Memory Patch Hijacking Protection for MS Office disabled when MBAE started

[hake]

I am running MBAE 1.12.1.109 on Windows 7 and MBAE 1.12.1.90 on Windows XP.  I have noticed that Memory Patch Hijacking Protection for MS Office becomes disabled when MBAE is started even though it is shown as enabled when default Advanced Settings are restored.  This occurs on both Windows 7 and Windows XP.

I am also using OSArmor 1.4 but the problem continues after OSArmor has been uninstalled.

Edited August 22, 2018 by hake

[Arthi]

Hi hake,

Yes, that setting has been disabled by us to prevent a False Positive with MS Office applications for all our users. 

Thanks.

[hake]

Thanks for that.

[hake]

I have contrived to ensure that MBAE 1.12.1.90, which I currently use with Windows XP, is now able to run with ALL advanced settings enabled without being disabled, except by me.  No false positives or unwanted behaviours have yet been observed.  I don't anticipate using a later version of MBAE with Windows XP.  It was a bit of a surprise to find that the RET ROP Gadget Detections for applications other than web browsers did not cause problems.  Office 2003 does not cause false positives with the process hollowing mitigations.

I look forward to forthcoming MBAE version updates for more recent versions of Windows than XP.

 

Edited August 23, 2018 by hake

[hake]

Drat!  It didn't work.  I give up.

I hope that when you guys fix the False Positive problem, us users of older versions of MBAE can restore the Advanced Settings option for Memory Patch Hijacking Protection for MS Office to enabled.

Edited August 26, 2018 by hake