One Day Sec

Can you enable blockdlls on the current process rather than only on child processes? How does the API differ between Windows 8 and Windows 10?

Yes, you can enable blockdlls on the current process by modifying its `ProcessSignaturePolicy` to enable `MicrosoftSignedOnly`. On Windows 10, this is done using `SetProcessMitigationPolicy()`. On Windows 8, that API fails, so you must use `NtSetInformationProcess()` instead. The implementation details are covered in the blockdlls exploitation analysis, which provides separate code for each OS version.
SetProcessMitigationPolicyNtSetInformationProcesscurrent processblockdllsWindows 8Windows 10

Browse all Q&A →