Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

131–140 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#131

> As you might still remember, I was working on an arm64 macbook and there currently is no sane solutions how to emulate x86 windows on arm macbooks. What about UTM? Also Parallels recently added initial support for Intel VMs as well.

The dynarec systems in QEMU aren't as efficient as the native dynarec systems in Windows and macOS (Rosetta 2). You can definitely run x86 Windows with UTM, and it works, but the performance characteristics are pretty poor. From a utility perspective, I've found that running an ARM Windows VM and using Windows' dynarec system to run x86 apps, or using WINE (both using native compiled subsystem code) is a much better experience. It's one of those things where it's okay if you need to run a workload in a pinch.

I'm not sure if performance characteristics are part of what the OP considers "sane", but if it is, I get the position.

Re: I ruined my vacation by reverse engineering WSC

#132

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

Path traversal attacks against IIS (or any web server) are still routine yet those were fixed back in the Win 2K days.

Your thought process is not correct.

Re: I ruined my vacation by reverse engineering WSC

#133
> the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request

I got really, really confused after that statement, because I don't understand what "the antivirus I was using" means and why they would have a reason to send the author a DMCA.

I think it means the author reverse-engineered another antivirus and put parts of it in their open-source project. But it could also mean other things. Skimming I see a heading with "Impersonating WinDefend".

So is the jist that the author somehow broke some kind of copyright law?

Re: I ruined my vacation by reverse engineering WSC

#134
post #118

Earlier quoted context omitted.

It sounds like adding an exception is the intended way to do exactly what you’re doing and resolves the issue entirely. It also sounds like you wrote bad software that didn’t consider the architecture of the parent OS.

While your first statement is reasonable, your second is uncharitable and hostile. If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer. Amusingly Microsoft ships exclusions for their own software, and states "Opting out of automatic exclusions might adversely impact performance, or result in data…

> If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer.

I guess Nintendo is wrong for not giving you a file system at all on the Game Boy. The analogy may be extreme but that’s part of the point here: who are we to dictate Microsoft’s design goals and choice of compromises?

It’s really not Microsoft’s fault if their product doesn’t meet the specific needs of someone’s specific software use case.

I do agree that my first suggestion is the more sensible one, but my second one was more of a philosophical point. Windows has been the same old Windows for a long time and developers that don’t understand its limitations and requirements for deploying applications are more in the wrong than Microsoft in this scenario.

If Microsoft felt like the best design decision was to remove windows defender and that there was no negative impact to doing so they would have done it by now.

Re: I ruined my vacation by reverse engineering WSC

#136
post #134

Earlier quoted context omitted.

While your first statement is reasonable, your second is uncharitable and hostile. If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer. Amusingly Microsoft ships exclusions for their own software, and states "Opting out of automatic exclusions might adversely impact performance, or result in data…

> If Windows won't allow use of the filesystem as a database or cannot heuristically detect when a folder is being used as a store of data, Windows is wrong, not the developer. I guess Nintendo is wrong for not giving you a file system at all on the Game Boy. The analogy may be extreme but that’s part of the point here: who are we to dictate Microsoft’s design goals and choice of compromises? It’s really not Microsof…

I'm sorry, but I believe your argument is extremely weak.

The Nintendo/Game Boy analogy doesn’t hold water. Nintendo doesn’t give you a filesystem on the Game Boy, but it certainly doesn’t stop you from implementing one yourself. Nintendo doesn’t include a filesystem because that’s not part of the Game Boy’s platform model; it’s a console with fundamentally different goals and constraints. If you require a virtual filesystem to load assets for your game, Nintendo _will not_ slow your cartridge ROM down.

Windows, on the other hand, has always shipped with a general-purpose filesystem and encourages developers to use it for data persistence, caching, configuration, and more. In fact, the Win32 API is deeply file-centric. Even the OS has its own hidden virtual filesystem.

Windows is a Unix-inspired CP/M derivative, and both lineages are strongly file-based. In fact, when Windows tried to replace the filesystem with a database in Longhorn, they failed spectacularly, and only a few pieces of that design are left today. What still exists, however, is a filesystem optimized for storing files.

Suggesting that developers are "in the wrong" for relying on the filesystem on an OS that has always promoted it is like blaming drivers for expecting roads to be usable. We’ve been building software on Windows that reads and writes files for decades, with Microsoft’s full blessing.

If Defender or related tooling starts punishing valid, decades-old patterns like using a folder as a key-value store, that’s not a failure of developers to "understand Windows". It’s a regression in the OS, or at least a poor balance of heuristics.

We absolutely should question Microsoft’s design goals if they break longstanding, legitimate use cases without offering workable alternatives. Being dominant doesn’t make them immune to critique, especially when their changes have real-world consequences for maintainable, cross-platform software using well-established techniques.

Re: I ruined my vacation by reverse engineering WSC

#137

> the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request I got really, really confused after that statement, because I don't understand what "the antivirus I was using" means and why they would have a reason to send the author a DMCA. I think it means the author reverse-engineered another antivirus and put parts of it in their open-…

yes, they broke copywright law by copying part of an existing AV program.

From the paragraph directly before the one you quoted:

The way how my project worked is that it was using a thirdparty code from some already existing antivirus and forced that av to register the antivirus in WSC.

Re: I ruined my vacation by reverse engineering WSC

#138

> the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request I got really, really confused after that statement, because I don't understand what "the antivirus I was using" means and why they would have a reason to send the author a DMCA. I think it means the author reverse-engineered another antivirus and put parts of it in their open-…

My understanding is he used the carcass of another AV tool to bypass signature requirements which is understandably grey (there's an argument for it being transformative, IMO but IANAL).

Re: I ruined my vacation by reverse engineering WSC

#139
post #116

Earlier quoted context omitted.

Now I'm curious, how do you attack DOS? I mean, it comes without networking support, and if you have local access, you're already privileged.

You attack the networking stacks for it, those are still actively developed (mTCP was last updated Jan 2025) as businesses use networked DOS for quite a few things. A DOS networking stack consists of a packet driver, a NIC driver, and a protocol library. All of those have attack surface. NIC drivers in particular often haven't really had updates since they were first released. Because for hardware manufacturers of th…

So you are not talking about attacking old code at all, but networking stacks that are indeed actively developed? That feels like a very different ball game from attacking Win98, even if the platform they are running on top of is old.

Re: I ruined my vacation by reverse engineering WSC

#140
post #45
post #38

Earlier quoted context omitted.

It needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guid…

This is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?

Or use the abbr (and its title attribute) that was designed for that purpose; no extraneous "flow" breaking required. Mobile people can long press on the indicator to read more, everyone who magically knew what WSC gets to continue to know what WSC means

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

Post reply on HN