CFG reported False for managed executables (.NET)

NetSPI / PESecurity

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

https://blog.netspi.com/verifying-aslr-dep-and-safeseh-with-powershell/

MIT License

614 stars 152 forks source link

CFG reported False for managed executables (.NET) #19

Closed aursulis closed 4 years ago

aursulis commented 4 years ago

In a similar vein to Issue #16, there is noise reported for managed code executables for the Control Flow Guard feature. Managed code (e.g. C# compiled for .NET) does not have the feature enabled but it is also not applicable. For one it cannot be enabled for such binaries, but also the exploits that it mitigates should not happen in managed runtimes.

egru commented 4 years ago

Gotcha. I added a check to see if it's a managed binary. Hopefully that fixes it.