Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A jump into the middle of an instruction from nowhere (2023)

devblogs.microsoft.com

Post reply on HN
Print view View original

101–110 of 112 posts

Re: A jump into the middle of an instruction from nowhere (2023)

#101

Post by twoodfin »

Kwpolska wrote: post #44
userbinator wrote: post #26

Earlier quoted context omitted.

That's a lot of money and time to spend on supporting someone else's bug-riddled software. Consider that it's money and time that MS spent to get into their position today. They built their empire on "back-compat is king", and betraying that principle gives far less reason for their customers to continue using their software instead of moving to alternatives.

Microsoft cares about backwards compatibility and does a good job at it IMO, especially compared to their competitors. The thing that broke was not a public API, but an internal, undocumented, unexported function in Explorer. Microsoft did patch API abuse in the past for prominent software, but they can't be expected to do it forever and for all software.

Software didn’t have to be that prominent to warrant a compatibility hack in Windows.

When I was exposed to the “shim” database in the XP era, it had thousands of entries.

Re: A jump into the middle of an instruction from nowhere (2023)

#102

Post by justin66 »

twoodfin wrote: post #101
Kwpolska wrote: post #44

Earlier quoted context omitted.

Microsoft cares about backwards compatibility and does a good job at it IMO, especially compared to their competitors. The thing that broke was not a public API, but an internal, undocumented, unexported function in Explorer. Microsoft did patch API abuse in the past for prominent software, but they can't be expected to do it forever and for all software.

Software didn’t have to be that prominent to warrant a compatibility hack in Windows. When I was exposed to the “shim” database in the XP era, it had thousands of entries.

I'm not sure if you're holding up the XP list as being better than the list today, but I bet even the list at that time did not include every random shell extension imaginable.

Re: A jump into the middle of an instruction from nowhere (2023)

#103

Post by rep_lodsb »

rightbyte wrote: post #100
rep_lodsb wrote: post #74

Earlier quoted context omitted.

Rather than "jumping into the middle of an instruction" (which to me implies some crazy trickery where both the original instruction and the middle of it do something useful, like the sibling comment about biology), a more straightforward way of looking at it is that the "jumped-into" instruction is actually a single-byte jump which skips over the one or two following bytes - and those shouldn't be considered to be p…

> Rather than "jumping into the middle of an instruction" (which to me implies some crazy trickery where both the original instruction and the middle of it do something useful, like the sibling comment about biology) Doesn't "jumping into the middle of the instruction" just mean that decoding from the middle is another instruction, then when decoding from the start of it? E.g.: IMUL -> 0x0FAF SCASW -> 0xAF

Almost any random bytes can be decoded as some instruction - most of them are not useful. The essence of this jump-forward-by-one-or-two-bytes trick is that it performs an operation which doesn't have an effect on the program, so it can be considered to be a single-byte jump opcode, and its "immediate operand" as a separate instruction which is simply skipped over.

You could define assembler macros named something like "SKIP1" and "SKIP2" that emit these opcode bytes (3Ch / 3Dh), and use them just like a jump, provided that you don't care about the flags.

My point was that this is easier to reason about than the more general case where (working) code jumps into the middle of an instruction that already does something else - that either takes extreme cleverness, or evolution over millions of years.

Re: A jump into the middle of an instruction from nowhere (2023)

#104

Post by twoodfin »

justin66 wrote: post #102
twoodfin wrote: post #101

Earlier quoted context omitted.

Software didn’t have to be that prominent to warrant a compatibility hack in Windows. When I was exposed to the “shim” database in the XP era, it had thousands of entries.

I'm not sure if you're holding up the XP list as being better than the list today, but I bet even the list at that time did not include every random shell extension imaginable.

At the time, there weren’t that many “random shell extensions”. Many of the more common ones were almost certainly there if needed.

My point was you didn’t need to be a “prominent” developer for Microsoft to patch up your app at runtime. This was particularly important for XP, given that it was the big, strategic consumer swap to the NT kernel and had to go smoothly.

Re: A jump into the middle of an instruction from nowhere (2023)

#105

Post by NoZebra120vClip »

mrguyorama wrote: post #83
sandworm101 wrote: post #67

Earlier quoted context omitted.

Wallpapers can be animated? This is like learning my car can count butterflies. I wonder why such a feature exists but also now feel obligated to hook VLC into the wallpaper function so i can play movies underneath all my other work. Can wallpapers have sound?

There was a time when we thought wallpapers should be entire web pages! That didn't go so well

Now, browsers have themes and wallpapers, so it's customisation all the way down.

This winter, Edge introduced interactive wallpapers. There were little buttons you could press to put a layer of frost on everything, or make snow fall. I couldn't make enough snow fall to obliterate the clickbait MSNBC headlines.

Re: A jump into the middle of an instruction from nowhere (2023)

#106

Post by NoZebra120vClip »

magicalhippo wrote: post #30
nottorp wrote: post #10

Earlier quoted context omitted.

> For one thing, it allows you to move the taskbar again. But but... think of their support costs if people accidentally move the taskbar! They have to remove your options or they'll starve!

I've literally spent over 30 minutes on a support call with someone who had accidentally moved and resized their taskbar. All I could get out of the user was "half the screen is grey". I quickly figured out it was probably the taskbar, and I tried asking if it was the top or bottom half, or left or right. "Half" was the reply... After a lot of attempts and little progress, I made a breakthrough by asking in which cor…

Every time I go to click "Lock the Taskbar" a Clash song boogies into my head. Such an earworm! I believe they've finally renamed that option, though.

Re: A jump into the middle of an instruction from nowhere (2023)

#107

Post by NoZebra120vClip »

arsome wrote: post #13
kristianp wrote: post #8

Earlier quoted context omitted.

Do you have to turn off all system file modification detection to do these hacks? Sounds risky.

These are not applied on disk, they're injected at runtime. Just open the process and write to its memory directly.

In that case, DEP would be the system preventing self-modifying code.

https://en.wikipedia.org/wiki/Executable-space_protection#Wi...

Re: A jump into the middle of an instruction from nowhere (2023)

#108

Post by defrost »

NoZebra120vClip wrote: post #106
magicalhippo wrote: post #30

Earlier quoted context omitted.

I've literally spent over 30 minutes on a support call with someone who had accidentally moved and resized their taskbar. All I could get out of the user was "half the screen is grey". I quickly figured out it was probably the taskbar, and I tried asking if it was the top or bottom half, or left or right. "Half" was the reply... After a lot of attempts and little progress, I made a breakthrough by asking in which cor…

Every time I go to click "Lock the Taskbar" a Clash song boogies into my head. Such an earworm! I believe they've finally renamed that option, though.

It's Lock El Taskbar now .. https://www.youtube.com/watch?v=02Sg9H2T_TQ

https://www.nytimes.com/2005/03/13/arts/music/shock-the-casb...

Re: A jump into the middle of an instruction from nowhere (2023)

#109

Post by arsome »

NoZebra120vClip wrote: post #107
arsome wrote: post #13

Earlier quoted context omitted.

These are not applied on disk, they're injected at runtime. Just open the process and write to its memory directly.

In that case, DEP would be the system preventing self-modifying code. https://en.wikipedia.org/wiki/Executable-space_protection#Wi...

DEP does nothing to prevent OpenProcess() and WriteProcessMemory() from working or prevent applications from loading a dll which reaches into the main process's image to patch it. DEP tries to prevent exploitation from taking place within a single process by ensuring say, a buffer overflow can't just call the value you loaded into your webpage, not running software tampering with the memory of other running software using APIs which allow for the purpose.

Even if the page is marked as non-writable, execute only, you can pause the process, change the permissions and resume it or do it at image load time without issue.

Windows applications using the old/standard win32 api don't have sandboxing between them at all and any application is free to tamper with any other to an almost limitless extent. It's incredibly powerful, in both good and bad ways.

Certain advanced firewall tools with IDS style features can hook these calls and notify you when an application is attempting to do something like this.

Re: A jump into the middle of an instruction from nowhere (2023)

#110

Post by jdewerd »

poizan42 wrote: post #99
mrguyorama wrote: post #87

Earlier quoted context omitted.

Sure, but if you use/build a tool that modifies how Windows runs by trawling through and manipulating internal process memory that explicitly is not meant to be modified by anything else , that's on you. It's like asking why Nintendo won't support the NES you desoldered the CPU from and replaced with a higher clock capable CMOS 6502 and new crystal "Nintendo is such a bad company, I upgraded my NES and now it can't p…

I don't remember anybody in this thread making any claims about what Microsoft should or should not support.

Yeah. It's not fair to judge Microsoft for people abusing the API, but that's a different question from whether or not they should lock it out. That would be a big freedom reduction, and even though I'm sure it would make life slightly easier for for some parts of Microsoft, I'm pretty sure it wouldn't be for the best.

Going to the game console example, blaming Nintendo for the botched upgrade is dumb, but what if Nintendo puts security keys in every component to prevent repair? Yeah, it's fair and good that they foiled the 3 modders who bricked their devices and tried to claim warranty, but they also sent 3 million extra devices to the dump that otherwise could have been fixed by enterprising teenagers with soldering irons. It would be 100% fair to blame them for that.

Post reply on HN