Jump to content
hake

Memory Patch Hijacking Protection for MS Office disabled when MBAE started

Recommended Posts

I am running MBAE 1.12.1.109 on Windows 7 and MBAE 1.12.1.90 on Windows XP.  I have noticed that Memory Patch Hijacking Protection for MS Office becomes disabled when MBAE is started even though it is shown as enabled when default Advanced Settings are restored.  This occurs on both Windows 7 and Windows XP.

I am also using OSArmor 1.4 but the problem continues after OSArmor has been uninstalled.

Edited by hake

Share this post


Link to post
Share on other sites

Hi hake,

Yes, that setting has been disabled by us to prevent a False Positive with MS Office applications for all our users. 

Thanks.

Share this post


Link to post
Share on other sites

Thanks for that.

Share this post


Link to post
Share on other sites

I have contrived to ensure that MBAE 1.12.1.90, which I currently use with Windows XP, is now able to run with ALL advanced settings enabled without being disabled, except by me.  No false positives or unwanted behaviours have yet been observed.  I don't anticipate using a later version of MBAE with Windows XP.  It was a bit of a surprise to find that the RET ROP Gadget Detections for applications other than web browsers did not cause problems.  Office 2003 does not cause false positives with the process hollowing mitigations.

I look forward to forthcoming MBAE version updates for more recent versions of Windows than XP.

 

Edited by hake

Share this post


Link to post
Share on other sites

Drat!  It didn't work.  I give up.

white_flag.jpg.317e4a6b59d0f3131afff3916eb3a041.jpg

I hope that when you guys fix the False Positive problem, us users of older versions of MBAE can restore the Advanced Settings option for Memory Patch Hijacking Protection for MS Office to enabled.

Edited by hake

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.