Comodo HIPS Causes Chrome 45.0.2454.85 Crash

Comodo HIPS 造成 Chrome 45 沒有回應,官方人員表示星期一會針對此bug做hotfix
暫時解決方式:
Comodo 設定 -> Defense+ --> HIPS --> HIPS 設定 --> 偵測 shellcode 注入 -> [排除項目]
加入 chrome.exe 到排除清單

Comodo注入了guard32.dll到Chrome,並Hook了一個地方,而新版多了一條push esi被蓋掉了導致crash

44.0.2403.157

  • Original

    chrome.ChromeMain+356A31 - 55                    - push ebp    -> Hook here
    chrome.ChromeMain+356A32 - 8B EC - mov ebp,esp
    chrome.ChromeMain+356A34 - 8B 4D 08 - mov ecx,[ebp+08]
    chrome.ChromeMain+356A37 - 83 79 24 00 - cmp dword ptr [ecx+24],00
    chrome.ChromeMain+356A3B - 75 23 - jne chrome.ChromeMain+356A60
  • Hooked

    chrome.ChromeMain+356A31 - E9 FA60E20D           - jmp guard32.dll+33D0
    chrome.ChromeMain+356A36 - CC - int 3
    chrome.ChromeMain+356A37 - 83 79 24 00 - cmp dword ptr [ecx+24],00
    chrome.ChromeMain+356A3B - 75 23 - jne chrome.ChromeMain+356A60

45.0.2454.85

  • Original

    chrome.ChromeMain+37C696 - 55                    - push ebp
    chrome.ChromeMain+37C697 - 8B EC - mov ebp,esp -> Hook here
    chrome.ChromeMain+37C699 - 56 - push esi -> This cause the problem!
    chrome.ChromeMain+37C69A - 8B 75 08 - mov esi,[ebp+08]
    chrome.ChromeMain+37C69D - 83 7E 24 00 - cmp dword ptr [esi+24],00
    chrome.ChromeMain+37C6A1 - 75 23 - jne chrome.ChromeMain+37C6C6
  • Hooked

    chrome.ChromeMain+37C696 - 55                    - push ebp
    chrome.ChromeMain+37C697 - E9 63057816 - jmp guard32.dll+33D0
    chrome.ChromeMain+37C69C - CC - int 3
    chrome.ChromeMain+37C69D - 83 7E 24 00 - cmp dword ptr [esi+24],00
    chrome.ChromeMain+37C6A1 - 75 23 - jne chrome.ChromeMain+37C6C6

Temporary solution:
Add chrome.exe to Defense+ --> HIPS --> HIPS Settings --> Detect shellcode injection --> [Exclusions]

A hotfix will be released on Monday.

Hello Guys,

Please kindly note that we will be doing a hotfix release on Monday to fix this bug.

For your kind attention please.

Kind Regards
Buket