Earlier quoted context omitted.
As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro
In a sense, it has been for a long time. With Linux, there's often a good clean way to do a thing, and then there are weird hacks. On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem. (I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K Euro…
I ruined my vacation by reverse engineering WSC
121–130 of 196 posts
Re: I ruined my vacation by reverse engineering WSC
#122Earlier quoted context omitted.
Performance reasons? Malware development? Hacking?
Is there a more performant, less resource-crippling, antivirus for Windows?
Re: I ruined my vacation by reverse engineering WSC
#123This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...
yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though
#define defer(body) DeferHolder COMMON_CAT(_defer_instance, __LINE__) {([&]()->void body)};
and call it as defer({
function body here;
});
Which looks much nicer. The preprocessor treats balanced curlies as one single token regardless of how many lines it spans, precisely to enable this usage.Re: I ruined my vacation by reverse engineering WSC
#124Earlier quoted context omitted.
It’s my hardware. I’ll do what I want with it, m8. Simple as that.
Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…
Oh, you chose to buy new shoes even though they were too tight which distracted you for 1 sec in your car on the way home, due to the discomfort, so you hit someone and they died.
Clearly people can not be trusted to buy their own shoes!
Re: I ruined my vacation by reverse engineering WSC
#125Earlier quoted context omitted.
We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.
It sounds like adding an exception is the intended way to do exactly what you’re doing and resolves the issue entirely. It also sounds like you wrote bad software that didn’t consider the architecture of the parent OS.
If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer.
Amusingly Microsoft ships exclusions for their own software, and states "Opting out of automatic exclusions might adversely impact performance, or result in data corruption. Automatic server role exclusions are optimized for Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025."
https://learn.microsoft.com/en-us/defender-endpoint/configur...
Re: I ruined my vacation by reverse engineering WSC
#126This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...
yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though
scope_exit{[&]{ ... } };Re: I ruined my vacation by reverse engineering WSC
#127Earlier quoted context omitted.
But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?
I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…
Re: I ruined my vacation by reverse engineering WSC
#128Earlier quoted context omitted.
Ah yes, I have my Windows power user bingo card dusted off! So far in this thread I’ve got: - Antivirus software is malware - We have to disable Windows Updates because I didn’t like them 30 years ago - Windows Defender hogs resources, laptop reviews showing Windows systems getting 10 hours of web browsing battery life are lying, Windows Defender actually ruins the performance of your computer - It’s better to compla…
We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.
Exceptions are valid when scoped to a container where you reasonably expect to be the sole user of the data therein and it contains no executable code.
Re: I ruined my vacation by reverse engineering WSC
#129Earlier quoted context omitted.
We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…
I don't think we actually need `->void` -- shouldn't the compiler be able to infer the return type (or rather, absence thereof)? My experience is that the compiler only struggles when the return value needs to be implicitly converted to some other type. Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`? Agreed that the simplest "fix" would be to just rename the macro to be all-caps.
Yes, agreed.
> Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`?
It's subjective but personally I still hate it.
> Agreed that the simplest "fix" would be to just rename the macro to be all-caps.
Actually I think the bigger part of my suggestion is switching from an object-like macro to a function-like macro [1], which makes it all a bit less magical.
[1] https://stackoverflow.com/questions/36126687/function-like-m...
Re: I ruined my vacation by reverse engineering WSC
#130Earlier quoted context omitted.
group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.
And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection
any control you think you have over windows is imaginary.