[tor-bugs] #13893 [Tor Browser]: Torbrowser 4.0.X crashes on start when using MS EMET 5.1

[Tor Bug Tracker & Wiki]

#13893: Torbrowser 4.0.X crashes on start when using MS EMET 5.1
-----------------------------+----------------------
     Reporter:  Diapolo      |      Owner:  tbb-team
         Type:  defect       |     Status:  new
     Priority:  major        |  Milestone:
    Component:  Tor Browser  |    Version:
   Resolution:               |   Keywords:  EMET
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+----------------------

Comment (by Diapolo):

 The default protection profile for firefox.exe (which is also used for the
 Tor Browser) is this here:

 <AppConfig Path="*" Executable="firefox.exe">
   <Mitigation Name="DEP" Enabled="true" />
   <Mitigation Name="SEHOP" Enabled="true" />
   <Mitigation Name="NullPage" Enabled="true" />
   <Mitigation Name="HeapSpray" Enabled="true" />
   <Mitigation Name="EAF" Enabled="true" />
   <Mitigation Name="EAF+" Enabled="true">
     <eaf_modules>mozjs.dll;xul.dll</eaf_modules>
   </Mitigation>
   <Mitigation Name="MandatoryASLR" Enabled="true" />
   <Mitigation Name="BottomUpASLR" Enabled="true" />
   <Mitigation Name="LoadLib" Enabled="true" />
   <Mitigation Name="MemProt" Enabled="true" />
   <Mitigation Name="Caller" Enabled="true" />
   <Mitigation Name="SimExecFlow" Enabled="true" />
   <Mitigation Name="StackPivot" Enabled="true" />
   <Mitigation Name="ASR" Enabled="false" />
 </AppConfig>

 This lists the SimExecFlow mitigation technique, which is one from
 different ROP (return oriented programming) techniques in EMET, which
 Microsoft describes as: "Without EMET in place, attackers can take
 advantage of a predictable mapping of those dlls and could use them in
 order to bypass DEP through a known technique called return oriented
 programming (ROP)."

 Some details are listed here:
 http://blogs.technet.com/b/srd/archive/2012/07/24/emet-3-5-tech-preview-
 leverages-security-mitigations-from-the-bluehat-prize.aspx

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13893#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online