IntResource and EMET

Add-in Express™ Support Service
That's what is more important than anything else

IntResource and EMET
Outlook 2013 is terminated by EMET because of call to IntResource.dll 
Michael Fuchs


Guest


There are other forum entries dealing with security problems and IntResource.dll:
https://www.add-in-express.com/forum/read.php?FID=5&TID=10078&MID=51880
https://www.add-in-express.com/forum/read.php?FID=5&TID=11689&MID=59612
https://www.add-in-express.com/forum/read.php?FID=5&TID=9201&MID=47237
https://www.add-in-express.com/forum/read.php?FID=5&TID=9208&MID=47140


  • IntResource.dll (IntResource64.dll always implicit) is part of AddinExpress.OL.Resources in assembly AddinExpress.OL.2005.dll
  • In case AddinExpress.OL.2005.dll is available in GAC, it will always be loaded from there, and IntResource.dll will be created in the %temp% folder.
  • In case AddinExpress.OL.2005.dll is NOT available in GAC, assembly resolve will try the installation folder. In this case, IntResource.dll can be manually placed in the installation folder as well, which will prevent its creation (and load) in %temp%.


So I successfully prevented loading IntResource.dll from %temp% directory. Unfortunately, this did NOT solve the problem, EMET (Enhanced Mitigation Experience Toolkit) does still terminate Outlook 2013 (note that this does not happen with Outlook 2016!).

To reproduce the crash:


https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx output if AddinExpress.OL.2005.dll is found in GAC:
http://postimg.org/image/po2nsx7of/

ProcessMonitor output if AddinExpress.OL.2005.dll is NOT found in GAC (still crashes):
http://postimg.org/image/3wa8rd63j/


So, questions:
1. Can you reproduce the behavior?
2. Can you explain why EMET still terminates Outlook despite loading IntResource.dll from the installation folder?
3. Could it be because IntResource.dll is not a managed assembly (cannot show it in a disassembler)?
4. Do you have a solution to prevent the crash?
Posted 07 Mar, 2016 05:36:19 Top
Andrei Smolin


Add-in Express team


Posts: 18794
Joined: 2006-05-11
Hello Michael,

We use IntResource (among other uses) to solve several problems with painting Add-in Express forms in some Outlook regions. Note that if you use Dock* regions, you can avoid the problem with EMET by switching to using Microsoft Custom Task Panes. For other regions, the only way out is to turn SimExecFlow off.



Andrei Smolin
Add-in Express Team Leader
Posted 07 Mar, 2016 06:27:13 Top
Michael Fuchs


Guest


Hello Andrei

The customer would like to keep SimExecFlow on, and I doubt Custom Task Panes will be able to replace Form Regions for our purposes:
- How to get rid of the ugly title bar/border?
- Adding a task pane dynamically runs into the following exception. Creating the task pane at design time and just setting the ControlProgID at runtime produces the same behavior.

System.Runtime.InteropServices.COMException (0x80004005): Unable to create specified ActiveX control.
   at System.RuntimeType.ForwardCallToInvokeMember(String memberName, BindingFlags flags, Object target, Int32[] aWrapperTypes, MessageData& msgData)
   at AddinExpress.MSO.ICTPFactory.CreateCTP(String CTPAxID, String CTPTitle, Object CTPParentWindow)
   at AddinExpress.MSO.ADXAddinModule.AddCustomTaskPanes(Object parent, String outlookFolderName)

- Is there a way to limit the folders in which a task pane is shown (analogous to ExplorerItemTypes with forms)?

Regards
Posted 07 Mar, 2016 09:21:40 Top
Michael Fuchs


Guest


Also, since you seem to be acquainted with the problem:
2. Can you explain why EMET still terminates Outlook despite loading IntResource.dll from the installation folder?
Posted 07 Mar, 2016 09:29:44 Top
Andrei Smolin


Add-in Express team


Posts: 18794
Joined: 2006-05-11
Hello Michael,

Michael Fuchs writes:
2. Can you explain why EMET still terminates Outlook despite loading IntResource.dll from the installation folder?


There's no difference where IntResource.dll is loaded from. It looks like Outlook 2013 crashed due to a problem in its logic. Or maybe this is a result of a mixture of what Outlook and IntResource.dll do. I'm not sure.

Michael Fuchs writes:
- How to get rid of the ugly title bar/border?


You can't. You can set the caption to a " " (space) but you can't do anything else.

Michael Fuchs writes:
- Adding a task pane dynamically runs into the following exception. Creating the task pane at design time and just setting the ControlProgID at runtime produces the same behavior.


Do you set the caption to an empty string? Set it to a space instead.

Michael Fuchs writes:
- Is there a way to limit the folders in which a task pane is shown (analogous to ExplorerItemTypes with forms)?


You can use the [Before]FolderSwitch event to show/hide the pane.

A question regarding the IntResource.dll problem: What Outlook regions are you using or going to use in your add-in?



Andrei Smolin
Add-in Express Team Leader
Posted 09 Mar, 2016 05:43:23 Top
Michael Fuchs


Guest


Hello Andrei

Thanks for replying to all my questions in detail.

A question regarding the IntResource.dll problem: What Outlook regions are you using or going to use in your add-in?


We have a form region docked to the top, which is a messagebar only (so this would definitely not work with a custom task pane and its massive border), and the main region which is docked to the right:

http://postimg.org/image/71whv6ci7/

So is there no chance that you can change the way IntResource.dll gets handled? Obviously putting it into Temp folder and loading it from there creates lots of problems. McAffee by the way also detects that access and can block it depending on configuration.
That EMET classifies it as violating SimExecFlow no matter where it is loaded from is the big problem we face at the moment, are you sure you have no other option than to use IntResource.dll in its present form, for what you are trying to achieve? Can you provide more information about what IntResource is used for, except painting form regions (which might not be necessary in our case, for example)?

Regards
Posted 10 Mar, 2016 08:36:27 Top
Andrei Smolin


Add-in Express team


Posts: 18794
Joined: 2006-05-11
Hello Michael,

Michael Fuchs writes:
So is there no chance that you can change the way IntResource.dll gets handled?


The only chance is to change your add-in in the framework of our custom development services, see https://www.add-in-express.com/custom-development/index.php. We can't incorporate this solution in Add-in Express. The result will be a region resembling an Add-in Express region with these restrictions:
- the region will only be used by your add-in; no other Add-in Express add-in will ever show its form(s) in that region
- the region won't support several forms in the region


Andrei Smolin
Add-in Express Team Leader
Posted 10 Mar, 2016 09:54:35 Top