NetSPI / PESecurity

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

https://blog.netspi.com/verifying-aslr-dep-and-safeseh-with-powershell/

MIT License

614 stars 152 forks source link

Window exe's SafeSEH is always false no matter the linker option is set or not from VS2019 #23

Closed DengYiming closed 2 years ago

DengYiming commented 2 years ago

Pls see the following code, it seems like Get-SEHStatus is never executed? if ($ARCH -eq 'AMD64') { $SEH = 'N/A' } elseif ($ARCH -ne 'AMD64') { $HighentropyVA = 'N/A' } elseif ($SEH -ne 'N/A') {

Get SEH Status

  $SEH = Get-SEHStatus $CurrentFile $NTHeader $PointerNtHeader $PEBaseAddr

}

egru commented 2 years ago

You are absolutely correct. Thanks for catching that. I changed both elseifs to if statements.