by do son · Published · Updated
PowerShell script to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, Authenticode, Control Flow Guard, and HighEntropyVA.
Download
git clone https://github.com/NetSPI/PESecurity.git
Usage
Import the module
Import-Module .\Get-PESecurity.psm1
Check a single file
C:\PS> Get-PESecurity -file C:\Windows\System32\kernel32.dll
Check a directory for DLLs & EXEs
C:\PS> Get-PESecurity -directory C:\Windows\System32\
Check a directory for DLLs & EXEs recrusively
C:\PS> Get-PESecurity -directory C:\Windows\System32\ -recursive
Export results as a CSV
C:\PS> Get-PESecurity -directory C:\Windows\System32\ -recursive | Export-CSV file.csv
Show results in a table
C:\PS> Get-PESecurity -directory C:\Windows\System32\ -recursive | Format-Table
Show results in a table and sort by a column
C:\PS> Get-PESecurity -directory C:\Windows\System32\ -recursive | Format-Table | sort ASLR
Copyright (c) 2015 NetSPI
Source: https://github.com/NetSPI/
Tags: PESecurity
Support Securityonline.info site. Thanks!
