Disable MicrosoftSignedOnly mitigation on Win10 20H1
@@ -212,7 +212,25 @@ INT WINAPI wWinMain(
}
#ifndef DEBUG
- if (WindowsVersion >= WINDOWS_10)
+ // Starting with Win10 20H1 processes with uiAccess=true override the ProcessExtensionPointDisablePolicy
+ // blocking hook DLL injection and inject the window hook anyway. This override doesn't check if the process has also enabled
+ // the MicrosoftSignedOnly policy causing an infinite loop of APC messages and hook DLL loading/unloading
+ // inside user32!_ClientLoadLibrary while calling the GetMessageW API for the window message loop.
+ // ...
+ // 1) GetMessageW processes the APC message for loading the window hook DLL with user32!_ClientLoadLibrary.
+ // 2) user32!_ClientLoadLibrary calls LoadLibraryEx with the DLL path.
+ // 3) LoadLibraryEx returns an error loading the window hook DLL because we enabled MicrosoftSignedOnly.
+ // 4) SetWindowsHookEx ignores the result and re-queues the APC message from step 1.
+ // ...
+ // Mouse/keyboard/window messages passing through GetMessageW generate large volumes of calls to LoadLibraryEx
+ // making the application unresponsive as each message processes the APC message and loads/unloads the hook DLL...
+ // So don't use MicrosoftSignedOnly on versions of Windows where Process Hacker becomes unresponsive
+ // because a third party application called SetWindowsHookEx on the machine. (dmex)
+ if (
+ WindowsVersion >= WINDOWS_10 &&
+ WindowsVersion != WINDOWS_10_20H1 &&
+ WindowsVersion != WINDOWS_10_20H2
+ )
{
PROCESS_MITIGATION_POLICY_INFORMATION policyInfo;
