BlackMark/CoopAllTheThings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make inline-hook install AND remove safe to spam

Browse Source 
The uncapped, input-polling mock_game_test storm (thousands of presents/s, now
also driving the input/focus/MKB hooks) drove out a family of install/remove races
the slow vsync'd mock had masked. Fixes (hook/src/hook_install.hpp + hook_guard.hpp):

- Persistent hooks. The old model created a hook on install and DESTROYED it on
  remove (= {}), freeing the trampoline; a detour about to call it (.stdcall) then
  hit freed memory -> 0xC0000005. drain() can't fully close that window (a thread
  can be inside the detour but not past its Guard ctor). So hooks are now created
  ONCE and only enable()/disable()d across install/remove cycles -- never destroyed
  during the session -- so a stale detour always calls a live trampoline (disabled,
  it just runs the original). Reused, so no churn and no leak. remove_* therefore
  disable()s + drain()s but does not destroy; install guards check .enabled().

- Install race. create_inline() enables the hook before the result is move-assigned
  into the global the detour reads; a call landing in the detour mid-assign reads a
  torn hook -> AV. install_inline() creates StartDisabled, assigns, then enable()s.

- drain() Sleep(1)s BEFORE each zero-check, so a thread that entered the detour but
  hasn't reached its Guard registers before we conclude zero.

- Focus: publish g_orig_proc before SetWindowLongPtr activates the subclass (and
  subclass_proc falls back to DefWindowProc if null); and disable the focus-query
  hooks in reverse install order, because GetForegroundWindow shares user32 code
  with GetActiveWindow (keep GFW hooked until GAW is unhooked).

- disable()/enable() [[nodiscard]] results are handled (logged), not (void)-discarded.

Storm now survives on every backend across repeated runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
BlackMark
2026-06-23 11:17:13 +02:00
parent 8a43d2f568
commit 79582f9fa6
10 changed files with 197 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
hook/src/mkb_hook.cpp
View File

@@ -10,6 +10,7 @@
#include <safetyhook.hpp>
#include "hook_guard.hpp"
#include "hook_install.hpp"
#include "hook_registry.hpp"
#include "vtable_hook.hpp"
@@ -406,7 +407,7 @@ void install_user32_hook(HMODULE user32, const char* name, void* detour, safetyh
}
if (void* target = reinterpret_cast<void*>(GetProcAddress(user32, name)))
{
slot = safetyhook::create_inline(target, detour);
install_inline(slot, target, detour); // StartDisabled -> assign -> enable (no install race)
if (slot)
{
hook_set_installed(id, true);
@@ -519,16 +520,15 @@ void remove_mkb_hooks()
// drain. Destroying before the drain frees the trampoline under a detour about to call it -- the
// same UAF class as the present-storm crash. (The DI hook is a vtable swap: remove() restores the
// slot and keeps m_original valid, so it has no trampoline to free early.)
(void)g_hk_async.disable();
(void)g_hk_kbstate.disable();
(void)g_hk_cursor.disable();
(void)g_hk_getrawinputdata.disable();
disable_for_removal(g_hk_async);
disable_for_removal(g_hk_kbstate);
disable_for_removal(g_hk_cursor);
disable_for_removal(g_hk_getrawinputdata);
g_vh_di_getstate.remove(); // restore the DI GetDeviceState slot (probe kept alive for re-enable)
g_gate.drain(); // wait for any in-flight polling / DI / raw detour before clearing state
g_hk_async = {}; // no detour in-flight or able to start now -> safe to free the trampolines
g_hk_kbstate = {};
g_hk_cursor = {};
g_hk_getrawinputdata = {};
// Persistent hooks: keep g_hk_async/kbstate/cursor/getrawinputdata ALIVE (disabled), so a stale
// detour's trampoline call (these detours DO call the trampoline) is never freed -- re-install
// re-enables them (see hook_install.hpp).
hook_set_installed(g_id_di_getstate, false);
hook_set_installed(g_id_rawinput, false);
for (int vk = 0; vk < 256; ++vk)