Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

151–160 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#151

Post by Yizahi »

stuffoverflow wrote: post #53
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

How do you know your system weren't infected in that experiment?

Re: I ruined my vacation by reverse engineering WSC

#152

Post by e12e »

stuffoverflow wrote: post #53
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

> browsing all kinds of sketchy sites with Firefox and chrome

How did you install those - downloaded via another system? Because with that old system, you are missing ssl certificates (Firefox and Chrome bring their own).

Re: I ruined my vacation by reverse engineering WSC

#153

Post by Yizahi »

bob1029 wrote: post #63
fransje26 wrote: post #48

Earlier quoted context omitted.

Is there a more performant, less resource-crippling, antivirus for Windows?

A skilled user. I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system. There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don'…

Skilled in what exactly? In x-raying all data storages on a system with a naked eye and spotting there a malware? In sniffing ether around the system and smelling a malicious bits on the radio spectrum coming in? How does this skill works?

Re: I ruined my vacation by reverse engineering WSC

#155

Post by delfinom »

tallanvor wrote: post #128
BenjiWiebe wrote: post #117

Earlier quoted context omitted.

We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.

The solution there is adding the exception, not turning off Defender, especially when you don't have control over what other activities may take place on the system. Exceptions are valid when scoped to a container where you reasonably expect to be the sole user of the data therein and it contains no executable code.

I honestly have never seen Defender behave with exceptions properly. Sometimes it does, sometimes it doesn't. Seems to depend on whether the day starts with a T.

Re: I ruined my vacation by reverse engineering WSC

#156

Post by oefrha »

dangus wrote: post #118
BenjiWiebe wrote: post #117

Earlier quoted context omitted.

We use some software that stores each record in a separate file; basically using the filesystem as a database. Without adding an exception to Windows defender, that software is unusably slow. Once the exception is added (or defender is turned off) the software is nice and fast again.

It sounds like adding an exception is the intended way to do exactly what you’re doing and resolves the issue entirely. It also sounds like you wrote bad software that didn’t consider the architecture of the parent OS.

That “architecture of the parent OS” is so shitty they had to introduce a first party “Dev Drive” mode to disable said architecture wholesale so that developer workflows aren’t crippled. Think about that.

I assume you either don’t really know what you’re talking about, or are arguing in bad faith.

Oh, and people develop software for a living and sometimes that involves making sure the software works on Windows. Not everyone complaining is using Windows by choice.

Re: I ruined my vacation by reverse engineering WSC

#157

Post by musjleman »

dangus wrote: post #119
wpm wrote: post #115

Earlier quoted context omitted.

> In what universe is windows defender “resource-crippling?” This one? Not all of us want to throw perfectly usable hardware in the e-waste pile. Windows 10 was perfectly fine on my old Haswell miniPC, save for Defender wasting CPU cycles and IO doing..."checks".

Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware. We are in the “Windows users complain endlessly and refuse to switch to Linux” bingo card right now. Windows has been this way since before you bought that mini PC.

> Let’s cut the bullshit, Defender is basically unchanged as a concept since Windows Vista or maybe even Windows XP. It runs completely fine on 15 year old hardware.

Exactly. It's the same legacy scan every fucking thing you open AV architecture.

Back in the day of spinning disks it probably wouldn't have been too noticeable for the AV to marshal scanning to its usermode service and the filesystem to pull the data from cache for the original request afterwards. However now that we have 10GB/s+ capable SSDs the factor of slowdown is exponentially larger.

I can run ripgrep on a massive directory, make myself a cup of tea and return to it still searching for matches versus being done in < 10 seconds with defender disabled.

Re: I ruined my vacation by reverse engineering WSC

#158

Post by qingcharles »

RedCardRef wrote: post #143
Fokamul wrote: post #142

Earlier quoted context omitted.

To prepare Win11 Enterprise edition image for distribution, I run ~200 lines long powershell script, nuking every bloatware MS puts into Win. It's ridiculous. Linux distro devs, working for free, pushing excellent product can't compare with these clowns in high-paying jobs at Microsoft, pretending they're working.

Care to share the powershell script with us?

https://github.com/Raphire/Win11Debloat

I start with Tiny11 first though these days, then run that to get rid of the last few bits.

Re: I ruined my vacation by reverse engineering WSC

#159

Post by leeter »

Sesse__ wrote: post #139
leeter wrote: post #116

Earlier quoted context omitted.

You attack the networking stacks for it, those are still actively developed (mTCP was last updated Jan 2025) as businesses use networked DOS for quite a few things. A DOS networking stack consists of a packet driver, a NIC driver, and a protocol library. All of those have attack surface. NIC drivers in particular often haven't really had updates since they were first released. Because for hardware manufacturers of th…

So you are not talking about attacking old code at all, but networking stacks that are indeed actively developed? That feels like a very different ball game from attacking Win98, even if the platform they are running on top of is old.

It's a complicated space. There are attacks on both maintained and unmaintained stacks. There are definitely attacks against windows 95/98 too because people have things like mills or other industrial automation that are powered by those OSes still connected to the internet. There is a lot of SCADA[1] too that fits that bill. It's easy to think "but why wasn't this replaced!" and the answer is almost always "cost or process certification". If the operator is lucky and has good networking folks all of this is in a very very well firewalled VLAN. But, never underestimate the amount of people that are not that savvy and just have it plugged into the internet.

For anyone saying these aren't targets, no they are probably already hacked. These are the things that keep the national security folks up at night knowing an adversary has them already backdoored and set up for take down. Moreover if they execute on that they would go for maximum damage first to either create chaos, or prevent the system from being repaired easily.

[1]https://en.wikipedia.org/wiki/SCADA#Security

Re: I ruined my vacation by reverse engineering WSC

#160

Post by duskwuff »

grishka wrote: post #150
einsteinx2 wrote: post #85

> As you might still remember, I was working on an arm64 macbook and there currently is no sane solutions how to emulate x86 windows on arm macbooks. What about UTM? Also Parallels recently added initial support for Intel VMs as well.

Correct me if I'm wrong, but isn't the emulation of an MMU-equipped CPU a fundamentally slow and unoptimizable task? Apple's Rosetta and its Microsoft equivalent only work as fast as they do because they only run userspace code so they don't have to emulate the MMU.

I wouldn't go as far as to say unoptimizable, but it's certainly harder, particularly if your emulator is running in userspace (like Rosetta does).
Post reply on HN