2

I'm reading this document: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide

In older OS, EMET injects a DLL into the process. On latest Windows EMET is implemented by windows directly. I'm wondering which DLL implements it? I'll then look into it with IDA.

daisy
  • 1,735
  • 3
  • 25
  • 39
  • I'm pretty sure it's a number of different DLLs, in addition to kernel features (for things that don't need to be implemented in userspace, like W^X). I strongly doubt there's just a single one. – forest Aug 18 '22 at 01:59

0 Answers0