BlackMark/CoopAllTheThings
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden hook removal: disable -> drain -> destroy, and drain settles first

Browse Source 
Uncapping the mock game (next commit) turned mock_game_test's hook/unhook storm
into a real stress test (thousands of presents/s instead of tens), which reliably
crashed the game on remove (0xC0000005) for dx9/dx11/dx12. Two races the slow
vsync'd mock had masked:

1. Trampoline use-after-free. remove_*_hooks did `hook = {}` (destroy) BEFORE the
   DetourGate drain. Destroying a SafetyHook InlineHook frees its trampoline
   immediately, but an in-flight detour about to call the original via .stdcall()
   (the trampoline) then used freed memory. Fix: disable() first (restores the
   original bytes under thread suspension, but KEEPS the trampoline alive) -> drain
   -> only then destroy. Applied to present/d3d9/opengl/vk/xinput/mkb/focus.

2. Entry-window race in DetourGate::drain(). It returned the instant the active
   count read zero, but a thread can be inside the detour yet not have reached its
   Guard constructor (the prologue is unguarded), so the count reads zero while a
   detour is about to run -- and the freed state is then used. Fix: Sleep(1) BEFORE
   each zero-check; with the hook disabled no new detour starts, so any
   already-entered thread registers within that window. This alone fixed dx11 (the
   highest present rate, ~11000/s, which hit the window every storm).

Audio is unaffected (it uses vtable swaps, which keep a real original pointer, not
a trampoline). Full suite 21/21, and the storm now survives on every backend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
BlackMark
2026-06-23 09:44:42 +02:00
parent c480dfe152
commit 958c355126
8 changed files with 79 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hook/src/xinput_hook.cpp
View File

@@ -234,12 +234,20 @@ bool install_xinput_hooks(IpcClient& ipc)
void remove_xinput_hooks()
{
g_hooks.clear(); // InlineHook destructor restores the original bytes -> no new detour starts
// Disable (restore original bytes) first so no new detour starts, but KEEP the trampolines alive
// for any in-flight detour calling its trampoline; destroy only after the drain. Clearing the
// vector here would free the trampolines immediately -- a UAF a game polling XInput at a high
// rate could hit (the same class as the mock-game present-storm crash).
for (auto& h : g_hooks)
{
(void)h.disable();
}
hook_set_installed(g_id_getstate, false);
hook_set_installed(g_id_getstateex, false);
hook_set_installed(g_id_getcaps, false);
hook_set_installed(g_id_setstate, false);
g_gate.drain(); // wait for any in-flight detour before nulling the IPC pointer it reads
g_hooks.clear(); // no detour in-flight or able to start now -> safe to free the trampolines
if (g_ipc != nullptr)
{
g_ipc->mark_detached();