Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

141–150 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#141

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

Code is a way you treat your coworkers - Michael Feather, https://x.com/mfeathers/status/1031176879577780224

TL;DR, not AI

The code defers a function call until the point in time that an object goes out of scope. The implementation uses C macros to create a more succinct syntax that omits parts of the necessary C lambda/unnamed function definition and to create a unique variable name for managing the deferred function call. However, the resulting syntax eschews the common convention of using UPPER CASE to denote C macros, and instead appears similar at first glance to a function call from an object pointer.

This can cause confusion if one is not familiar with this pattern and expects macros to be communicated differently. Some commenters say this is common enough, or useful enough to them, to be considered almost idiomatic in some contexts.

For technical explanation, https://news.ycombinator.com/item?id=43959403#43960905 provides a useful breakdown of how the macro works.

Re: I ruined my vacation by reverse engineering WSC

#142
post #59

Earlier quoted context omitted.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro

To prepare Win11 Enterprise edition image for distribution, I run ~200 lines long powershell script, nuking every bloatware MS puts into Win. It's ridiculous.

Linux distro devs, working for free, pushing excellent product can't compare with these clowns in high-paying jobs at Microsoft, pretending they're working.

Re: I ruined my vacation by reverse engineering WSC

#143

Earlier quoted context omitted.

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro

To prepare Win11 Enterprise edition image for distribution, I run ~200 lines long powershell script, nuking every bloatware MS puts into Win. It's ridiculous. Linux distro devs, working for free, pushing excellent product can't compare with these clowns in high-paying jobs at Microsoft, pretending they're working.

Care to share the powershell script with us?

Re: I ruined my vacation by reverse engineering WSC

#144
post #68

Earlier quoted context omitted.

It’s my hardware. I’ll do what I want with it, m8. Simple as that.

Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…

I presume you use Apple products, right?

Re: I ruined my vacation by reverse engineering WSC

#145
post #22

Earlier quoted context omitted.

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

Eh, there are better implementations that are less syntactically obtuse (no ->void) but other than that it’s fine. Fairly obvious what it’s supposed to do and I’ve needed similar things in the past. There’s a cppcon talk that use ->* operator for precedence reasons and the macro lets you use it like ‘defer { … };’

Re: I ruined my vacation by reverse engineering WSC

#146
post #11

Why would you want to disable WSC?

If you are a threat actor, you could get lucky and there isn't another Endpoint Detection and Response product installed, which would almost certainly intercept this.

If you are an EDR vendor, this is an obfuscated API call that EDR vendors can use to suppress or disable the Windows Firewall. CrowdStrike for example, can do either I believe, use Windows Firewall or use their implementation.

Re: I ruined my vacation by reverse engineering WSC

#147
post #114

Earlier quoted context omitted.

My suggestion: In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly.

thank you! i changed the first paragraph to include these changes

Ah that makes sense. I saw this subthread and was quite confused because WSC was clearly and obviously defined in the first sentence.

Now I see why. Thanks for incorporating the feedback! It had a positive impact for me coming later to this article.

Re: I ruined my vacation by reverse engineering WSC

#148

Earlier quoted context omitted.

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro

In a sense, it has been for a long time. With Linux, there's often a good clean way to do a thing, and then there are weird hacks. On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem. (I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K Euro…

By doing it slowly they enabling a hacker spirit to evolve, which I’m sure is unintentional.

Re: I ruined my vacation by reverse engineering WSC

#149
post #7

Earlier quoted context omitted.

Group policies still work so effectively that I've set up a local domain using a controller in my homelab that does nothing but change the defender policies automatically for all users.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

Group policies and registry keys are gentle suggestions. Deleting or renaming files is "I wasn't asking, it's my computer not yours" kind of approach.

Re: I ruined my vacation by reverse engineering WSC

#150

> As you might still remember, I was working on an arm64 macbook and there currently is no sane solutions how to emulate x86 windows on arm macbooks. What about UTM? Also Parallels recently added initial support for Intel VMs as well.

Correct me if I'm wrong, but isn't the emulation of an MMU-equipped CPU a fundamentally slow and unoptimizable task? Apple's Rosetta and its Microsoft equivalent only work as fast as they do because they only run userspace code so they don't have to emulate the MMU.
Post reply on HN