Conan Posted December 28, 2013 ID:769651 Share Posted December 28, 2013 Hello, using MBAE and EMET (with Deep Hooks and ROP Mitigation) crashes chrome browser. If I use MBAE and EMET (with Deep Hooks and all ROP Mitigation are disabled) - Chrome startsIf I use MBAE and EMET (without Deep Hooks and all ROP Mitigation are enabled) - Chrome startsIf I use MBAE disabled and EMET (with Deep Hooks and all ROP Mitigation are enabled) - Chrome starts Link to post Share on other sites More sharing options...
Staff pbust Posted December 28, 2013 Staff ID:769693 Share Posted December 28, 2013 Can you try again by disabling only EAF mitigation in EMET to see if it works? Link to post Share on other sites More sharing options...
Conan Posted December 28, 2013 Author ID:769698 Share Posted December 28, 2013 Hello, disabling only EAF mitigation with Deep Hooks and ROP mitigation enabled still crashes chrome.BTW, I am on Windows 8 x64 Link to post Share on other sites More sharing options...
hoople Posted December 28, 2013 ID:770073 Share Posted December 28, 2013 Confirmed using EMET 4.1 and Windows 8.1 x64 Link to post Share on other sites More sharing options...
Staff pbust Posted December 29, 2013 Staff ID:770168 Share Posted December 29, 2013 Conan, can you disable the mitigations one by one and try again to see if you can find the one that's causing the conflict? Link to post Share on other sites More sharing options...
Conan Posted December 29, 2013 Author ID:770185 Share Posted December 29, 2013 Hello, all ROP mitigation cause the conflict. I think (not sure) from what I've read about Deep Hooks, it is used as a countermeasure to exploits by passing ROP mitigation thus maybe it is used whenever a ROP mitigation is ticked? Link to post Share on other sites More sharing options...
Staff pbust Posted December 30, 2013 Staff ID:770602 Share Posted December 30, 2013 I've updated the Known Issues & Compatibility list to reflect this while we investigate further. Thanks for reporting!! Link to post Share on other sites More sharing options...
Conan Posted December 30, 2013 Author ID:770623 Share Posted December 30, 2013 I only tested this in chrome. I don't know about other browsers. However, with WindowsMediaPlayer all is working fine. Link to post Share on other sites More sharing options...
Staff pbust Posted December 30, 2013 Staff ID:770625 Share Posted December 30, 2013 Yes, EMET seems to have quite a bit of problems with Chrome. In fact Google posted a blog some time ago saying that users should NOT protect Chrome with EMET. On the other hand MBAE is fully compatible with Chrome and we are working to also make it fully compatible with EMET. Link to post Share on other sites More sharing options...
Conan Posted January 5, 2014 Author ID:773646 Share Posted January 5, 2014 I've read that too. It seems Chrome has mitigitations built-in. Link to post Share on other sites More sharing options...
hake Posted January 5, 2014 ID:773840 Share Posted January 5, 2014 Concerning Google Chrome on Windows XP SP3 with EMET 4.1Without an obvious system change, Google Chrome became unresponsive after it was started (last evening it worked as it should). I was able to get Chrome working in the following circumstances: -1. Deep Hooks disabled in EMET 4.1, MBAE Anti-Exploit protection enabled and all EMET 4.1 mitigations enabled except EAF for Chrome.2. Deep Hooks enabled in EMET 4.1, MBAE Anti-Exploit protection disabled and all EMET 4.1 mitigations enabled except EAF for Chrome.3. Deep Hooks enabled in EMET 4.1, MBAE Anti-Exploit protection enabled and EAF, Load lib, MemProt, Caller, SimEx and Stack pivot mitigations disabled for Chrome in EMET 4.1.Subsequent to these evolutions, Acrobat 6 Professional would not start fully.A system restart seems to have restored stability and Acrobat 6 Pro now works again as it had previously and should with all EMET 4.1 mitigations and Deep Hooks enabled.On a second Windows XP SP3 system, Google Chrome runs with Deep Hooks enabled and all mitigations for Chrome except EAF enabled. Link to post Share on other sites More sharing options...
Staff pbust Posted January 5, 2014 Staff ID:773843 Share Posted January 5, 2014 Seeing all the problems that exist between EMET and Chrome prior to the introduction of MBAE, I'm not sure fixing a tri-part compatibility issue between EMET, Chrome and MBAE will be a priority since the root of the problems is basically between EMET and Chrome. MBAE and Chrome don't seem to have a problem. Following Google's advice, I would recommend not using EMET to protect Chrome and relying on MBAE for Chrome protection against exploits. Link to post Share on other sites More sharing options...
hake Posted January 5, 2014 ID:773855 Share Posted January 5, 2014 That view seems quite reasonable. Google's advice is surely authoritative. Coincident on my previous comment, I have noticed that Adobe Reader 11 now runs in protected mode on that system with EMET mitigations enabled except for Caller, SimEx and Stack Pivot. Previously it would not run in protected mode with all mitigations in EMET disabled (that is there was an entry for AcroRd32.exe in EMET with ALL mitigations unchecked). Link to post Share on other sites More sharing options...
hake Posted January 5, 2014 ID:773864 Share Posted January 5, 2014 Correction of my last comment: Adobe Reader 11 was able to run with EMET mitigations as I stated BUT not when used in web mode, i.e. as a PDF reader in a web browser. I had to revert to completely removing AcroRd32.exe from the EMET list. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now