside Windows NT 5 that is used during the initialization of ntdll and kernel32, and most of the code needed to replicate Windows NT 6’s behavior is present in WildBill’s ntdll.