Beat Saber Cannot be Modded due to WindHawk interfering with IPA.exe

[IAMDEDJUSTTOGETFILES]

Hello,
BSMG Support here. There's apparently an issue with WindHawk and BSIPA, our modloader for the pc version of the game, in which IPA.exe apparently tries to modify the necessary files, but when it tries to modify winhttp.dll, the permission is denied as seen in the attached image due to WindHawk.

The issue can be fixed by putting IPA.exe in the process exclusions list or by deleting/removing WindHawk. Has this issue come up before? I'll try to get log files or anything you need to debug this.

[m417z]

Hi, are you the author of IPA.exe? Can you reduce the issue to a small package that can be used to reproduce the problem? For example, attach the original or modified IPA.exe along with winhttp.dll and tell me how to run it to see the problem.

[Meivyn]

Hello, I am the maintainer of BSIPA.

We've had people complaining recently that the mod loader couldn't be installed, and this error was showing up. I asked them to send a minidump and I noticed that winhttp.dll was loaded by IPA.exe because of this binary being injected into the program:

Here's the minidump file: https://pixeldrain.com/u/canuNJQY

Somehow the first report we've got about this issue happened way after the latest release you made, only about a month ago. And I didn't make any BSIPA release either in that timeframe, so I assume that it has something to do with system updates or Windhawk mods updates. I can't guarantee that it wasn't an issue before, but we didn't get a single report of it, and now we suddenly get a lot of them.

BSIPA uses an old customized version of the Unity doorstop to inject the game and install mods. IPA.exe is just moving files and taking care of backups, it does nothing special: https://github.com/nike4613/BeatSaber-IPA-Reloaded/blob/master/IPA/Program.cs

You can get the latest release of BSIPA here. It'll only work with a game made with Unity. Extract it into the game folder and run IPA.exe if you want to try it out.

Worth noting that some people also started to experience the same issue because of adwares, and it wasn't an issue either before as far as I know.

[m417z]

It'll only work with a game made with Unity. Extract it into the game folder and run IPA.exe if you want to try it out.

Can it be reproduced without having a game installed?

[Meivyn]

IPA won't work without a game, but I assume that any console program trying to mess up with this file would be enough to reproduce. I'll see if I can get you a repro case.

[m417z]

It'd be surprising if having winhttp.dll loaded affected moving a file of the same name. My best guess of how it can cause issues is that perhaps IPA loads its own winhttp.dll and does something like GetModuleFileName("winhttp.dll"), assuming only its copy is loaded. Then perhaps it's actually trying to delete the system winhttp.dll, which makes sense to result in an access denied error.

What I can do to mitigate the issue to have winhttp.dll delay-loaded. It's not used that often and it makes sense to do it to reduce the chance of conflicts, although if it does get loaded, the same issue will occur, so it's not a complete fix.

[m417z]

perhaps IPA loads its own winhttp.dll

Indeed it does, as can be seen in the dump.

0:000> lmf
start             end                 module name
0000026a`ad3c0000 0000026a`ad3d4000   IPA      C:\Users\...\depots\620981\15813345\IPA.exe
[...]
00007ffa`c46d0000 00007ffa`c46dc000   winhttp  C:\Users\...\depots\620981\15813345\winhttp.dll
00007ffa`dbf60000 00007ffa`dbf6a000   version  C:\Windows\System32\version.dll
00007ffa`de530000 00007ffa`de666000   winhttp_7ffade530000 C:\Windows\System32\winhttp.dll

[Meivyn]

It does load it, but only because of the Windhawk DLL being injected into it. It doesn't otherwise. winhttp.dll is in the same directory as the program. I can reproduce the problem myself after installing Windhawk with no mods. That's still weird because it didn't happen before...

Here's a dump when Windhawk isn't running: https://send.vis.ee/download/1731f18802f70748/#DIsIh4Qv0mqh-RmDGhXZyA

[m417z]

OK, now I understand the issue better. winhttp.dll isn't in the list of known DLLs, so it's loaded from the current directory, at which point it's in use so it can't be deleted.

Perhaps I can use delay loading together with a custom handler to load the system32 version specifically. I'll see what I can do.

[Meivyn]

Not loading the DLL from the current directory would indeed solve the issue. However, I'm still flabbergasted that it didn't happen before considering that you are injecting all programs on purpose (at least from what I've understood of your blog post). I really wonder why.

[IAMDEDJUSTTOGETFILES]

We already know beat saber can be modded by putting IPA.exe in the exclusion list, as I said when I first created the post, we just want to know if it can be fixed or not.

[InterGalacticCold]

@IAMDEDJUSTTOGETFILES Have you tried putting IPA.exe in the exclusions list of windhawk?

[IAMDEDJUSTTOGETFILES]

Yes, as I have said before. I am going to say before you commit on issues, you should read the issue itself first. Mindlessly replying without reading leads you to miss Info that I have already said. Thank you.