Crash in [@ LdrpSnapModule] caused by Microsoft's EMET
Categories
(External Software Affecting Firefox :: Other, defect, P3)
Tracking
(Not tracked)
People
(Reporter: yoasif, Unassigned)
Details
(Keywords: crash)
Crash Data
This bug is for crash report bp-2a226846-244c-4c63-96a4-f84770200111.
Top 6 frames of crashing thread:
0 ntdll.dll LdrpSnapModule
1 ntdll.dll LdrpMapAndSnapModules
2 ntdll.dll LdrpPrepareModuleForExecution
3 ntdll.dll LdrpLoadDll
4 ntdll.dll LdrLoadDll
5 emet64.dll emet64.dll@0x47fd9
Also reported in https://www.reddit.com/r/firefox/comments/enge0k/since_updating_to_ff72_ive_had_several_random_tab/
emet64.dll appears to be a common reference. That is part of Microsoft EMET (Enhanced Mitigation Experience Toolkit). I've used EMET for years, and never had a problem between it and Firefox until today.
Reporter | ||
Updated•5 years ago
|
Comment 1•5 years ago
|
||
Sending to Widget:Win32 for a first look.
Comment 2•5 years ago
|
||
The priority flag is not set for this bug.
:jimm, could you have a look please?
For more information, please visit auto_nag documentation.
![]() |
||
Comment 3•5 years ago
|
||
Hey Toshi, do you think we can block this Microsoft thing?
https://www.blackhat.com/docs/us-16/materials/us-16-Alsaheel-Using-EMET-To-Disable-EMET.pdf
Comment 4•5 years ago
|
||
Probably this is caused by EAF (= Export Address Filtering). Can you disable EAF/EAF+ for firefox.exe and see the crash still happens or not? As discussed in Bug 1509748, it's not guaranteed that firefox works with EAF.
I think our blocklist can block emet64.dll, but it means all EMET mitigations would be implicitly disabled in firefox. If the problem is only EAF, we don't want to disable the other mitigations.
![]() |
||
Updated•5 years ago
|
Description
•