EMET 4.0 / SimExecFlow

EMET 4.0 blocking SUMo due to SimExecFlow with no more details...

Error message is

EMET detected SimExecFlow mitigation and will close application : SUMo.exe

I'm the developper of SUMo and some users are reporting this screen being displayed and blocking my software.

What did i do wrong ? How can this be fixed ?

 

Did you try asking your question here? http://social.technet.microsoft.com/Forums/security/en-US/home#forum=emet&filter=alltypes&sort=lastpostdesc&brandIgnore=true&page=2&content=Search

 

Yes but no reply so far : http://social.technet.microsoft.com...-sumo-due-to-simexecflow-with-no-more-details

 

This is a ROP mitigation and as such only applies to x86 processes.

Per the EMET 4 user manual "This feature tries to detect ROP gadgets following a call to a critical function. Like the "Caller checks"."

 

Yes but how can i find out which part of my code is going wrong ?

 

Use a debugger? I assume you can get a stack trace and track the code that caused this.

 

But what can i use as a trigger to get the fauly line of code ?

 

No idea, if I could answer that you wouldn't need the debugger.

 

Perhaps try also to ask on kernelmode.info

 

In the applications settings for EMET, change to audit only. It might give you a bit more info in the EMET log.

 

... how do you install EMET ?

 

There are multiple versions. Here is a link to the latest 4.0 version: http://www.microsoft.com/en-us/download/details.aspx?id=39273.

Better read up on how to use/configure it. Then try to duplicate the user EMET configuration having problems with your software on your PC.

 

If I remember correctly it doesnt happen automatically, only when you add sumo to the apps list and enable manually.

 

OK, i'll try right now.

Thanks !

 

Take a hard look at all the ROP mitigation one of which is simulate execution flow. The others are load library checks, memory protection checks, caller checks and stack pivot.

The ROP mitigations are the big difference between EMET 3.0 and 4.0. They only apply to x86 processes. W.O.T. has been acting up on my PC ever since I installed EMET 4.0. Finally traced it back to the load library checks mitigation which monitors all calls to API loadlibrary and also prevents loading of libraries from UNC path. It is the latter that I strongly suspect was hanging W.O.T. in IE9.

Once you find out which mitigation is hanging your software, you will have to instruct your users to turn it of for your app. You can also report your findings in the EMET user forum. You will also have to contact Microsoft to see if the problem can be fixed in the next EMET release.

 

I've been unable to track the faulty line of code : EMET blocks before my first line of code, therefore, debugger is of little help...

Where can i report my case to EMET support ?

 

I would just tell your users to turn off the SimExecFlow mitigation for your application and leave it at that. You have already posted the problem in the EMET forum.

EMET is the category of optional security software as far as Microsoft is concerned. In other words, "you take it or leave it." To date, they have fixed known issues with each new release of the product but no guarantees.

 

ok, thanks !