Prevent DLL injection from third-party software (Astrill VPN)

[Copilot]

Astrill VPN injects ASProxy64.dll into RustDesk's process space, causing access violations when it calls AuthenticateLicense. The current DLL search path allowed loading from user directories via LOAD_LIBRARY_SEARCH_USER_DIRS.

Changes

• Remove LOAD_LIBRARY_SEARCH_USER_DIRS from SetDefaultDllDirectories call
• Restrict DLL loading to System32 directory only (LOAD_LIBRARY_SEARCH_SYSTEM32)

// Before
func(LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS)

// After
func(LOAD_LIBRARY_SEARCH_SYSTEM32)

This hardens against DLL injection attacks from any third-party software, not just Astrill.

Affected: Windows non-debug builds only

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• chromium.googlesource.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https REDACTED REDACTED grep -l evc_amf /macos/macos_impl.rs /usr/bin/grep --global (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https REDACTED REDACTED grep -l evc_amf ld.rs k/_temp/ghcca-node/node/bin/grep --global user.email rgo/bin/grep grep -l evc_amf (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https REDACTED REDACTED grep -l evc_amf s (dns block)
• https://api.github.com/repos/rustdesk/rustdesk/discussions
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.