mattifestation / WDACPolicies

A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies

60 stars 7 forks source link

Detect resource-only dll's #1

Open kimoppalfens opened 1 year ago

kimoppalfens commented 1 year ago

Hi Matt,

Have a question around a remark in the VMWare Tools policy markdown.

Exclude *ver.dll DLLs. These are not signed but they are resource-only DLLs

How do you determine a DLL is a resource-only DLL? Are there any tools available that can help in this process?

Kim

screamtracker commented 6 months ago

I think its best guess. You can install vs 2022 community edition and select the c++ profiling tools to get dumpbin. Then using /headers and /exports you can see if the output shows it exports functions or contains any code. Try with vmware tools and see, i dont have access to those binaries.