Whitehat Shellcode VS Shellcode 2° to heapspray

[trismegistos]

Didier Stevens' CounterHeapSpray

By planting its own shellcode before the heap spray can fill the heap with malicious shellcode, CounterHeapSpray not only prevents execution of this malicious shellcode but is able to suspend the process and to inform the user of the attack.

https://blog.didierstevens.com/2012/...nterheapspray/

[STV0726]

EMET 3.6 shall include a new mitigation CounterCounterHeapSpray.

[trismegistos]

Originally Posted by STV0726

EMET 3.6 shall include a new mitigation CounterCounterHeapSpray.

A typo, perhaps? Why would EMET counter a CounterHeapSpray.

Yeah, I know about EMET offering a solution against Heap Spray that's why I didn't post this tool in the other anti-malware or other software and services subforum. But perhaps more whitehats will follow the lead of Didier about the concept of a shellcode fighting a malware exploit code.