PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY 結構

struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY {union {DWORD Flags;struct {DWORD MicrosoftSignedOnly : 1;DWORD StoreSignedOnly : 1;DWORD MitigationOptIn : 1;DWORD AuditMicrosoftSignedOnly : 1;DWORD AuditStoreSignedOnly : 1;DWORD ReservedFlags : 27;} DUMMYSTRUCTNAME;// ...}// ...
}

這個結構包含用于加載映像的進程緩解策略設置，具體取決于映像的簽名。

MicrosoftSignedOnly

設置 (0x1) 以防止進程加載未由 Microsoft 簽名的圖像;否則保留未設置 (0x0) 。

StoreSignedOnly

設置 (0x1) 以防止進程加載未由 Windows 應用商店簽名的圖像;否則保留未設置 (0x0) 。

MitigationOptIn

設置 (0x1) 以防止進程加載未由 Microsoft、Windows 應用商店和 Windows 硬件質量實驗室 (WHQL) 簽名的圖像;否則保留未設置 (0x0) 。

測試

我們通過啟用MicrosoftSignedOnly來禁止非微軟簽名的DLL注入到我們的進程。

如下代碼開啟:

#include <iostream>
#include <Windows.h>int main() {PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY ply = { 0 };ply.StoreSignedOnly = false;ply.MicrosoftSignedOnly = true;if (SetProcessMitigationPolicy(ProcessSignaturePolicy, &ply, sizeof(ply))) {printf("設置成功");} else {printf("設置失敗");}getchar();
}

測試結論是沒有起到作用，這是因為SetProcessMitigationPolicy是在程序啟動后調用的，調用前就已經被注入了。

解決辦法是編寫一個Loader，在Loader中調用SetProcessMitigationPolicy，然后使用CreateProcess加載目標程序，這樣就可以了。

#include <Windows.h>void CreateChildProcessWithMitigationOption() {PROCESS_INFORMATION pi = {};STARTUPINFOEXA si = {};SIZE_T attributeSize = 0;InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);PPROC_THREAD_ATTRIBUTE_LIST attributes = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, attributeSize);InitializeProcThreadAttributeList(attributes, 1, 0, &attributeSize);DWORD64 policy = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON;UpdateProcThreadAttribute(attributes, 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &policy, sizeof(DWORD64), NULL, NULL);si.lpAttributeList = attributes;CreateProcessA(NULL, (LPSTR)"app.exe", NULL, NULL, TRUE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, attributes);
}void LocalProcessMitigationOption() {PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY poy = { 0 };GetProcessMitigationPolicy(GetCurrentProcess(), ProcessSignaturePolicy, &poy, sizeof(poy));poy.MicrosoftSignedOnly = true;CreateChildProcessWithMitigationOption();SetProcessMitigationPolicy(ProcessSignaturePolicy, &poy, sizeof(poy));
}int main() {LocalProcessMitigationOption();
}