Bypassing EMET 3.5′s ROP Mitigations

Any truth in this article?

https://repret.wordpress.com/2012/08/08/bypassing-emet-3-5s-rop-mitigations/

 

Yes, it's true. This was discussed in the EMET topic.

Unfortunately for Windows users there are a select few areas of a programs address space that will always remain static - no matter if you're using EMET or ASLR Always On or not.

This demonstrates that even a single area of address space is sufficient for an attacker to bypass ASLR.

Once they've done that it's a matter of bypassing EMET's new Anti-ROP mitigations, which isn't very difficult.

This doesn't mean EMET is 'broken' or 'weak' - it's still going to protect you from exploits, it's still going to make exploits harder to write, and generic exploitation of a program running EMET is still difficult.

 

very true

 

Thank you Hungry Man.