Skip to content

Add PE security feature detection #2498

@wagoodman

Description

@wagoodman

ELF security feature detections was added in #2443 . It would be nice to also add this same kind of features but for windows (PE formatted binaries).

Proposed features to detect:

  • DEP (data execution prevention)... though enforced from the kernel I think this is detectable from the binary's header.
  • ASLR compatibility, partially detectable with the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag in the PE header (needs research).
  • CFG (control flow guard, needs research)
  • Code signing (authenticode signature)

There may be more features to detect that I'm unaware of.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    Backlog

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions