Block Multiple DLLs ?

Open MukundaK opened this issue 4 years ago • 1 comments

Is it possible to block multiple dlls ? cmd and powershell crash when given multiple dll names.

for example, .\sharpblock.exe -n "dll1.dll" -n "dll2.dll" --disable-bypass-amsi -e "c:\windows\system32\windowspowershell\v1.0\powershell.exe" --disable-bypass-etw --disable-header-patch -w

Apr 05 '21 15:04 MukundaK

That's going to be tough. There are only 4 hardware breakpoints you have to play with and I'm using up all of them for different purposes. DLL entry point patch, AMSI bypass, ETW bypass and command line patch I believe. There is a potential for using software BP's for DLL blocking but not on my radar right now as I don't have the time.

Apr 10 '21 13:04 CCob