Unwanted breakpoint in ntdll.dll!_LdrpSnapThunk@36() + 0xf5 bytes

Question

I'm debugging an Outlook add-in DLL in the following environment: Windows 7 x64 Office 2013 Click-to-Run x86 Visual Studio 2010 Native only (C++)

"Show loader snaps" is disabled on the system level and for outlook.exe in both the x86 and x64 registry, and I've verified that there's no overriding "GlobalFlag" registry value anywhere.

The only "GlobalFlag" value in the system is set to 0x00000400 (only FLG_POOL_ENABLE_TAGGING) and is in CurrentControlSet.

When I attach the VS debugger to OUTLOOK.EXE (my DLL is already loaded) I can debug it as expected (symbols load, etc.) but at random times I hit this breakpoint, regardless of what I'm doing.

Why would I get breakpoints in LdrpSnapThunk? I couldn't find any option to even set/enable such breakpoints (loader snaps should only print a debug string, not cause a breakpoint, AFAIK).

It's really annoying - I get this breakpoint stopping me at random times when debugging.

Thanks!

Answer 1

Hans's comment above helped me solve it. For future reference - you need to turn off "Export Address Table Access Filtering" (EAF) for OUTLOOK.EXE in the Application Configuration window in EMET.