Bug 1553776 Comment 11 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

That dump is useful, thanks.

From what I can see, they are injecting a DLL that hooks into the loader the same way that the launcher process does. Unfortunately their code assumes that they're the only ones hooking that function, so their hook corrupts `ntdll!NtMapViewOfSection`.

Since our hook is in first, we can probably block them from loading their bad code. If they insist on continuing to inject, they're going to need to start playing nicely with our code in order for us to lift the block.
That dump is useful, thanks.

From what I can see, they are injecting a DLL that hooks into the loader the same way that the launcher process does. Unfortunately their code assumes that they're the only ones hooking that function, so their hook corrupts `ntdll!NtMapViewOfSection`.

Since our hook is in first, we can probably block them from loading their bad code. If they insist on continuing to inject, they're going to need to start playing nicely with our code in order for us to lift the block.

(Of course, the better course of action is to find out what they're *really* trying to do, and recommend a course of action that doesn't require them to inject and hook into us in the first place.)

Back to Bug 1553776 Comment 11