In summary, they found out that in spite of EMET protecting a wide variety of functions, EMET has a function and a global variable that turns off EMET.  So they can call it or set the variable and EMET is bypassed.<p>Why bother with all the fancy tricks to get around the various protections when you can just ask EMET to turn them off for you?