Jump to content

MBAE, EMET, HMP.Alert conflicts


assur
 Share

Recommended Posts

see this below pic and i can't do anything with browser until close browser and stop protection,then open browser again but firefox i.e work fine.help me plz.

 

post-161098-0-41364500-1402771223_thumb.

 

question

Is malwarebytes anti exploit protect browsers based on google chrome and based on firefox ?or not.

 

Link to post
Share on other sites

I too had this same problems too. I had the beta version and had no problems. So today I decided to upgrade and get the paid version. It installed over the beta version fine and was up and running. 

 

Google Chrome could not access the internet ever since then.

 

Yes, I do have EMET and HitmanPRO Alert running. I uninstall both of them and since then Google Chrome has been running fine. However, I was unhappy to run into the problems since I had no problem with the beta version. What changed ? 

 

Shawn 

Link to post
Share on other sites

  • Staff

Hello,

 

MBAE, EMET and HMP Alert simply can't work together. EMET and MBAE try to apply similar mitigations, that's the cause of the conflict (even with the beta version). MBAE's team  is aware of this issue and has warned the users regarding EMET compatibility.

 

FYI running also EMET alongside HMP will ruin the benefits of using HMP, due to internal conflicts, so don't expect to make these 3 programs run together. Chose simply one of them and you'll be fine.

Link to post
Share on other sites

  • Staff

Kaine is 100% correct. It is worth noting that Kaine sent us a very detailed analysis of both EMET and MBAE hooking mechanisms which changed our minds about any compatibility claims. It was due to his analysis that we decided to change our claim of compatibility and are now focused on improving MBAE rather than wasting time trying to make them compatible.

Link to post
Share on other sites

Different Windows versions, different compatibility problems.  MBAE is a wonderful means of mitigating the imperfections and vulnerabilities of Microsoft Windows.  It is hardly surprising if two or more mitigation tools, each trying to achieve similar ends, should get across each other.  I would not even think of using three.

 

I was puzzled for a while by the initials HMP which for a Brit means Her Majesty's Prisons.  Definitely avoid these.

 

With Win32 systems, Google Chrome (and also Comodo Dragon) do not like any EMET ROP mitigations when MBAE is also in use.  They also do not like EMET's EAF mitigations.  I have found that, with Windows XP at least, it helps application stability if EMET SIM and Stack Pivot mitigations are disabled for all applications protected by MBAE.  With Windows XP, Adobe Reader 11 with Enhanced Security enabled is so sensitive when both MBAE and EMET are used that it will not run even if it is listed in EMET without ANY mitigations whatsoever being enabled.

 

Time taken to experiment with EMET mitigations for applications protected by MBAE will pay dividends.  You can't crash the OS while doing this.

 

MBAE is a wonderful tour de force and I am very pleased to have the protection it affords.  I also use EMET and enjoy the protection of most of its mitigations, including ROP.  To paraphrase Boswell's Life of Samuel Johnson from which I have taken and 'modified' one of his quotations of the great man: "Sir, using MBAE and EMET together is like a dog walking on its hind legs. It is not done perfectly but you are surprised to find it done at all."

 

In other words, MBAE is doing an almost impossibly difficult job effectively and acceptably well, especially with EMET.

Link to post
Share on other sites

I checked Adobe Reader 11 on a 32bit Windows 7 system.  The behaviour of Adobe Reader 11 with Enhanced Security enabled is like most applications protected by MBAE which is that EMET SIM mitigation will be tripped so it should be disabled in EMET.

 

I can only guess that 32bit Vista is the same and the 64bit versions of Windows post XP need no disabling of SIM mitigation.  I will have my hands on a 64bit Windows 7 on Saturday so can confirm that then.

Link to post
Share on other sites

  • Staff

I didn't know about Her Majesty's Prison initials, I'm sorry hake.

 

Indeed I've worked on the last MBAE Beta release to make it work with EMET for private use (I hope you don't mind Pedro !), as promised I'll contact you privately asap.

Applying these modifications to the first non beta version should not be a problem...

 

I would like to congratulate MBAE team for their first non beta release that introduces many new exploit mitigations technologies and also really improves the existing ones.

Keep up the good work !

Link to post
Share on other sites

Hi Kaine,

 

Please do not apologise.  You are obviously a gentleman and it is I who should apologise for my obscure sense of humour.  I hasten to add that I have never enjoyed the hospitality offered by HMP.  :-)

 

Regarding MBAE and EMET in conjunction with Windows XP, I find that Windows Media Player also does not like any ROP mitigations enabled in EMET when protected by MBAE.

Link to post
Share on other sites

  • Staff

No problem hake ! :)

 

If you really wish to use MBAE with EMET (and that seems to be the case even if it's not recommended !), I suggest you to disable all the ROP mitigations: SimExecFlow, Stack Pivot, Caller, MemProt, LoadLib, Banned Functions, Deep Hooks and Anti Détours. That's the only way to get something stable with both products installed on your computer. You can now enjoy 100 % of the benefits of MBAE without any crash.

Link to post
Share on other sites

Internet Explorer 11 crash at open.

I have installed EMET.

i use MBAE free version.

It is a MBAE & EMET compatibility problem. Without EMET MBAE works fine.

I read maybe deactivating IE on MBAE can resolve the problem but MBAE don't permit deactivate IE.

How to?

 

Thanks,

 

Link to post
Share on other sites

Hi , just updated my MBAE to premium , so far so good , but know Chrome starts but nothing works in it ... it comes up with that kill pages screen , if i stop MBAE its all ok .... i,ve tried a few things already mentioned here like deleting some programFiles ... but to no avail ... any answers ????

 

Roy

Link to post
Share on other sites

Hi , solved this myself ..... i have hitman pro running , so uninstalled that , and MBAE pro is running ok .... obviously can,t have both at the same time ?? i will stick with MBAE for the time being and see how it goes unless anyone has a workaround ?? 

 

Looking around elsewhere MBAE seems a better prospect as it seems to be more preventative ... i will see how it goes ...thanks Roy

Link to post
Share on other sites

cheers , thought I was going round the bend there for a few hours , I,ll trust MBAE and see how it goes ... I,ve never had HMP alert anyway , I,ll stick with MBAE , you have always sorted me out before ... Thanks ROY , if your from USA ?? USA 2 Portugal 1 .. Get in there ..

Link to post
Share on other sites

  • 1 month later...

Hello. Very simply, with both EMET 5.0 IE11 protections turned on and MBAE running, IE11 crashes under certain circumstances. If either EMET IE protections are turned off, or MBAE is uninstalled, then IE runs fine.

 

Process:

1) From DuckDuckGo search "ie 10 emet process"

 

2) Click on first link titled "Are All Internet Explorer Processes Protected By EMET 4.0?"

 

3) IE11 Crashes.

 

System Variables

 

Windows 8.1 64bit all updates, Installed yesterday.

Kaspersky Internet Security 2015, default settings

IE11, (with options: Enable 64bit processes for Enhanced Protected Mode, & Enhanced Protected Mode)

EMET 5.0

MBAE

 

Software Installed:

Asus Audio Driver

AMD 14.7 RC3 Video driver

Intel chipset drivers

Malwarebytes Anti-Malware (set to not load on startup)

No Other Software Installed

 

If you need more information, please let me know. I'd like to get this settled.

Link to post
Share on other sites

  • 7 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.