DynamoRIO / DynamoRIO/dynamorio
EMET thwarts injection
Open
Hotlist-Release
Migrated
OpSys-Windows
Priority-Medium
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on September 27, 2014 22:47:46_
Trying to run powerpnt.exe from Office 2010 under DR on one of my machines recently resulted in powerpnt launching natively, whether I tried drrun, from-parent injection, or AppInit. This is a 64-bit app, so not wow64 layer.
Disabling all the checkboxes for EMET for powerpnt.exe and it then runs fine under DR.
_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1546_
Contributor guide
Assessment
This issue has not been assessed yet.