From following this program and using it from early on, I can tell you the “shielded applications” counter has been bugging since the beginning and they havn’t completely solved this issue (even yet)
You can always confirm the shielded app by checking the logs tab.
Edit: I should also mention I have not had any, nor have I read of any issues between Avast and ExploitShield now MBAE.
I don’t believe Polonus has had any issues either, but I should let him speak for himself. 8)
@schmidthouse thank you for you’re feedback I do really appreciate your help on this issue while I was waiting for polonus feedback, well to tell you the real truth this issue still hasn’t been fix on v0.9.2 as been said on Malwarebytes Anti-Exploit Shielded forum from Malwarebytes as I’m currently using the latest FF v22.0
Edit: Yes according to Malwarebytes Anti-Exploit Shielded log saying FF is protected while the shielded application count keeps on going back and forward…0 to 1 all the time which is bloody strange.
Yes, there are bugs and hick-ups. Code is not yet in thegeneral beta phase. Beyond an occasional crash, I did not see programs shut down. Thereis also an issue withWindows Defender,
Hi Bob, Are you using the latest beta version? [ 0.9.2.1200] Found here:http://forums.malwarebytes.org/index.php?showtopic=128145
Apparently this “back counting” bug was/is supposed to be fix in this latest version.
You could report that in this thread if you care too : http://forums.malwarebytes.org/index.php?showtopic=128314
I have not seen that with my installation, but the ’ showing 0 shielded apps’ when there are shielded Apps, is still bugged.
Not sure if that helps.
See some comments on the code used starting from C : \ E n u m I n j e c t R e q u e s t c r a s h , C : \ S e s s i o n G o n e c r a s h, C : \ P r o c e s s G o n e c r a s h, C : \ D e s k t o p \ I o c t l c r a s h - accessibility identifiers to all the elements: pViewOfSection ZwCreateSection routine creates a section object. driver - ZwCreateFile ZwWriteFile - there is ExAllocatePoolXXX function set to allocate memory from the system pools and ExFreePool to release. … are zero terminated ->V ExFreePool _stricmp -declaration of _SYSTEM_PROCESSES structure ( System Information Class 5 ) with ZwQuerySystemInformation works fine for this purpose to construct process tree → ZwQuerySystemInformation - write user mem from driver -PEPROCESS)process,&ApcStAte) write user memory from driver -KeStackAttachProcess - this has a strange kernel-mode bug ->PsLookupProcessByProcessId - POSIX functions are deprecated. Use the ISO C++ conformant _stricmp instead for wcsicmp - depending on an undocumented function as ZwQueryInformationProcess API available in NTDLL.dll – ObfDereferenceObject decrements the given object’s reference count and performs retention checks - KeUnstackDetachProcess detaches the current thread from the address space of a process and restores the previous attach state – ObOpenObjectByPointer function opens an object referenced by a pointer and returns a handle to the object, this is minifiltering – memmove moves block of memory- ZwQueryInformationToken - ZwAllocateVirtualMemory - ZwQueryInformationFile - wcscat, function is deprecated because more secure versions are available - - KeInitializeMutex mutex on a struct for a kernel device driver - should be tested with https://www.reactos.org/archives/public/ros-diffs/2012-September/047083.html (source tfaber)- KeWaitForSingleObject, the thread calls KeWaitForSingleObject with a pointer to the timer object, which puts the thread into a wait state - KeReleaseMutex KeReleaseMutex routine releases a mutex object, and specifies whether the caller is to call one of the KeWaitXxx routines for certain wait reasons - _wcslwr depreceated used to cleanup the /lib directory- RtlCompareMemory routine compares two blocks of memory and returns thenumber of bytes that match-RtlUnwind will initiate an unwind of procedure call frames -ntoskrnl.exe is the OS kernel image, provides and segments kernel space, and manages services such as hardware virtualization, memory management, and process scheduling
. This is a short oversight, and possible weak points are set out in bold,
An answer to the above can be found here: http://forums.malwarebytes.org/index.php?showtopic=128456&hl=%2Banalyzer
So a new hooking framework is under development. Recently there was also a glitch in the cooperation of mba-e and the chrome browser resulting in bringing down mba-e, so it had to be restarted. Also saw in the logs:
Malwarebytes Anti-Exploit can not create the Inter-Process Communication (IPC) Channel
Thanks for keeping a finger on the pulse for me.
We will keep this beta reports coming here and there as well.
I will keep you informed of upcoming developments my friend…
Got a crash for the mbae executable with this error: module with error MSVCR100D.dll, version 10.0.30319.1, timestamp 0x4ba1dbd4, exclusion code 0xc0000005, errormarge 0x000f32a4, process-id 0xb50, starttime 0x01ce75820df000b1.
MSVCR100D is debug version of runtime library used by VC2010
Could have been an issue with avast as special apps have been incorrectly patched for behav.shields/sandbox before as avast! team member pk has reported earlier, could have issues with mbae.exe also, but I think the crash is Google Chrome browser related because of the mentioned process-id.
Also checked through dzdiag.exe, but everything there seems OK.
See test page: http://www.fileformat.info/info/unicode/char/f32a4/index.htm
8)