Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

161–170 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#161

Post by dataflow »

yrro wrote: post #151
dataflow wrote: post #59

Earlier quoted context omitted.

Huh? That API requires a file handle. Which you get by opening a file. Which you can't do because you can't find it on the filesystem when it's not there. Edit: Actually, hmm... see edit above.

While a process still has an unlinked file open, /proc/ /fd can be used to obtain a handle to the file so that you can mess around with it.

You're suggesting opening every single FD of every single process (which might not even point to a file, let alone a file on that volume) and querying it just to do this? I mean, sure, I guess that's usually not physically impossible (unless e.g. /proc is unavailable/unmounted)... but it's clearly a hack.

In fact, I think it's not just a (slow!) hack, but a buggy one too. Every time you open a an object that doesn't belong to you, you extend its lifetime. I think that can break stuff. Like imagine you open a socket in some server, then the server closes it. Then that server (or another one) starts up again and tries to bind to the same port. But you're still holding it open, so now it can't do that, and it errors out.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#162

Post by anticensor »

xxs wrote: post #142
tankenmate wrote: post #81

I keep forgetting Windows-isms that won't allow you to delete the executable file of a running process. I guess that's also why the arcane .dll upgrade process / WoW is so necessary.

>won't allow you to delete the executable file Any open file

Tne kernel actually allows for that, but Win32 apparently does not.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#163

Post by dataflow »

yrro wrote: post #145
dataflow wrote: post #66

Earlier quoted context omitted.

> You don't? Those are either free space, or held by handle by a running process, so you just leave them be and assume they will be released sooner or later. Well that's what I was getting at, it would suck to not be able to move around file blocks just because a process is using the file. That "sooner or later" might well be "until the next reboot". The current strategy makes it possible to live-shrink and live-defr…

'Sooner or later' means 'until the file is no longer open'.

Yes? And that might not happen until you log off or shut down the OS.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#164

Post by blackpill0w »

tetris11 wrote: post #153
blackpill0w wrote: post #149

Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?

One thing I like about Linux package managers is that you can query any file to see which package owns it. How does Windows not track this?

Ok, I see what you're saying here, still, Linux's way is better, I'd rather have my system cluttered with useless files of deleted programs than be exploited because of something that was solved decades ago.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#165

Post by jaclaz »

coldtea wrote: post #54
cornel_io wrote: post #32

Earlier quoted context omitted.

For those of us who don't Windows, can you explain what a detour is?

Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary. Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for us…

Only for the record, there is also easyhook:

https://easyhook.github.io/

https://easyhook.github.io/#features

https://github.com/EasyHook/EasyHook

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#166

Post by senectus1 »

eru wrote: post #97
senectus1 wrote: post #24

funny because any application without a sufficiently advanced uninstaller should also be considered malware.

If you can just delete its directory (or its single file) and everything works, that should be fine?

I guess so... but then you're assuming that the user isn't saving data in that directory :-P

but honestly, please Windows Dev's.. use MSI's please

it make me love you and i have so much love to give.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#167

Post by yrro »

dataflow wrote: post #163
yrro wrote: post #145

Earlier quoted context omitted.

'Sooner or later' means 'until the file is no longer open'.

Yes? And that might not happen until you log off or shut down the OS.

But it doesn't have to. Space is freed up deterministically, not "sooner or later".

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#168

Post by dataflow »

yrro wrote: post #167
dataflow wrote: post #163

Earlier quoted context omitted.

Yes? And that might not happen until you log off or shut down the OS.

But it doesn't have to. Space is freed up deterministically, not "sooner or later".

What? Space can't be freed up while the file is in use. The process is using the file, the data needs to be there...

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#169

Post by vidarh »

jraph wrote: post #124
mook wrote: post #89

Earlier quoted context omitted.

Thunderbird never quite used XULRunner, I think; they always built their own binary (though at some point quite a lot of the shared stuff moved into the XRE stuff). Think of it as they had a fork of Firefox (much like Firefox had a stripped down fork of the SeaMonkey stuff). Also, I think one of the Start Menus (might have been XP‽) was kind of HTA-ish? Not sure about that part, though.

> they always built their own binary > Think of it as they had a fork of Firefox Yep indeed, you are right. Notable projects using actual XULRunner included Songbird (a music player) and BlueGriffon, an WYSIWYG HTML editor (a successor of Nvu and KompoZer, themselves succeeding Netscape Composer). Both released after 2006 indeed. I liked XUL, I strongly believe Mozilla could have dominated the market taken by Electro…

There was an experiment back in the hazy past around that time called Entity that did something similar. It was never complete enough to be a competitor to XULRunner, but it was fascinating for two reasons:

1) You could write event handlers in multiple languages, including C. If you wrote them in C, it spawned gcc and compiled it into a library, and dynamically loaded it... The overall idea of a polyglot runtime like that was fun.

2) #1 is only really weird because this could be done at runtime. One of the demo apps was an editor for the GUI itself, where you could add buttons to the editor, then write that event handler in C, and have it compiled and loaded into the editor itself...

It was a fascinating starting point, though full of heavy duty foot guns, and I'm still sad nobody took it further.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#170

Post by notpushkin »

technion wrote: post #28
bdamm wrote: post #3

And today I learned that Windows supports running Javascript as shell script. huh

Malware delivered as an email with a link to a zip file containing a .js file is one of the most common methods of delivery, right behind word macros. The "map the .js extension to notepad.exe" is a common security trick with a measurable, immediate drop in malware in large orgs. You can deploy it via GPO or InTune. Personal promotion, I built this as a better alternative: https://github.com/technion/open_safety Note…

> It creates the file "example.com" in the same directory containing the EICAR test string. This should set off appropriate alarms

Huh, neat!

Post reply on HN