Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

EAF regulates access to the Export Address Table (EAT), allowing or disallowing read/write access based on the calling code originating from a shellcode. With EMET in place, most of today’s shellcode will be blocked when it tries to lookup the APIs needed for its payload. In addition, EMET tries to prevent attempts by shellcode and ROP gadget to clearing the hardware breakpoints used for this mitigation. 

Export Address Table Filtering Plus (EAF+)

...

 

EAF+ mitigation blocks read attempts to export and import table addresses originating from modules commonly used to probe memory during the exploitation of memory corruption vulnerabilities. EAF+ is an extension of EAF that can be used independently or in combination with EAF itself.

Mandatory Address Space Layout Randomization (MandatoryASLR) - Randomizes the location where modules are loaded in memory, limiting the ability of an attacker to point to predetermined memory addresses.

...