EMET 5.1 fundamentally broken on XP x64 and hence presumably on Server 2003 x64 RRS feed

  • General discussion

  • Launching any EMET protected application on XP x64 will result in the following error message:

    The procedure entry point fopen_s could not be located in the dynamic link library msvcrt.dll.

    However the application will still open and appears to work.

    Disabling all mitigations has no effect, only removing the application from the protected list stops the error from occurring but of course that defeats the whole purpose.

    As XP x64 is built on the codebase of Server 2003 x64 it is reasonable to assume that the same errors will occur there.

    Of the 20 protected applications I tested only Foxit Reader didn't throw an error but it turns out that's because the wrong application name is coded into EMET, it is listed as "Foxit Reader.exe" when it should be "FoxitReader.exe", no space.

    Monday, November 17, 2014 9:13 AM