{"guid":"_kPJG76FUvxbX7Z6h20Gcw","title":"EMET 5.1 - Armor or Curtain?","subtitle":null,"slug":"31c3_-_6161_-_en_-_saal_2_-_201412291600_-_emet_5_1_-_armor_or_curtain_-_rene_freingruber","link":"http://events.ccc.de/congress/2014/Fahrplan/events/6161.html","description":"EMET (Enhanced Mitigation Experience Toolkit) is an application which can be used to further harden a Windows system by adding additional security protections to running processes. These protections include several ROP (Return-Oriented-Programming) checks, shellcode detection mechansims, heap-spray mitigations and many more.\nThe talk covers techniques to bypass EMET 5.1 (the current version) and shows the audience how hard/easy it is for an attacker to accomplish this.","original_language":"eng","persons":["René Freingruber"],"view_count":1527,"promoted":false,"date":"2014-12-29T16:00:00.000+01:00","release_date":"2014-12-29T01:00:00.000+01:00","updated_at":"2026-02-07T21:15:09.473+01:00","tags":["Security \u0026 Hacking"],"length":3452,"duration":3452,"thumb_url":"https://static.media.ccc.de/media/congress/2014/6161-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2014/6161-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2014/_kPJG76FUvxbX7Z6h20Gcw-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2014/_kPJG76FUvxbX7Z6h20Gcw-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/31c3_-_6161_-_en_-_saal_2_-_201412291600_-_emet_5_1_-_armor_or_curtain_-_rene_freingruber","url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_title":"31C3: a new dawn","conference_url":"https://api.media.ccc.de/public/conferences/31c3","related":[{"event_id":1126,"event_guid":"import-642660b4ee88817288","weight":1},{"event_id":1800,"event_guid":"gL8lRFVpn8NFFfATsOn7Bw","weight":1},{"event_id":1833,"event_guid":"bJDjDUHLd0Y6wLncMd5Unw","weight":1},{"event_id":2178,"event_guid":"7G4FQIXg2eb7D6F_jNwuxA","weight":1},{"event_id":2213,"event_guid":"xyADKdXtvEgJWo6eaTmUBQ","weight":1},{"event_id":2216,"event_guid":"A8xVpIjX1oKQOQcWMt_49Q","weight":1},{"event_id":2227,"event_guid":"H1GEe9l64eUbo1oZXtLkEg","weight":1},{"event_id":2246,"event_guid":"5hkhmuwi5J8ZHMfd5k7veg","weight":1},{"event_id":2255,"event_guid":"aowmh_BVhxN_YNmkQomweQ","weight":1},{"event_id":2265,"event_guid":"yN_BHtGEljjFHh2dl-Irug","weight":1},{"event_id":2273,"event_guid":"38ea922b-5b2d-4290-8c79-da0c891edd7a","weight":1},{"event_id":2865,"event_guid":"b2a8a8fe-646f-4e32-a4d8-67a163573e36","weight":1},{"event_id":2871,"event_guid":"74515f8e-a752-4cbb-b407-3a70fca5b0b3","weight":1},{"event_id":3656,"event_guid":"1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","weight":1},{"event_id":3661,"event_guid":"599ef527-fc3f-4474-8137-cf0e49cf118f","weight":1},{"event_id":3762,"event_guid":"25e2df7d-5740-4c2f-bc34-986326d606fe","weight":1},{"event_id":4764,"event_guid":"da934433-0092-4749-b606-56b65e84214f","weight":1},{"event_id":4794,"event_guid":"a2887b4a-0c9d-4220-a52f-c65c20ae25d7","weight":1},{"event_id":4929,"event_guid":"8e222759-cd6b-403b-8fe1-3517bf7d2802","weight":1},{"event_id":6391,"event_guid":"1601bf3b-ce4a-44c9-993f-7d28fa65168d","weight":1},{"event_id":6423,"event_guid":"ea7c532f-cc2d-4cb1-8f15-1933df7fd523","weight":1},{"event_id":6511,"event_guid":"4f6f4278-1cfb-4e8d-935d-ec0ac2adefc5","weight":1},{"event_id":6567,"event_guid":"b87de377-eb03-4795-b998-7988a63fc239","weight":1},{"event_id":6593,"event_guid":"c293b397-9fad-45ff-9ffe-716503c6c095","weight":1}],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"DRAFT_31c3-6161-en-de-EMET_51_-_Armor_or_Curtain.en_DRAFT.srt","state":"todo","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2022-01-15T18:53:09.898+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/DRAFT_31c3-6161-en-de-EMET_51_-_Armor_or_Curtain.en_DRAFT.srt","url":"https://api.media.ccc.de/public/recordings/50909","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":39,"length":3443,"mime_type":"audio/opus","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_opus.opus","state":"downloaded","folder":"opus","high_quality":true,"width":null,"height":null,"updated_at":"2014-12-30T00:27:01.874+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/opus/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_opus.opus","url":"https://api.media.ccc.de/public/recordings/5480","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":78,"length":3443,"mime_type":"audio/mpeg","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_mp3.mp3","state":"downloaded","folder":"mp3","high_quality":true,"width":null,"height":null,"updated_at":"2014-12-30T00:50:15.942+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/mp3/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/5510","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":246,"length":3452,"mime_type":"video/mp4","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_sd.mp4","state":"downloaded","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:07:37.938+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-sd/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_sd.mp4","url":"https://api.media.ccc.de/public/recordings/5552","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":250,"length":3452,"mime_type":"video/webm","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_webm-sd.webm","state":"downloaded","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:07:44.183+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/webm-sd/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/5608","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":504,"length":3452,"mime_type":"video/mp4","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_hd.mp4","state":"downloaded","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T14:07:27.155+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-hd/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_hd.mp4","url":"https://api.media.ccc.de/public/recordings/5415","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":537,"length":3452,"mime_type":"video/webm","language":"eng","filename":"31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_webm-hd.webm","state":"downloaded","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T21:01:41.985+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/webm-hd/31c3-6161-en-de-EMET_51_-_Armor_or_Curtain_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/5654","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":null,"length":3452,"mime_type":"video/mp4","language":"eng","filename":"31c3-6161-en-EMET_51_-_Armor_or_Curtain_hd.mp4","state":"downloaded","folder":"h264-hd-web","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-01-26T08:07:51.372+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-hd-web/31c3-6161-en-EMET_51_-_Armor_or_Curtain_hd.mp4","url":"https://api.media.ccc.de/public/recordings/5825","event_url":"https://api.media.ccc.de/public/events/_kPJG76FUvxbX7Z6h20Gcw","conference_url":"https://api.media.ccc.de/public/conferences/31c3"}]}