What are the limitations or bypass techniques related to blockdlls? Can it be bypassed using signature forgery?
Blockdlls cannot be bypassed using 'Authenticode Signature Forgery' or 'Catalog Signature Forgery—Long UNC Filename Spoofing' techniques. Additionally, you cannot use `NtSetInformationProcess()` to modify the security policy of a remote process, as it returns error code `c000000d` (STATUS_ILLEGAL_INSTRUCTION). The feature is primarily a defense against third-party DLL injection but does not prevent all exploitation methods, such as loading .NET assemblies from memory or executing shellcode via Boolang language.
blockdlls bypasssignature forgeryremote processNtSetInformationProcess.NET assemblyshellcode execution