[EMET] SimExecFlow problem not fixed as previously thought

[MCFatTongue]

I reported here https://forums.malwarebytes.org/index.php?&showtopic=144762 that the SimExecFlow problem was fixed for me, but unfortunately it's not.

I thought it was fixed because deep hooks was unticked and once I had ticked it again the problem returned.

[1PW]

I reported here https://forums.malwarebytes.org/index.php?&showtopic=144762 that the SimExecFlow problem was fixed for me, but unfortunately it's not.

I thought it was fixed because deep hooks was unticked and once I had ticked it again the problem returned.

 

That's still a good find and valuable information.

 

Thank you.

[Durew]

I reported here https://forums.malwarebytes.org/index.php?&showtopic=144762 that the SimExecFlow problem was fixed for me, but unfortunately it's not.

I thought it was fixed because deep hooks was unticked and once I had ticked it again the problem returned.

 Same here. (except for the "I reported here" part.)

Without deep hooks every thing works fine.

[Kaine]

Hello,

 

You should disable SimExecFlow mitigation, it simply can't work with MBAE. There are many other powerful mitigations techniques in EMET that work fine with MBAE.

I suggest you don't disable Deep Hooks, which was a well known weakness in 4.x, probably the easiest way to bypass EMET.

 

Regards,

Kaine

[MCFatTongue]

Hello Kaine,

 

Thanks for the advice, I had already disabled SimExFlow mitigation in EMET for my affected applications, Deep Hooks is still enabled, It works just fine like that.

 

I'm hoping there will be a fix in the next update of MBAE.

[pbust]

Please refer to this notice regarding MBAE and EMET compatibility going forward:

https://forums.malwarebytes.org/index.php?showtopic=146501

[pbust]

Unlocking and re-opening the EMET-compatibility discussions under "News, Questions and Comments" section instead of under "Product Support".