syft
syft copied to clipboard
Add PE security feature detection
ELF security feature detections was added in https://github.com/anchore/syft/pull/2443 . It would be nice to also add this same kind of features but for windows (PE formatted binaries).
Proposed features to detect:
- DEP (data execution prevention)... though enforced from the kernel I think this is detectable from the binary's header.
- ASLR compatibility, partially detectable with the
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
flag in the PE header (needs research). - CFG (control flow guard, needs research)
- Code signing (authenticode signature)
There may be more features to detect that I'm unaware of.