over 2 years ago

Comodo HIPS 造成 Chrome 45 沒有回應,官方人員表示星期一會針對此bug做hotfix
暫時解決方式:
Comodo 設定 -> Defense+ --> HIPS --> HIPS 設定 --> 偵測 shellcode 注入 -> [排除項目]
加入 chrome.exe 到排除清單

Comodo注入了guard32.dll到Chrome,並Hook了一個地方,而新版多了一條push esi被蓋掉了導致crash

44.0.2403.157

  • Original

    chrome.ChromeMain+356A31 - 55                    - push ebp    -> Hook here
    chrome.ChromeMain+356A32 - 8B EC                 - mov ebp,esp
    chrome.ChromeMain+356A34 - 8B 4D 08              - mov ecx,[ebp+08]
    chrome.ChromeMain+356A37 - 83 79 24 00           - cmp dword ptr [ecx+24],00
    chrome.ChromeMain+356A3B - 75 23                 - jne chrome.ChromeMain+356A60
    
  • Hooked

    chrome.ChromeMain+356A31 - E9 FA60E20D           - jmp guard32.dll+33D0
    chrome.ChromeMain+356A36 - CC                    - int 3 
    chrome.ChromeMain+356A37 - 83 79 24 00           - cmp dword ptr [ecx+24],00
    chrome.ChromeMain+356A3B - 75 23                 - jne chrome.ChromeMain+356A60
    

45.0.2454.85

  • Original

    chrome.ChromeMain+37C696 - 55                    - push ebp
    chrome.ChromeMain+37C697 - 8B EC                 - mov ebp,esp -> Hook here
    chrome.ChromeMain+37C699 - 56                    - push esi    -> This cause the problem!
    chrome.ChromeMain+37C69A - 8B 75 08              - mov esi,[ebp+08]
    chrome.ChromeMain+37C69D - 83 7E 24 00           - cmp dword ptr [esi+24],00
    chrome.ChromeMain+37C6A1 - 75 23                 - jne chrome.ChromeMain+37C6C6
    
  • Hooked

    chrome.ChromeMain+37C696 - 55                    - push ebp
    chrome.ChromeMain+37C697 - E9 63057816           - jmp guard32.dll+33D0
    chrome.ChromeMain+37C69C - CC                    - int 3 
    chrome.ChromeMain+37C69D - 83 7E 24 00           - cmp dword ptr [esi+24],00
    chrome.ChromeMain+37C6A1 - 75 23                 - jne chrome.ChromeMain+37C6C6
    

Temporary solution:
Add chrome.exe to Defense+ --> HIPS --> HIPS Settings --> Detect shellcode injection --> [Exclusions]

A hotfix will be released on Monday.

Hello Guys,

Please kindly note that we will be doing a hotfix release on Monday to fix this bug.

For your kind attention please.

Kind Regards
Buket

← HITCON 之 Windows 也要玩 Nano 棉被楓之谷幹的噁心事情 →
 
comments powered by Disqus