Is there a way for the executable created by InnoSetup to prevent DLL redirection?

Question

When launching an installer created with InnoSetup it tries to load the common-controls DLL from Windows. I'm assuming this is for rendering the UI dialogas. However, by using the DLL Redirection feature provided by Windows (https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection) you can make the installer run a different DLL that you place on a specific location.

This behavior can be a problem especially if the installer itself requires elevated privileges to run but the installer file has been placed in a more accessible location, like the user Downloads folder.

Microsoft provides a couple of options to manage the DLL-loading behavior, like using some specific parameters on the linker when building the application (https://devblogs.microsoft.com/oldnewthing/20230328-00/?p=107978)

So I'm wondering if there is a way to tell InnoSetup to use this (or other) mitigation alternatives to prevent this from happening. Is this a known issue and some documentation exists somewhere on how to deal with this?

PS: I'm currently using InnoSetup v6.0.5

Answer 1

So after digging some more in InnoSetup documentation, it turns out that this was fixed in a later version. An installer built with v6.2.2 (current latest) does not seem to present the same issue and will not try to run the "fake" dll.

From JRSoftware's website:

Change in default behavior: Starting with Inno Setup 6.1 the [Setup] section directive MinVersion defaults to 6.1sp1, so by default Setup will not run on Windows Vista or on versions of Windows 7 and Windows Server 2008 R2 which have not been updated. Setting MinVersion to 6.0 to allow Setup to run on Windows Vista is supported but not recommended: Windows Vista doesn't support some of Setup's security measures against potential DLL preloading attacks so these have to be removed by the compiler if MinVersion is below 6.1 making your installer less secure on all versions of Windows.