PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY 结构

struct _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY {union {DWORD Flags;struct {DWORD MicrosoftSignedOnly : 1;DWORD StoreSignedOnly : 1;DWORD MitigationOptIn : 1;DWORD AuditMicrosoftSignedOnly : 1;DWORD AuditStoreSignedOnly : 1;DWORD ReservedFlags : 27;} DUMMYSTRUCTNAME;// ...}// ...
}

这个结构包含用于加载映像的进程缓解策略设置，具体取决于映像的签名。

MicrosoftSignedOnly

设置 (0x1) 以防止进程加载未由 Microsoft 签名的图像;否则保留未设置 (0x0) 。

StoreSignedOnly

设置 (0x1) 以防止进程加载未由 Windows 应用商店签名的图像;否则保留未设置 (0x0) 。

MitigationOptIn

设置 (0x1) 以防止进程加载未由 Microsoft、Windows 应用商店和 Windows 硬件质量实验室 (WHQL) 签名的图像;否则保留未设置 (0x0) 。

测试

我们通过启用MicrosoftSignedOnly来禁止非微软签名的DLL注入到我们的进程。

如下代码开启:

#include <iostream>
#include <Windows.h>int main() {PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY ply = { 0 };ply.StoreSignedOnly = false;ply.MicrosoftSignedOnly = true;if (SetProcessMitigationPolicy(ProcessSignaturePolicy, &ply, sizeof(ply))) {printf("设置成功");} else {printf("设置失败");}getchar();
}

测试结论是没有起到作用，这是因为SetProcessMitigationPolicy是在程序启动后调用的，调用前就已经被注入了。

解决办法是编写一个Loader，在Loader中调用SetProcessMitigationPolicy，然后使用CreateProcess加载目标程序，这样就可以了。

#include <Windows.h>void CreateChildProcessWithMitigationOption() {PROCESS_INFORMATION pi = {};STARTUPINFOEXA si = {};SIZE_T attributeSize = 0;InitializeProcThreadAttributeList(NULL, 1, 0, &attributeSize);PPROC_THREAD_ATTRIBUTE_LIST attributes = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, attributeSize);InitializeProcThreadAttributeList(attributes, 1, 0, &attributeSize);DWORD64 policy = PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON;UpdateProcThreadAttribute(attributes, 0, PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY, &policy, sizeof(DWORD64), NULL, NULL);si.lpAttributeList = attributes;CreateProcessA(NULL, (LPSTR)"app.exe", NULL, NULL, TRUE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &si.StartupInfo, &pi);HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, attributes);
}void LocalProcessMitigationOption() {PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY poy = { 0 };GetProcessMitigationPolicy(GetCurrentProcess(), ProcessSignaturePolicy, &poy, sizeof(poy));poy.MicrosoftSignedOnly = true;CreateChildProcessWithMitigationOption();SetProcessMitigationPolicy(ProcessSignaturePolicy, &poy, sizeof(poy));
}int main() {LocalProcessMitigationOption();
}