New Emet 4 compatibility on Xp?

[mr666]

I have an old WinXp 32bit.
I have recently bad news from my fresh MS Emet 4 installation: a lot of programmes can not work if they have mitigation policies, but worst is Palemoon which is not working at all: it just freezes when I try to open it : so probably I will try to follow "How to completely remove and reinstall Pale Moon".
May be something wrong for anyone else in the same way: I am not sure, if the issue is going to repeat: I should eliminate Emet or change Palemoon for Chromium...
Thanks!
Paolo

[Moonchild]

I don't see why you would need EMET to begin with. Pale Moon uses DEP, ASLR and SEH if available in the OS and that is something that is very much wanted... XP has no issues running Pale Moon, so I think if it freezes up when you have EMET installed, that it's an EMET problem...

[satrow]

EMET on XP can only use a subset of the features it uses on later OS'es, could it be that you've ticked too many boxes (one that's incompatible) for Pale Moon?

[mr666]

I meant: 60% of my applications opting in Emet 4 are crashing... I have just used PM leaving out from Emet mitigation and in this way it works plenty.
In any case I would like to know something about Palemoon and DEP, please.
Other than this Palemoon developer says:

Pale Moon uses DEP, ASLR and SEH if available in the OS and that is something that is very much wanted.

, I find Emet having SEHOP and BottomupASLR functions; Can I think they are the same he mentions? They should work with EMET 4 on Xp, in any case.

Thanks
Paolo

[Moonchild]

I don't know EMET well enough to know exactly what it does or tries to do. Pale Moon doesn't need any "help" to employ safe exception handlers or ASLR as they are already present in the binary (options are enabled when compiling). If it tries to apply its own version on top, that may certainly cause crashes. Pale Moon is also compiled with the NXCOMPAT flag, enabling the NX (NoeXecute) CPU/OS capabilities if they are present.

[mr666]

It is all Greek to me( I am Italian)...

1. Are these options in firefox too or is it just your own development?
2. This code is effective to protect PM from hack and exploit?
3. What do you think of FF/ PM not having plugins in sandbox like Chromium? Could it be something new about it in next versions?

(At any rate about ASLR and safe exception handler: I am not really sure they work in EMET with WinXp, on a system wide level they do not anyway)

Thank you,
Paolo

[Moonchild]

1. Firefox should be built with all this enabled as well.

2. Yes, it is. Up to the level any other program gets protected with the same techniques, that is. They are basic techniques to prevent a few potential exploits. Of course any in-code vulnerabilities still need to be addressed since those will not be stopped by DEP, ASLR or SEH.

3. Plugins do run in their own (limited) process (the plugin container) preventing direct code access to the rest of the browser. This is a sandbox of sorts and probably similar to what Chromium does (I'm not familiar with the Chromium code to know the fine differences)