![\"\"](\"\/images\/adobexpgp1.jpg\")
<\/p>\nIn this post I am providing a solution to a problem some of our users had encountered. When users were starting up Adobe Reader X an exception was triggered in process AcroRd32.exe. Observing the crash details the memory addresses was always the same and module was always pgphk.dll. Taking a look at the properties of this library told me that it comes shipped with the PGP Desktop software.<\/p>\n
<\/p>\n
![\"\"](\"\/images\/adobexpgp2.jpg\")
<\/p>\n
After some investigative work I figured out what was actually happening:<\/p>\n
1. PGPTray.exe executable gets loaded from the start-up.
\n2. This process loads up the library PGPhk.dll in PGPTray.exe process space.
\n3. Thereafter any new process opened the library PGPhk.dll gets injected in its process space.<\/p>\n
So say if you load up Windows Calculator you’ll see PGPhk.dll in calc.exe. Due to this injection happening in AcroRd32.exe process it causes Adobe Reader to crash as by default Adobe Reader X runs in protected mode. Why PGP software does this injection in every process that I can\u2019t say but is the cause of the problem.<\/p>\n
Now there are a couple of ways around this:<\/p>\n
1. Just don\u2019t load PGPTray.exe executable and thus won\u2019t load PGPhk.dll
\n2. Disable Adobe Reader in “Protected Mode” but I strongly advise not to do so, this shouldn\u2019t be seen as a solution but only if there is no other options.
\n3. Upgrade to the latest version of PGP Desktop 10.1 which fixes the issue. This is the best action to take as you will be also fixing any previous vulnerabilities in its product. The version I had problems with was 9.5.3.
\n4. Create a whitelist excluding PGPhk memory section from Adobe Readers protected mode. The way to add this to the exclusion is to take the steps below.
\n\u00a0
\n\u00a0 i.\u00a0\u00a0 Add a registry entry enabling the use of whitelisting:
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Adobe\\Acrobat Reader\\10.0\\FeatureLockDown]
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 “bUseWhitelistConfigFile”=dword:00000001
\n\u00a0 ii.\u00a0 Create a whitelist file called “ProtectedModeWhitelistConfig.txt” and place it
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 in the Adobe Reader executable path i.e. C:\\Program Files\\Adobe\\Reader 10.0\\Reader
\n\u00a0 iii. The ProtectedModeWhitelistConfig.txt file will need to contain the string
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SECTION_ALLOW_ANY = *PGPhk*<\/p>\n
Check out Adobe’s Application Security Guide document which is a very good document worth reading. Another point to mention is that if you try to rename PGPhk.dll library then PGP Desktop will only try to re-install it again. Another way to test is to close the handle PGPhkSharedMemory before starting up Adobe Reader and you’ll find that Adobe Reader loads up fine.<\/p>\n
![\"\"](\"\/images\/adobexpgp3.jpg\")
<\/p>\n
When you enable Adobe Readers “Create Protected Mode log file” and view the log file AdbeReaderBroker.log you will see something like this below. This is if the exclusion is not added to the whitelist giving you information you need to add future exclusions in the whitelist.<\/p>\n
[03:11\/09:08:06] Adobe Reader Protected Mode Logging Initiated
\n[03:11\/09:08:08] NtCreateSection: STATUS_ACCESS_DENIED
\n[03:11\/09:08:08] real_path: \\BaseNamedObjects\\PGPhkSharedMemory
\n[03:11\/09:08:08] Consider modifying policy using this policy rule: SECTION_ALLOW_ANY<\/p>\n
References:<\/p>\n
http:\/\/forums.adobe.com\/thread\/755098<\/a> In this post I am providing a solution to a problem some of our users had encountered. When users were starting up Adobe Reader X an exception was triggered in process AcroRd32.exe. Observing the crash details the memory addresses was always the same and module was always pgphk.dll. Taking a look at the properties of […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18,8],"tags":[22,25,26],"class_list":["post-259","post","type-post","status-publish","format-standard","hentry","category-all","category-bugs","tag-adobe","tag-pgp","tag-sandbox"],"_links":{"self":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/259","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=259"}],"version-history":[{"count":9,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/259\/revisions"}],"predecessor-version":[{"id":689,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=\/wp\/v2\/posts\/259\/revisions\/689"}],"wp:attachment":[{"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.greyhathacker.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nhttp:\/\/learn.adobe.com\/wiki\/display\/security\/Application+Security+Library<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"