Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

121–130 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#121

Earlier quoted context omitted.

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro

In a sense, it has been for a long time. With Linux, there's often a good clean way to do a thing, and then there are weird hacks. On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem. (I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K Euro…

The 'weird hack' is actually just a normal option left hanging in Defender options that clearly states it will prevent "other" stuff from changing Defender settings

Re: I ruined my vacation by reverse engineering WSC

#122

Earlier quoted context omitted.

Performance reasons? Malware development? Hacking?

Is there a more performant, less resource-crippling, antivirus for Windows?

Yes, a small number, but it changes each year due to AV vendors (including Microsoft) changing how their AV works. It also depends on whether one looks at the impact from passively running the antivirus vs actively running a scan.

Re: I ruined my vacation by reverse engineering WSC

#123
post #17

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though

Why did you write it with two structs though? You could do

    #define defer(body) DeferHolder COMMON_CAT(_defer_instance, __LINE__) {([&]()->void body)};
and call it as

    defer({
        function body here;
    });
Which looks much nicer. The preprocessor treats balanced curlies as one single token regardless of how many lines it spans, precisely to enable this usage.

Re: I ruined my vacation by reverse engineering WSC

#124
post #68

Earlier quoted context omitted.

It’s my hardware. I’ll do what I want with it, m8. Simple as that.

Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…

Man that is a silly line of thought. Your conclusion now has to be that all freedom is bad because peoples choices can have ramifications, yeah?

Oh, you chose to buy new shoes even though they were too tight which distracted you for 1 sec in your car on the way home, due to the discomfort, so you hit someone and they died.

Clearly people can not be trusted to buy their own shoes!

Re: I ruined my vacation by reverse engineering WSC

#125
post #118

Earlier quoted context omitted.

We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.

It sounds like adding an exception is the intended way to do exactly what you’re doing and resolves the issue entirely. It also sounds like you wrote bad software that didn’t consider the architecture of the parent OS.

While your first statement is reasonable, your second is uncharitable and hostile.

If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer.

Amusingly Microsoft ships exclusions for their own software, and states "Opting out of automatic exclusions might adversely impact performance, or result in data corruption. Automatic server role exclusions are optimized for Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025."

https://learn.microsoft.com/en-us/defender-endpoint/configur...

Re: I ruined my vacation by reverse engineering WSC

#126
post #17

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though

https://en.cppreference.com/w/cpp/experimental/scope_exit

  scope_exit{[&]{ ... } };

Re: I ruined my vacation by reverse engineering WSC

#127

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

https://www.shodan.io/search/facet?query=windows&facet=vuln....

Re: I ruined my vacation by reverse engineering WSC

#128
post #113

Earlier quoted context omitted.

Ah yes, I have my Windows power user bingo card dusted off! So far in this thread I’ve got: - Antivirus software is malware - We have to disable Windows Updates because I didn’t like them 30 years ago - Windows Defender hogs resources, laptop reviews showing Windows systems getting 10 hours of web browsing battery life are lying, Windows Defender actually ruins the performance of your computer - It’s better to compla…

We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.

The solution there is adding the exception, not turning off Defender, especially when you don't have control over what other activities may take place on the system.

Exceptions are valid when scoped to a container where you reasonably expect to be the sole user of the data therein and it contains no executable code.

Re: I ruined my vacation by reverse engineering WSC

#129
post #110

Earlier quoted context omitted.

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

I don't think we actually need `->void` -- shouldn't the compiler be able to infer the return type (or rather, absence thereof)? My experience is that the compiler only struggles when the return value needs to be implicitly converted to some other type. Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`? Agreed that the simplest "fix" would be to just rename the macro to be all-caps.

> I don't think we actually need `->void`

Yes, agreed.

> Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`?

It's subjective but personally I still hate it.

> Agreed that the simplest "fix" would be to just rename the macro to be all-caps.

Actually I think the bigger part of my suggestion is switching from an object-like macro to a function-like macro [1], which makes it all a bit less magical.

[1] https://stackoverflow.com/questions/36126687/function-like-m...

Re: I ruined my vacation by reverse engineering WSC

#130
post #59

Earlier quoted context omitted.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

its been disabled. defender group policy auto re-enabling is readily reproducible. i have a screenshot showing defender detecting the group policy change as a malware detection.

any control you think you have over windows is imaginary.

Post reply on HN