EMET 5.1 + Windows 8.1 Disable ASLR?

I recently upgraded to windows 8.1 from windows 7. On win7 I used EMET to disable system ASLR so that I could work on binaries that react if they are modified. Now with windows 8.1 it seems that the setting inside EMET to disable system wide ASLR does
nothing. Is there a workaround or another way to disable ASLR on 8.1?

I'm not sure if this can be disabled in Windows 8.1, but you might want to try a couple of things. First verify the ASLR value from the command line using the "emet_conf --list_system" command to make sure it is as expected there too.
The registry setting EMET changes in Windows 8.1 for system-wide ASLR is the REG_QWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\MitigationOptions. The full description of this setting appears to be at the end of the paper http://0xdabbad00.com/wp-content/uploads/2013/11/emet_4_1_uncovered.pdf.
The last three number in the value are for ASLR, SEHOP, and DEP respectively. 6=Disabled, 5=Enabled, 2=OptIn, 1=OptOut. For example, it may look something like 0x00000022, which is unspecified for ASLR, and SEHOP and DEP set to OptIn.
Manually changing it to 0x00000622 will set ASLR to Disabled, and SEHOP and DEP will be OptIn.
Another quirk in Windows 8 is that "Reboot" is typically the only clean way to power down+restart. Doing a "Shut Down" caches a few things to disk I believe instead of the actions done with a full shut down in previous versions.
Another avenue to try if Windows 8.1 can't disable ASLR system-wide would be to modify the binary's header value for Dynamic Base using mt.exe from Microsoft (takes a little bit of work) or another third party tool. This SANS blog has information on
that:
http://digital-forensics.sans.org/blog/2014/02/17/malware-analysis-and-aslr-on-windows-8-1

Similar Messages

The checkbox (Install or remove Windows 7) is disabled in bootcamp.

Hi, I want to get rid of windows that was installed using bootcamp on my early 2011 macbook pro but the checkbox (install or remove windows 7) is disabled in bootcamp. I tried to format the drive using disk utility but failed, It says "couldn't modify partition map". What can I do to remove windows 7 and unite all the data in my HDD into one single partition?

2 things, the option is greyed out because (1) 1st 2 items are unchecked or (2) the USB containing Windows and the drivers is not detected.
The newer 2013 machines seem to be very picky about the Windows install, as keys that worked on 2012 machines would no longer work on the 2013s. If you want a painless install, do this
DL the correct W7 ISO from here http://techverse.net/download-windows-7-iso-x86-x64-microsofts-official-servers/ - SP1 ISOs
Then insert your USB and select all 3 options. The program will copy this new ISO to your USB.
Only use a USB2 (not USB3) drive

UI font name in Windows? I disabled mine.

I need to know the name of the UI font for Photoshop CS2. Upon startup I keep receiving the "UI font not found" error. I have over 1000 ttf and ps fonts and occasionally disable some of them; to keep that piece of Windows XP stuff working corectly. Must have disabled the font. Don't really want to enable all the fonts. The system would crash.

Thanks R_Kelly for your reply. I found the ADMUI3.fon in my G:\ttl folder; which is where I keep all my non postscript fonts.
Now, all I have to do is to remember how to get ATMfn4 to reactivate that font - it doesn't show it as available - and I'll be ok. Or may be I'll just move it into K:\ps9; which is where psCS2 is installed, or may be into C:\windows\fonts. I've forgotten how to install fonts on Win XP. May be they just need to be moved, but then again this is a .fon file and I'm only really used to .pfb's or .ttf's or .otf's.
Would you care to comment on the previous paragraph?
[email protected]
Date: Thu, 14 Feb 2013 13:20:38 -0800
From: [email protected]
To: [email protected]
Subject: UI font name in Windows? I disabled mine.
    Re: UI font name in Windows? I disabled mine.
    created by R_Kelly in Photoshop General Discussion - View the full discussion
I believe the ui font for cs2 is ADMUI3.fon. If you look in C:\Program Files\Adobe\Adobe Photoshop CS2\Required is that font in the folder.
     Please note that the Adobe Forums do not accept email attachments. If you want to embed a screen image in your message please visit the thread in the forum to embed the image at http://forums.adobe.com/message/5074054#5074054
     Replies to this message go to everyone subscribed to this thread, not directly to the person who posted the message. To post a reply, either reply to this email or visit the message page: http://forums.adobe.com/message/5074054#5074054
     To unsubscribe from this thread, please visit the message page at http://forums.adobe.com/message/5074054#5074054. In the Actions box on the right, click the Stop Email Notifications link.
     Start a new discussion in Photoshop General Discussion by email or at Adobe Community
For more information about maintaining your forum email notifications please go to http://forums.adobe.com/message/2936746#2936746.

Windows Aero Theme Disabled When Undocking Laptop

Hi everyone,
My problem is quite simple (at least to explain). I am using a X230 bought in August 2012 with the Ultrabase docking station and a Philipps external display (not sure about the exact reference, but I don't think it's relevant anyway) connected to the docking station via VGA. All in all, the computer has everything needed to run high quality graphics.
When my laptop is docked, everything works perfectly fine with regards to display: desktop is extended over the two screens, Windows Aero features work fine, etc.
When I undock my laptop, the aero mode is automatically disabled (even when I am plugged in and not running on battery), and the left side of my screen has no "edge" (i.e. behaves just like the extended desktop, as if the external display, which is usually on the left, were connected and running).
Concerning the Aero problem, I ran the Aero troubleshooter, which returned two issues to be solved:
1. Color depth is too low. I checked this, and it's set on 32 bit TrueColor already, so this should not be an issue
2. Desktop Windows Manager is disabled. Once again, this feature seems to be running (I went to Services->Desktop Window Manager and it seems to be OK).
I have tried several solutions found on the internet/microsoft forums, but none worked. I am pretty sure that this problem appeared after a Windows update (a massive one, as I have disabled automatic update).Oh, and the Intel Graphics and Media Control Panel doesn't show up either. It shows up in the taskbar when I open it, but I don't get any dialog box/program on my screen.
Regarding the "fake" extended desktop... well apart from checking that there is only one display detected when I'm undocked, I don't really know what to look for. This is less of a problem though, as I can easily live with it.
Many thanks,
Matthieu

I may have come up with a new lead on this issue. I found this thread on the Apple forum:
https://discussions.apple.com/thread/4580006?start=0&tstart=0
I have exactly the same problem with Quicktime and it may be worth trying to uninstall/reinstall the graphics driver. I really don't want to screw things up though.
How should I proceed? Should I use the "uninstall driver" in the control panel? What will happen next: black screen, poor resolution? After I'm done, is this the correct driver I should reinstall?
http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS029033
M.

Unable to follow links in pdf document which use asynchronous pluggable protocol on Windows unless we disable extended security completely (Reader 11.0.7) - is there any other way round this?

We have a pdf document which contains links of the format appname://some/path.
This is using Windows Asynchronous Pluggable Protocols which we have defined in the registry so these links should launch the application with the path as an argument.
If we disable enhanced security in Reader 11.0.7 then this works - otherwise it just fails to do anything.
With enhanced security on, we get warning and select trust this site for all pdfs.
Adobe then stores the first part of the path i.e. for appname://some/path it will store path in [HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\TrustManager\cDefaultLaunchURLPerms].
Don't get warning after that but the application still doesn't launch if enhanced security is enabled.

Apologies was mislead - it's not enhanced security which is causing the issue, it is protected mode.

Blocking popup windows even when disabling the popup blocker

For quite some time now, Firefox has been blocking essential popup windows on my computer. It's not just those annoying ones, even those when I am trying to write an email and similar things. I have disabled the popup blocker and it does not change anything at all. It does not alert me that it has blocked anything either, it is simply as if I never clicked anything in the first place. I have tried adding exceptions to my popup blocker, and this does not work either. This is really frustrating and is interfering with my daily use of firefox, and forces me to use crappy explorer which does not block things. What can I do?

Hi Sachin
Thank you so much for the reply.
About your request, the codes that I used are:
HTML for the PopUp:
<SCRIPT LANGUAGE="JavaScript">
function popUp(URL) {
var iMyWidth;
var iMyHeight;
//half the screen width minus half the new window width (plus 5 pixel borders).
iMyWidth = (window.screen.width/2) - (250 + 10);
//half the screen height minus half the new window height (plus title and status bars).
iMyHeight = (window.screen.height/2) - (225 + 50);
//Open the window.
var win2 = window.open("http://xarao.businesscatalyst.com/caipiroska.html","Window2","status=no,height=450,width=500,resizable=yes,left=" + iMyWidth + ",top=" + iMyHeight + ",screenX=" + iMyWidth + ",screenY=" + iMyHeight + ",toolbar=no,menubar=no,scrollbars=no,location=no,directories=no");
win2.focus();
</SCRIPT>
For the Link:
javascript:popUp('http://xarao.businesscatalyst.com/caipiroska.html')
Of course for all the different links in the page I've changed the http of each image in both codes.
http://xarao.businesscatalyst.com/cocktails.html
Thank you once more.
Best regards,
Augusto

Windows Update Service Disabled - Error 80070422

Hi,
On Windows Vista Ultimate SP1, when I go to Windows Update I see a "Check For Updates" button. When I click it I get an 80070422 error and "Try Again" button which does not work.
I have tried all that is explained in Help on this error, but it's still not working. Let me write in more detail: I opened "Administrative Tools", went to "Services", "Windows Update" service is disabled. I set the "Startup Type" to "Automatic", click on Apply and then I click the "Start" button to start the service. I get an error: 1058: "Windows could not start the Windows Update service on Local Computer", "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it".
I downloaded "WindowsUpdateAgent30-x86.exe" and installed it, hoping that the problem will be fixed, but no luck.
I read somewhere on this forum that a user faced a similar problem and searched in "Windows\System32" for "wu*.*" files and changed the security settings for all of them to allow SYSTEM and Administrators full control and re-registered through "regsvr32" all of the .dll files, but, after doing all of these I still had no luck.
My Windows Update still displays the error 80070422 and when I try to start the Windows Update service I get the error that the service cannot be started and it always sets itself on "Disabled", no matter what I do.
Could someone please help me with this problem? I really don't know what else to do.

Wow, great!
I ran the tool that you mentioned and the virus in question was detected as: Trojan.Vundo
Maybe the logs will help some others, too: Here's the log on the first scan:
Malwarebytes' Anti-Malware 1.14
Database version: 808
8:40:22 PM 5/31/2008
mbam-log-5-31-2008 (20-40-22).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 169731
Time elapsed: 42 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 8
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Unloaded module successfully.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1449fa3b-f8a5-40ec-87da-707e80637ddd} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{663656df-6bae-460c-a612-8133df519346} (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\byxohabu -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Delete on reboot.
C:\Users\Shere Khan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LK0KREDB\kb516107[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\fccywwts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\gEwtTLFy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\yayvSiHb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\_Shere_Quarantine\fmsnvygd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXnMghG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\byXPfgfe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Here's the log on the second scan, after a restart:
Malwarebytes' Anti-Malware 1.14
Database version: 808
9:48:01 PM 5/31/2008
mbam-log-5-31-2008 (21-48-01).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 168808
Time elapsed: 56 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows\System32\byXOHaBU.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\dqhreobq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
On the third scan, no other infections were found. The files and locations and one or two registry entries are similar to what I suspected was not allright, so I guess the (right) virus has been found and eliminated. Have enabled Java in FireFox and everything seems fine, haven't touched Internet Explorer just to be on the safe side so I can't say anything about that, but everything looks allright. Seems this was the problem. Thanks again, mate, your post was a life saver.

Windows Installer Services Disabled

Hi,
Today I have checked my windows installer for some reason and found it's in disabled mode. I just wondered why this services went to disabled mode and able to start or stop the services. The same services I can able start
and stop with out any issues in other machines. Please see the screen shot for more details.
OS - Windows 8 Pro
Regards,
Thiyagu.

Contact the machine's maintainer, for example the IT department if it is managed by the IT. If you manage the machine yourself, ask on answers.microsoft.com.
This web site is for help in writing software, and you are not writing one, so your question is off-topic here.
Visual C++ MVP

Windows 7 GPO - Disable All Removable Media then Re-enable, now CD/DVD drive is inaccessible

Ok, this might be better placed in the Windows 7 forum, but we're having some issues with limiting access to removable media via GPO.
We've set up a GPO for Computer Policy, Admin Templates, System, Removable Storage Access, All Removable Storage classes: Deny all access - Enabled
After finding that this was a bit too restrictive we reset it back to Not Configured (and later Disabled to try and force it) but it seems to break our DVD drives on all Win7 x64 machines (the gpo is limited to apply only to these machines). Instead
of the usual icon in my computer it shows a description of the CD/DVD in the drive and the usual "unknown file type" icon. if you take the cd out it shows the usual cd rom icon, but still gives "access denied"
There is one workaround, and that is to set the GPO back to not configured and manually remove the CD/DVD device via device manager, restart, and allow windows to re-install the device drivers.
This is 100% repeatable by applying the same local computer policy (All Removable Storage classes: Deny all access - Enabled" and restarting the machine.
Has anyone else run into this problem before? And how can we fix it without having to go to every machine to remove the DVD drive from device manager?
Thanks,
-Nick

Hi,
after looking on many pages for a solution i always found the same workarounds - but for me deleting the device is no option because you aren't allowed to delete devices without administrative rights. Also I can't expect that our users always have to reinstall
the device.
So i analyzed whats going on in the registry when the key "Deny_All" for blocking RemovableStorageAccess is set to 1 - with the running of gpupdate i realized that Windows is writing a registry key to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\Device\
named "security". The problem is that windows doesn't delete this key after setting the key "Deny_All" back to 0. Only sometimes it will be deleted, for example when you apply the policy for blocking devices and reverse this setting immediatly without a restart
of windows.
I made a little script which I integrated in the user-gpo (as logon script) for granting access to the removable storage devices:
'****SCRIPT START****
' this script searches for all "security"-keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\ and deletes them
Option Explicit
Const HKEY_LOCAL_MACHINE = &H80000002
Dim oReg : Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
Dim oShell : Set oShell = CreateObject("WScript.Shell")
Dim sPath, aSub, sKey, aSubToo, sKeyToo, dwValue
' Get all keys within sPath
sPath = "SYSTEM\CurrentControlSet\Enum\IDE"
oReg.EnumKey HKEY_LOCAL_MACHINE, sPath, aSub
' Loop through each key
For Each sKey In aSub
    'Get all subkeys within the key 'sKey'
    oReg.EnumKey HKEY_LOCAL_MACHINE, sPath & "\" & sKey, aSubToo
    For Each sKeyToo In aSubToo
        oReg.deleteValue HKEY_LOCAL_MACHINE, sPath & "\" & sKey & "\" & sKeyToo , "Security"
        if Err.Number<>0 then
            Err.Clear
        end if
    Next
Next
'****SCRIPT END****
The policy for giving access to removable storage looks like this now:
- a logon script is executed which searches for all "security"-keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\ and deletes them
- the setting "All Removable Storage classes: Deny all access" ist set to "Disabled"
I hope this helps...
Regards
Swanson

Windows XP - Howto Disable the broken backup process

I finally found a source on how to disable the backup process during the iPhone sync. Here's the link. Tried it myself and works great. I plan on removing this XML edit once Apple distributes a proper fix:
http://www.eidac.de/?p=60
From the article:"
Disabling the slow iTunes Backup on Windows is a little more tricky, but it works. First of all close ITunes and then follow these steps:
1. Locate your iTunesPrefs.xml file. It’s usually located in C:\Documents and Settings\username\Application Data\Apple Computer\iTunes or C:\Documents and Settings\username\Local Settings\Application Data\Apple Computer\iTunes.
Hint: If the folder Application Data does not show up, make sure that hidden files are visible in the Windows Explorer
2. Backup your iTunesPrefs.xml file
3. Open iTunesPrefs.xml using a capable text-editor (e.g. Notepad++, Ultraedit, but not MS Notepad)
4. Search for a section called User Preferences and paste the following snipped into the User Preferences Section after the first <dict>:
<key>DeviceBackupsDisabled</key>
<data>
dHJ1ZQ==
</data>
After you’ve done that it should exactly look like the screenshot on the left.
5. Save the file and restart iTunes. Backups should now be disabled. To enable backups again delete the XML Snippet from iTunesPrefs.xml file."

Hi Nick,
There isn't an easy way to do it via Mac OS X or System Preferences. But I did find this article that looks like it has some pretty good resources.
http://www.macosxhints.com/article.php?story=20071121141206367

Unable to login Windows 7 after disable Veriface 4.0

Hi all, i accidentally activated veriface 4.0 in my Ideapad U410 but find it useless and disabled it.
When i try to turn on my laptop the next day, was asked for password which i never set one. now im stuck at windows login without password and do not have a recovery disk to reset the password. please help!!

TanCH wrote:
Hi LenBlazer,i manage to login to safemode but password is still required. How should i preceed next?
Here is the link that says that veriface will not load in safemode and you should be able to bypass it. Try it again using the procedure given in the link. http://support.lenovo.com/en_US/diagnose-and-fix/detail.page?DocID=HT071368

Prevent BEx from stealing windows focus and disable nag screen

Hi all,
Whenever I start BEx Analyzer or QueryDesigner (3.5) it takes a couple of minutes until the application is loaded. During that time a welcome screen turns up, which prevents me from doing anything else but staring at the photo of the SAP Building.
For some reason the log on pad pops up as well.
When reloading a query in Bex Analyzer, the application steals the windows focus several times.
Does anyone know how I can disable these "features"?
Thanks
Gerrit

We have the same problem when reloading queries in BeX Analyzer.
Did you find a solution to prevent the application to steal the windows focus several times.
Thanks for your answer.

The log & capture window has become disabled...can control cam, but no vid.

I have been capturing 24p footage from the DVX100a and the log & capture feature has been working fine, until after the print to video feature was used. Now the device control works, but it will only display color bars. I have checked and rechecked the audio/video settings, as well as user preferences. Am I missing something simple?

? Am I missing something simple? < </div>
Probably but it's impossible to tell from here. Search the forum for your camera model and for preview disabled. We get at least one post a day on these topics. I don't follow the threads, I just see them all the time.
Try shutting down your system, disconnect the FW stuff, restart. Usually resets the FW bus. But there are many cameras out there now that tend to drop in and out of the preview window.
bogiesan

Windows 10 TP disables Intel HD Graphics driver

I'm really sorry if this is answered somewhere else but I have given up searching. I'm not a 'Tech Pro' so apologies for posting here - I just can't find any public forums for it.
A routine update of Windows 10 TP/IP a few months ago (not 100% sure which one) disabled my Intel(R) HD Graphics driver. In Device Manager, my driver has the error message:
This device cannot find enough free resources that it can use. (Code 12)
If you want to use this device, you will need to disable one of the other devices on this system.
Could anyone please help?
Thanks.

reboot the machine a few times and see if that helps get windows to reorganize the devices
more machine specs would be useful
Place your rig specifics into your signature like I have, makes it 100x easier!
Hardcore Games Legendary is the Only Way to Play!
Vegan Advocate How can you be an environmentalist and still eat meat?

Windows menu mostly disabled (eg. Layers). Trial limitation?

Hi all,
I just downloaded the Trial version of Elements. I want to be sure it's good for what I want (2D game graphics) before I purchase. I tried to create a simple into screen for my game, but the Layers window in the Windows menu is greyed out (as is 90% of the Windows menu).
I can seemingly create new layers with the Layers menu, but since I can' open the Layers window, I can't do much between them.
Is this a limitation of the trial, or am I doing something stupid?
Another small queston, when I select some text, the Copy/Paste options are greyed out, unless I select everything else in the document. Is this because they're on the same layer, or does it sound strange? I wanted to copy/paste my text (to creat a flipped, reflection), but I just couldn't find a way to do it.
Thanks.
Danny

Windows. When I start it, I Get the below splash screen. Clicking CREATE loads Elements with lots of stuff (like all of the windows: layers, history, effects, etc.) disabled. Clicking EDIT loads it with all this stuff enabled. I think the CREATE option is for using wizards to create flyers and stuff. I'd rather just skip this and have it load in the EDIT mode every time.

EMET 5.1 + Windows 8.1 Disable ASLR?

Similar Messages

Maybe you are looking for