Skip to content

Commit cb87326

Browse files
kjkclaude
andcommitted
add more DLLs to preload list to prevent DLL sideloading attacks
A crash report showed a malicious DWrite.dll planted next to the portable exe, executing shellcode via DLL search order hijacking. Preload all late-loaded DLLs from System32 to block this vector. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent ae90d15 commit cb87326

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

src/utils/WinDynCalls.cpp

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,14 @@ void SetWindowRoundedCorners(HWND hwnd, bool rounded) {
207207
}; // namespace dwm
208208

209209
static const char* dllsToPreload =
210-
"gdiplus.dll\0msimg32.dll\0shlwapi.dll\0urlmon.dll\0version.dll\0windowscodecs.dll\0wininet.dll\0";
210+
"gdiplus.dll\0msimg32.dll\0shlwapi.dll\0urlmon.dll\0version.dll\0windowscodecs.dll\0wininet.dll\0"
211+
"DWrite.dll\0TextShaping.dll\0textinputframework.dll\0"
212+
"WINTRUST.dll\0MSASN1.dll\0imagehlp.dll\0CRYPTSP.dll\0rsaenh.dll\0CRYPTBASE.dll\0"
213+
"bcryptPrimitives.dll\0kernel.appcore.dll\0MSCTF.dll\0"
214+
"CoreMessaging.dll\0CoreUIComponents.dll\0WS2_32.dll\0wintypes.dll\0"
215+
"ntmarta.dll\0clbcatq.dll\0profapi.dll\0PROPSYS.dll\0MrmCoreR.dll\0"
216+
"thumbcache.dll\0VCRUNTIME140.dll\0sendmail.dll\0policymanager.dll\0"
217+
"msvcp110_win.dll\0CFGMGR32.dll\0";
211218

212219
// try to mitigate dll hijacking by pre-loading all the dlls that we delay load or might
213220
// be loaded indirectly

0 commit comments

Comments
 (0)