com客户端认证
我们在这里设置了每个流程都经过签名的设置。我们有一个具有 SYSTEM 权限的进程，它公开 COM 接口。我们不希望我们签名的进程以外的进程使用 COM 接口。有什么办法可以做到这一点吗？我们还在探索其他可以实现这一点的 Windows IPC 机制。请随意建议其他 IPC 机制，使之成为可能。 目前我们正在发送 pid 以及请求，但这很容易被欺骗。有什么建议吗？
We have a setup here where every process is signed. We have a process with SYSTEM privilege that exposes COM interfaces. We do not want processes other than the ones signed by us to use the COM interfaces. Is there any way to accomplish this? We are also exploring other Windows IPC mechanisms that could allow this. Feel free to suggest other IPC Mechanisms that makes this possible.
Currently we are sending the pid, along with the request but that can be easily spoofed. Any suggestions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
注册自定义代理/存根或 inproc 处理程序，并让代理或处理程序包含检查二进制文件签名的代码。
通过 inproc COM 对象进行所有访问，该对象执行验证并与服务器进行质询/响应过程。当然，如果他们善于使用调试器，也可以进行欺骗。
放弃吧。即使是签名的进程也可能被欺骗 - 使用带有挂起标志的 CreateProcess，注入 DLL，并使用 JMP 将入口点覆盖到 DLL 中。第一个调用是 Sleep(1000)，因此允许它运行 500 毫秒，然后用原始代码替换跳转。现在您正在 DLL 中运行代码，但 EXE 尚未修改。
即使不使用调试 API 也是如此。哎呀，他们可以修补你的服务以删除检查！
Register a custom proxy/stub or inproc handler and have the proxy or handler incorporate code which checks the signature on the binary.
Make all access go via an inproc COM object which performs the validation and undergoes a challenge/response process with the server. Of course that can be spoofed too if they are handy with a debugger.
Just give up on it. Even a signed process can be spoofed - use CreateProcess with the suspended flag, inject a DLL, and overwrite the entrypoint with a JMP into the DLL. First call is a Sleep(1000) so allow it to run for 500ms, then replace your jump with the original code. Now you are running code in the DLL but the EXE hasn't been modified.
That's even without using the debugging APIs. Heck, they could patch your service to remove the check!