Skip to content

Commit b834439

Browse files
mamoreau-devolutionsawakecoding
authored andcommitted
Fix MsRdpEx loading in mstsc.exe on Windows 11 23H2
1 parent 273cfd8 commit b834439

1 file changed

Lines changed: 26 additions & 0 deletions

File tree

dll/ApiHooks.cpp

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,32 @@ HMODULE WINAPI Hook_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dw
155155
free(credsspDllA);
156156
}
157157

158+
if (MsRdpEx_IsAddressInRdpExeModule(_ReturnAddress())) {
159+
// mstsc.exe!CAxHostWnd::CreateControl calls LoadLibraryExW instead of LoadLibraryW
160+
// on Windows 11 23H2 - we want to intercept that call to get ourselves loaded
161+
// instead of the RDP ActiveX, while being careful not to intercept other calls
162+
163+
const char* msrdpexLibraryA = NULL;
164+
WCHAR* msrdpexLibraryW = NULL;
165+
166+
if (MsRdpEx_StringIEquals(filename, "mstscax.dll")) {
167+
msrdpexLibraryA = MsRdpEx_GetPath(MSRDPEX_LIBRARY_PATH);
168+
MsRdpEx_ConvertToUnicode(CP_UTF8, 0, msrdpexLibraryA, -1, &msrdpexLibraryW, 0);
169+
MsRdpEx_LogPrint(DEBUG, "LoadLibraryExW: \"%s\" -> \"%s\"", lpLibFileNameA, msrdpexLibraryA);
170+
hModule = Real_LoadLibraryW(msrdpexLibraryW);
171+
interceptedCall = true;
172+
}
173+
else if (MsRdpEx_StringIEquals(filename, "rdclientax.dll")) {
174+
msrdpexLibraryA = MsRdpEx_GetPath(MSRDPEX_LIBRARY_PATH);
175+
MsRdpEx_ConvertToUnicode(CP_UTF8, 0, msrdpexLibraryA, -1, &msrdpexLibraryW, 0);
176+
MsRdpEx_LogPrint(DEBUG, "LoadLibraryExW: \"%s\" -> \"%s\"", lpLibFileNameA, msrdpexLibraryA);
177+
hModule = Real_LoadLibraryW(msrdpexLibraryW);
178+
interceptedCall = true;
179+
}
180+
181+
free(msrdpexLibraryW);
182+
}
183+
158184
if (!interceptedCall)
159185
{
160186
// reduce log verbosity for repeated LoadLibraryExW calls

0 commit comments

Comments
 (0)