Microsoft announced last year that it was retiring all SHA-1 signed content from Microsoft Downloads in this blog post since the SHA-1 algorithm is no longer considered secure. The original timeline was stretched out a bit due to COVID-19, but as of January 2021 this content is no longer hosted by Microsoft servers.
This impacted the legacy DirectX SDK, the DirectX End-User Runtime, and the DirectX End-User Runtime Web Installer. In January 2021 they were removed from the Microsoft Download Center. As of February 20, 2021, these three downloads have been republished using SHA-256 signing for the ‘outer’ containers–there’s been no change to the contents or binaries. The payload DLLs are still using SHA-1, and there are known security issues, so it is highly recommended you move to the replacements mentioned in this post.
Impact for existing games
As I’ve communicated numerous times, this legacy installer never installs DirectX (i.e. it doesn’t change Direct3D, DirectDraw, DirectSound, DirectInput, etc.) at all. These components are strictly serviced as part of the Operating System. See this blog post.
For games that included the DirectX SDK
REDIST folder in their installation, there is no impact as that continues to work. Following the legacy recommendations of cutting down the number of
.cab files you ship to control overall download/media sizes remains a useful option per Microsoft Docs.
For legacy DirectX SDK-built games using Desktop Bridge, you can still make use of the of the “DirectX Framework Package” Microsoft.DirectX.x86 / Microsoft.DirectX.x64 which remain available as the
appx is signed with SHA-256.
Impact for existing developers
As has been the case the past decade, the strong recommendation is to no longer rely on the legacy DirectX SDK or it’s legacy DirectSetup redist solution. The bulk of the “DirectX” headers are already in the modern Windows SDK, so you do not need the legacy DirectX SDK at all for these components:
|DirectX component||Developer files in Windows SDK|
|Common||Dcommon.h, D3Dcommon.h, DXGUID.LIB|
|Direct2D||D2D1.h, D2D1Helper.h, D2DBaseTypes.h, D2Derr.h, d2d1.lib|
|Direct3D 11||D3D11.h, D3D11SDKLayers.h, D3D11Shader.h, d3d11.lib|
|Direct3D 10.1||D3D10_1.h, D3D10_1shader.h, d3d10_1.lib|
|Direct3D 10||D3D10.h, D3D10effect.h, d3d10misc.h, d3d10sdklayers.h, D3D10shader.h, d3d10.lib|
|Direct3D 9||d3d9.h, d3d9caps.h, d3d9types.h, d3d9.lib|
|DXGI||DXGI.h, DXGIFormat.h, DXGIType.h, dxgi.lib|
|DirectDraw||DDraw.h. See this blog post for why there is no ddraw.lib.|
|DirectInput||dinput.h, dinputd.h, dinput8.lib|
|DirectSound||dsconf.h, dsound.h, dsound.lib|
|Game Explorer UX||gameux.h|
|HLSL Compiler||D3Dcompiler.h, d3dcompiler.lib. See this blog post for more information.|
|D3DX11 Compute Shader Utility||D3DCSX.h, D3DCSX.lib, D3DCSXd.lib|
DirectX 12 was never part of the legacy DirectX SDK. Those headers and libraries are part of the Windows SDK as well as on GitHub.
Numerous replacements for legacy D3DX11 are detailed on this blog, most of which are open-source: Living without D3DX.
For users of D3DX10, the strong recommendation is to port to Direct3D 11 and use the D3DX11 replacements above. There is no technical reason to use Direct3D 10.x. See Microsoft Docs for a detailed porting guide.
There is an option for obtaining the deprecated D3DX9, D3DX10, and/or D3DX11 libraries without using the legacy DirectX SDK or redist via NuGet. The open source replacements are still preferable. See this blog post for more details.
D3DX12 (i.e. D3DX for DirectX 12) is of course still a thing. It never shipped in the legacy DirectX SDK, nor does it have any dependency on the legacy DirectSetup redist. See this blog post.
The best option is to upgrade to XAudio 2.9. For Windows 10, this is built-in and everything is included in the Windows SDK. For Windows 7 / Windows 8.x you can make use of XAudio2Redist. See Microsoft Docs. Primarily the change is in device numeration, obtaining the channel mask for the output device, and the move to a unified
xaudio2.lib, so it’s a quick and simple port.
For samples, see GitHub.
Do not use XAudio 2.7 or earlier. It has a number of known bugs as well as relying on the legacy redistribution.
The Windows SDK includes
Xinput9_1_0.lib. You can use XInput 9.1.0 for Windows 7 support as it’s always present in the OS. See this blog post.
For samples, see GitHub.
Do not use XInput 1.1, 1.2, or 1.3. These rely on the legacy redistribution, and there are known security issues with using these versions of the DLLs.
See Microsoft Docs for the detailed porting guide.
Managed DX 1.1
Managed DirectX 1.1 assemblies have been deprecated for a long time. They should no longer be used at all. See this blog post.
DXERR.LIB, see this blog post.
XDSP.Hmath helper header, you can find this on GitHub. It relies on DirectXMath.
XACT never saw wide-spread adoption. There’s no direct replacement option for XACT. Use in new projects is not recommended.
The legacy DirectX SDK included a DirectX Developer Runtime which provided the “Debug” device support for Direct3D 9 on Windows 7 or earlier. It also included a somewhat dated Direct3D 10/Direct3D 11 debug layer that are not compatible with DirectX 11.1 or later.
For Windows 10, you enable the Graphics Tools optional component to enable the DirectX Developer Runtime. This does not include support for legacy Direct3D 9 debugging.
For Windows 7 with DirectX 11.1 or Windows 8.x, the DirectX Developer Runtime is installed by the Windows SDK. Again, this does not include support for legacy Direct3D 9 debugging.
All of the advice above assumes you are targeting Windows 7 or up. For Windows XP / Windows Server 2003, there’s no choice at all but to use the legacy DirectX SDK. In order to target Windows XP, you must use the Windows 7.1A SDK instead of the modern Windows SDK which is before the DirectX content was fully moved over. The Windows 8.x SDK and Windows 10 SDK do not support Windows XP development.
In this case, the only option is to obtain the legacy DirectX SDK from Microsoft Downloads or some Internet mirror (for example, there’s a copy on archive.org). To ensure you are using the genuine bits, I highly recommend you verify the hash before running it.
certutil -hashfile DXSDK_Jun10.exe SHA512
The valid SHA-512 hash for the original SHA-1 signed exe is:
The valid SHA-512 has for the SHA-256 signed exe is:
For more information on using the Windows 7.1A SDK, see this blog post.
Also, be sure to read about this known issue with the legacy DirectX SDK setup.
See Also: The Zombie DirectX SDK,