Add DLL blocking hook for FM. #359
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dinhngtu
force-pushed
the
dllblock
branch
2 times, most recently
from
0c51b9e
to
bfe08d9
Compare
|
Thank you. I will merge your PR after I finish the separation of NanaZip.Classic and NanaZip.Modern. Please wait for me some time to finish that. Kenji Mouri |
|
The feature looks good to me. There are some steps needed.
Kenji Mouri |
|
I've enabled the DLL blocker for both projects. I'll leave the Detours part as is for the moment. |
|
Detours dependency integration is ready in NanaZip.Shared.Mitigations project. You can continue with this PR. I will merge this if you have done that. Kenji Mouri |
|
I've rebased the PR. |
dinhngtu
force-pushed
the
dllblock
branch
2 times, most recently
from
1ad9008
to
134a9f2
Compare
|
It looks like you forget calling NanaZipBlockDlls in Kenji Mouri |
|
Thank you. I have merged that. Kenji Mouri |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To recall, #236 disabled the dynamic code mitigation on NanaZip's main FM thread due to an incompatibility with ExplorerPatcher.
This PR introduces in NanaZip FM a Detours hook of NtMapViewOfSection that inspects a mapped DLL's identity and denies the mapping if it belongs to a predefined list, which at the moment contains only ExplorerPatcher.
Also reenable dynamic code mitigation on main NanaZip FM thread.
Tested on Windows 11 with ExplorerPatcher installed.
Additional mitigations to follow.