Avast! interferes with hooking of LdrLoadDll by somehow forcing itself to load
before most other DLLs, installing a multi-chain hook of its own on LdrLoadDll,
and also possibly overwriting any later attempts to add hooks to the chain.
This interference causes games to crash quite early when run in Hourglass (or
immediately desync if they do manage to start up). The particular component
that causes this problem is the "Behavior Shield", and Hourglass seems to work
fine if that is disabled.
This has caused similar problems in some builds of Firefox as well
(https://bugzilla.mozilla.org/show_bug.cgi?id=653361)
(https://bugzilla.mozilla.org/show_bug.cgi?id=652747). There are some suggested
patches, but I'm not sure if they're sufficient because it looks like I'm
already doing the checks they're adding.
Ideally there is some way to modify the hooking code such that it still works
normally and can coexist with Avast's behavior shield hooks. In the worst case,
if that isn't possible, when Hourglass detects that snxhk.dll has been loaded
it could at least warn the user about it and suggest temporarily disabling the
behavior shield.
Original issue reported on code.google.com by nitsuja-@hotmail.com on 24 Jul 2011 at 6:27
Original issue reported on code.google.com by
nitsuja-@hotmail.com
on 24 Jul 2011 at 6:27