@@ -155,6 +155,32 @@ HMODULE WINAPI Hook_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dw
155155 free (credsspDllA);
156156 }
157157
158+ if (MsRdpEx_IsAddressInRdpExeModule (_ReturnAddress ())) {
159+ // mstsc.exe!CAxHostWnd::CreateControl calls LoadLibraryExW instead of LoadLibraryW
160+ // on Windows 11 23H2 - we want to intercept that call to get ourselves loaded
161+ // instead of the RDP ActiveX, while being careful not to intercept other calls
162+
163+ const char * msrdpexLibraryA = NULL ;
164+ WCHAR* msrdpexLibraryW = NULL ;
165+
166+ if (MsRdpEx_StringIEquals (filename, " mstscax.dll" )) {
167+ msrdpexLibraryA = MsRdpEx_GetPath (MSRDPEX_LIBRARY_PATH);
168+ MsRdpEx_ConvertToUnicode (CP_UTF8, 0 , msrdpexLibraryA, -1 , &msrdpexLibraryW, 0 );
169+ MsRdpEx_LogPrint (DEBUG, " LoadLibraryExW: \" %s\" -> \" %s\" " , lpLibFileNameA, msrdpexLibraryA);
170+ hModule = Real_LoadLibraryW (msrdpexLibraryW);
171+ interceptedCall = true ;
172+ }
173+ else if (MsRdpEx_StringIEquals (filename, " rdclientax.dll" )) {
174+ msrdpexLibraryA = MsRdpEx_GetPath (MSRDPEX_LIBRARY_PATH);
175+ MsRdpEx_ConvertToUnicode (CP_UTF8, 0 , msrdpexLibraryA, -1 , &msrdpexLibraryW, 0 );
176+ MsRdpEx_LogPrint (DEBUG, " LoadLibraryExW: \" %s\" -> \" %s\" " , lpLibFileNameA, msrdpexLibraryA);
177+ hModule = Real_LoadLibraryW (msrdpexLibraryW);
178+ interceptedCall = true ;
179+ }
180+
181+ free (msrdpexLibraryW);
182+ }
183+
158184 if (!interceptedCall)
159185 {
160186 // reduce log verbosity for repeated LoadLibraryExW calls
0 commit comments