Two tools used during our analysis of the Microsoft binary injection mitigation implemented in Edge TH2.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
GetSignatureMitigation Update ReadMe.txt Dec 28, 2015
injector
README.md

README.md

BinaryInjectionMitigation

Two tools used during our analysis of the Microsoft binary injection mitigation implemented in Edge TH2. More information on this blog post: http://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/

Tool 1: GetSignatureMitigation

The purpose of this tool is to list the signature mitigation flags in a running process. To compile this binary, please download and install the latest Windows SDK version (in my case Version 1511 - updated on November 30th, 2015).

Example of usage on the PID 3704 (MicrosoftEdgeCP.exe in my case):

C:\>GetSignatureMitigation.exe 3704
Get SeDebugPrivilege: OK
Open process 3704: OK

Signature Microsoft Signed Only: 0
Signature Store Signed Only: 1
Signature Mitigation Opt-In: 1

The code used the following undocumented structure:

typedef enum _PROCESS_MITIGATION_POLICY {
    ProcessDEPPolicy,
    ProcessASLRPolicy,
    ProcessDynamicCodePolicy,
    ProcessStrictHandleCheckPolicy,
    ProcessSystemCallDisablePolicy,
    ProcessMitigationOptionsMask,
    ProcessExtensionPointDisablePolicy,
    ProcessControlFlowGuardPolicy,
    ProcessSignaturePolicy,
    ProcessFontDisablePolicy,
    ProcessImageLoadPolicy,
    MaxProcessMitigationPolicy
} PROCESS_MITIGATION_POLICY, *PPROCESS_MITIGATION_POLICY;

typedef struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY {
    union {
        DWORD Flags;
        struct {
            DWORD MicrosoftSignedOnly : 1;
            DWORD StoreSignedOnly : 1;
            DWORD MitigationOptIn : 1;
            DWORD ReservedFlags : 29;
        } DUMMYSTRUCTNAME;
    } DUMMYUNIONNAME;
} PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY, *PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY;

Tool 2: injector

The purpose of this tool is to inject code in a running process. We created it to test the signature loading mitigation of Edge TH2. Here is the syntax:

C:\>injector.exe
Usage of the injector.

injector.exe /d dll_file PID
injector.exe /s shellcode_file PID
    /d dll_file PID: dll injection via LoadLibrary().
    /s shellcode_file PID: shellcode injection.

The /d option uses the LoadLibrary() function in order to load a DLL. the /s option push the shellcode in memory and execute it directly.

P.