runtime: “unknown pc” exception for amd64 programs on Windows 7 with EMET and Export Address Table Access Filtering enabled #39410
Labels
compiler/runtime
Issues related to the Go compiler and/or runtime.
ExpertNeeded
NeedsInvestigation
Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
OS-Windows
Milestone
What version of Go are you using (
go version
)?Does this issue reproduce with the latest release?
Yes.
What operating system and processor architecture are you using (
go env
)?go env
OutputWhat did you do?
Download and install EMET 5.5 on Windows 7 64-bits.
Compile a simple 64-bit Go program (GOARCH=amd64). A "Hello, world" like the default shown in https://play.golang.org/ is enough.
Enable EMET for the compiled program (Open EMET GUI -> Apps -> Add application). The default profile enable all mitigations but EAF+ and ASR. The following screenshot illustrate this (main.exe in this example):
Click OK.
Run the program from the Command Prompt.
What did you expect to see?
What did you see instead?
Comments
The problem only occurs if Export Address Table Access Filtering (EAF) is enabled (it's enabled by default on EMET). You can find more information about it in EMET 5.5 User Guide.
I'm aware EMET is a discontinued product but there are legacy systems still using it, so I thought it'd good to let you guys know about this problem.
The text was updated successfully, but these errors were encountered: