Why is the recommended javascript way of doing it var fso = new ActiveXObject("Scripting.FileSystemObject"); rather than var fs = require('fs') // (or the appropriate ES6 incantation) ?
It’s JScript. Not JavaScript and definitely not Node.JS
Any sufficiently advanced uninstaller is indistinguishable from malware
51–60 of 556 posts
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#52Earlier quoted context omitted.
Been using this for years. Mostly really useful. Sometimes tricky to get right since the available APIs are semi-well documented and it's JScript, which is some sort of old Internet Explorer-ish version of JavaScript. By the way, there are also HTAs, which are Microsoft HTML Applications. You can create a simple double-clickable GUI with these using only HTML and JScript.
Pretty crazy how Microsoft basically invented the Electron app as HTAs all the way back in 1999. Of course we browsers weren't as capable as they are today, but "I just want a HTML+CSS GUI" had been a solved problem for over ten years when Electron first came out.
Yes, and XULRunner allowed this too, using Gecko, Firefox's web engine, to render HTML-like markup specifically designed to build native-like GUIs.
Apparently XULRunner was first released in 2006, but Thunderbird, which uses (used?) the same technology, was released as early as 2003, and maybe this was existing in the Mozilla Suite even before.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#53I can only imagine the Win32 API team meeting prior to this...
A: So, people are resorting to injecting code in Explorer to delete in-use files in such numbers that it shows up in our top-100 crash report reasons
B: Well, maybe we should add a public API to Windows to support this incredibly common functionality that apparently has been missing so far?
A: Nah, let's just write a mildly condescending blog post that recommends using an unreliable workaround that is pretty much guaranteed to trigger any client-side intrusion detection software, that will set them straight
B: Right on!
(Meanwhile, somewhere, a third-party developer is gearing up to ship a kernel-mode driver to directly manipulate file system structures from their uninstaller, since their old solution kept crashing: can't wait to read the postmortem once the crash dumps from that one hit the Microsoft servers!)
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#54Earlier quoted context omitted.
it's a little more general, I think, since one common use case for it is to use it on your own process in order to intercept calls to stdlib/OS code from libraries you don't control. For example, in the bad old days I used detours to virtualize the windows registry so that I could do "fake installs" of COM components inside of a VB6 app, allowing it to run without an install and without administrator permissions. Thi…
For those of us who don't Windows, can you explain what a detour is?
Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary.
Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for use by the instrumentation. Our trampoline design enables a large class of innovative extensions to existing binary software.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#55Earlier quoted context omitted.
it's a little more general, I think, since one common use case for it is to use it on your own process in order to intercept calls to stdlib/OS code from libraries you don't control. For example, in the bad old days I used detours to virtualize the windows registry so that I could do "fake installs" of COM components inside of a VB6 app, allowing it to run without an install and without administrator permissions. Thi…
For those of us who don't Windows, can you explain what a detour is?
You essentially replace a function with your own. The project is at https://github.com/microsoft/Detours.
I’ve created a PowerShell module that wraps this library to make it easier to hook functions on the fly for testing https://github.com/jborean93/PSDetour. For example I used it to capture TLS session data for decryption https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663... as well as create an strace like functionality for various Win32 APIs (still expanding as I find more use cases) https://github.com/jborean93/PSDetour-Hooks
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#56Earlier quoted context omitted.
I thought I'll be the guy to point out that once again mandatory file locking is to blame, but you beat me to it. I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour?
> I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour? How do you defragment/move files that are unreachable on the file system? How do you shrink volumes when you can't move files that need to be moved? Edit: Actually, hmm... as I type this, I suddenly recall you can also open a file by its ID on NTFS. And you can enumerate its streams as well. So presuma…
Using the same API that lets you move file blocks around at will.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#57Why is the recommended javascript way of doing it var fso = new ActiveXObject("Scripting.FileSystemObject"); rather than var fs = require('fs') // (or the appropriate ES6 incantation) ?
The latter is not "javascript" in general, it's just a Node.js (a specific v8 Javascript runtime + native integration and libs like fs bundle) API.
And the former windows version is JScript which is an implementation Javascript just using an different name for trademark reasons, but tied to an old version of the JavaScript standard (which is confusingly called "ecmascript" officially), plus some Windows-specific integrations, like ActiveXObject and COM/OLE support.
(There's also a later .NET version of JScript to add to the confusion).
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#58Why is the recommended javascript way of doing it var fso = new ActiveXObject("Scripting.FileSystemObject"); rather than var fs = require('fs') // (or the appropriate ES6 incantation) ?
Because JScript was introduced back in Windows 98 and the modern APIs were introduced 10 years later (in the case of Node.js).
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#59Earlier quoted context omitted.
> I never digged into the question, but why is it used, what benefits did it provide over the UNIX unlink behaviour? How do you defragment/move files that are unreachable on the file system? How do you shrink volumes when you can't move files that need to be moved? Edit: Actually, hmm... as I type this, I suddenly recall you can also open a file by its ID on NTFS. And you can enumerate its streams as well. So presuma…
Using the same API that lets you move file blocks around at will.
Huh? That API requires a file handle. Which you get by opening a file. Which you can't do because you can't find it on the filesystem when it's not there.
Edit: Actually, hmm... see edit above.
Re: Any sufficiently advanced uninstaller is indistinguishable from malware
#60And today I learned that Windows supports running Javascript as shell script. huh
It is very common for malware to contain java script payloads that try to obfuscate themselves like like this: Seemingly_random_code(seemingly_random_string) The seemingly_random_code decompresses/decodes whatever is in the seemingly_random_string and hands over control to it. Interestingly the decoded code is another version of the same with different code and string. This goes on for ~100 layers deep then at the en…
> This goes on for ~100 layers deep then at the end it just downloads and executes some file from the net.
I understand doing one layer. I guess I could maybe see two layers. But why would it bother with 100 layers? Either the antivirus or reverse-engineering tool can grab the final product or it can't.