locked
Application crash when DEP is enabled in EMET even when application has it disabled RRS feed

  • Question

  • I've noticed that a certain game(Soldier of Fortune 2) which I'm trying to host keeps crashing when DEP is enabled for this game.
    I tried disabling DEP in the system configuration of Windows but when EMET is installed this does not help.
    I then added this game to EMET and disabled all mitigations, yet the game still crashes.

    If I use opt out for DEP(Under system status) and disable all mitigations in EMET for this application + Disable DEP for this application in Windows (under the performance tab) the application still crashes.

    Once I change the DEP EMET (system status setting) to application opt in the problem is resolved.

    Why is this happening if I opt out the application in EMET and Windows?

    Tuesday, August 13, 2013 11:31 AM

All replies

  • Two things to check,

    Look for the AppCrash entry in the Event Log and check

    whether it's actaully the game .exec that has failed or

    another .DLL

    I've had problems with DEP errors when the .exe is set correctly

    but not any .DLL's that are invoked.

    When you have EMET DEP Opt Out set you also appear to

    still be using the Windows based exclusion list. There may

    be conflict there, so you could try leaving the Windows system

    DEP list blank and rely solely on the EMET settings.

    Thursday, August 15, 2013 10:25 AM
  • I already tried to leave the windows based exclusion list empty but this didn't help.
    I only find the error with the games exe name which I already excluded, so it's not caused by a .dll

    I believe this might be a bug in EMET?

    Friday, August 16, 2013 1:39 PM
  • Sounds like it's not picking up the application entry correctly from the filter list.

    When you've got EMET set to opt-out it's not "seeing" the application entry for

    that game and therefore enabling DEP.

    When you've got EMET set to opt-in it will only set DEP on when the entry matches

    and if (for some reason) it doesn't match then DEP is left off, hence it works with

    that setting. 

    Did you add the application entry manually or get the game running and then use

    the active tasks list to add the entry by right-clicking the entry and using "add application" ?

    I just wonder if the fully qualified path for the executable in the filter list is correct ?  

    Otherwise, it sounds like a filtering bug.

    Tuesday, August 20, 2013 1:54 PM
  • I added the application by browsing to its directory and selecting the exe, so it should have opted it out...
    Wednesday, August 21, 2013 3:24 PM
  • Yes, the path should be correct then.

    Sounds like a filtering bug.

    Thursday, August 22, 2013 10:32 AM
  • Yes, the path should be correct then.

    Sounds like a filtering bug.

    Anyway to report a bug to Microsoft?
    Thursday, August 22, 2013 12:54 PM
  • Yes, the path should be correct then.

    Sounds like a filtering bug.

    Anyway to report a bug to Microsoft?

    Hi Gijs007,

    Yes, you can email the EMET team using the address listed on page 38 of the EMET 4.0 User’s Guide (found in section 7: Support of the User Guide). This is a PDF file that is located in the installation folder of EMET 4.0. By default this installation folder is located at the following path:

    32 bit Windows:
    
    C:\Program Files\EMET 4.0
    
    64 bit Windows:
    
    C:\Program Files (x86)\EMET 4.0

    While this email address is not for technical support, it is a feedback address for EMET 4.0.

    It would be of benefit if you could provide a link to this forum thread in your email to the EMET team. The more information that you can provide the better.

    I hope this helps and thank you for highlighting this issue.

    • Edited by JamesC_836 Thursday, August 22, 2013 8:53 PM Minor edit
    Thursday, August 22, 2013 8:50 PM
  • Yes, the path should be correct then.

    Sounds like a filtering bug.

    Anyway to report a bug to Microsoft?

    Hi Gijs007,

    Yes, you can email the EMET team using the address listed on page 38 of the EMET 4.0 User’s Guide (found in section 7: Support of the User Guide). This is a PDF file that is located in the installation folder of EMET 4.0. By default this installation folder is located at the following path:

    32 bit Windows:
    
    C:\Program Files\EMET 4.0
    
    64 bit Windows:
    
    C:\Program Files (x86)\EMET 4.0

    While this email address is not for technical support, it is a feedback address for EMET 4.0.

    It would be of benefit if you could provide a link to this forum thread in your email to the EMET team. The more information that you can provide the better.

    I hope this helps and thank you for highlighting this issue.

    I've contacted them a couple of weeks ago but they haven't responded.
    Is there any other way to report bugs?

    Friday, September 6, 2013 7:01 PM
  • Hi Gijs007,

    I am sorry to hear that the EMET team did not respond to you. I'm afraid that I am not aware of any other official way of reporting bugs to them. You could try sending a tweet to Jonathan Ness' Twitter profile but he not may respond to you either.

    I also contacted twice them about the issue discussed in the following thread, they never responded to me either:

    http://social.technet.microsoft.com/Forums/security/en-US/9071b55b-dd7c-4b27-8c4f-8093dd080238/are-all-internet-explorer-10-processes-protected-by-emet-40

    Thanks.

    Sunday, September 22, 2013 7:14 PM
  • I've contacted him with my business twitter account, hopefully he will look at it.
    Wednesday, September 25, 2013 6:56 PM