From a76092fecd2276875c1cba90cc943a8fcaa30ba9 Mon Sep 17 00:00:00 2001 From: Andriy Brukhovetskyy Date: Wed, 26 Aug 2026 15:16:25 +0000 Subject: [PATCH] fix: Seal RWX memory protections and handle leaks in trampoline setup --- hooks.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hooks.c b/hooks.c index bb358e06..243c28e0 100644 --- a/hooks.c +++ b/hooks.c @@ -2122,6 +2122,11 @@ void set_hooks() } free(suspended_threads); + + // Close snapshot handle properly + if(hSnapShot != INVALID_HANDLE_VALUE && hSnapShot != NULL) { + CloseHandle(hSnapShot); + } if (pLdrRegisterDllNotification) pLdrRegisterDllNotification(0, &New_DllLoadNotification, NULL, &g_dll_notify_cookie); @@ -2132,5 +2137,8 @@ void set_hooks() set_hooks_exe(); + // Restore execution-only bindings locally + VirtualProtect(hooks, hooks_size, PAGE_EXECUTE_READ, &old_protect); + hook_enable(); }