For past two weeks I've been implementing apphelp.dll. I got that one working and moved onto kernel32 part of magic. According to various papers and blogs it seems that windows logs all exes and dlls ever executed in registry[1] and uses it as cache to lookup if binary needs to be shimmed or patched (if file isn't found, hard lookup of shim database is done) It is loaded on boot and saved back to registry on shutdown.

This is awfully overcomplicated (plus I do not know how to make such a "global" variable in wine) so I was wondering is it OK to implement this differently than windows does it. It would be simpler to control app compat with environmental variable. It would mean that Base*Appcompat* kernel32 APIs would remain unimplemented but as far as I know, no application uses them anyway, other than windows internally.

What do you think?

[1] https://github.com/mandiant/ShimCacheParser