In-memory code signing
Since a lots of malicious code are running in memory-only, wouldn’t it be possible to sign each eXecutable codes (functions etc) of each PE files and check before each new started thread the code (in-memory) is indeed signed … Continue reading In-memory code signing