2

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to inject into.

However, on my up-to-date Windows 10 machine, I've come to the conclusion that I cannot inject into Windows own binaries (e.g. calc.exe) and some third-party applications (e.g. Chrome).

For other processes, including my own programs, DLL injection works just fine, so I guess my injector works just fine...

What is the reason that I cannot inject into these processes?

1

Run the PowerShell Get-ProcessMitigation command on a process id (pid) of a running calc.exe.

PS> Get-ProcessMitigation -Id <calc_pid>

You will be informed that it will only load Microsoft Signed Libraries.

MicrosoftSignedOnly: ON

This is new in Windows 10.

  • Thank you! But why is calc.exe protected, while other Windows native programs like cmd.exe, powershell.exe are not? – Shuzheng Nov 18 '18 at 10:30
  • I can imagine that cmd.exe and powershell.exe are used to launch programs not run by Microsoft. The permissions are likely inherited by child processes. I can imagine this would be one reason that they do not have this restriction. – ojblass Nov 21 '18 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.