Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

161–170 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#161

Post by nyanpasu64 »

da_chicken wrote: post #81
keepamovin wrote: post #5

Earlier quoted context omitted.

It's weird that windows wouldn't have a signed manifest that would detect that

It does have that. Windows uses code signing and either DISM or SFC to do that. But this isn't about the binaries. It's where definitions and configuration are stored. It's C:\ProgramData, not C:\Program Files. The system also can't object too severely. Third party endpoint protection exists.

This is about the binaries. I first tried renaming the folder in Program Files, but Defender still kept eating RAM and CPU resources which were scarce on a 12-year-old laptop.

Re: I ruined my vacation by reverse engineering WSC

#162

Post by vitus »

quietbritishjim wrote: post #129
vitus wrote: post #110

Earlier quoted context omitted.

I don't think we actually need `->void` -- shouldn't the compiler be able to infer the return type (or rather, absence thereof)? My experience is that the compiler only struggles when the return value needs to be implicitly converted to some other type. Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`? Agreed that the simplest "fix" would be to just rename the macro to be all-caps.

> I don't think we actually need `->void` Yes, agreed. > Would it have looked any less cursed if it just read `defer { CoUninitialize(); };`? It's subjective but personally I still hate it. > Agreed that the simplest "fix" would be to just rename the macro to be all-caps. Actually I think the bigger part of my suggestion is switching from an object-like macro to a function-like macro [1], which makes it all a bit les…

And, I personally hate macros that pretend to be functions but provide no visual indicator that they're not actually functions. For instance, `#define min(x, y) (x I think the "best" approach here would be to make it a function-like macro, and also change the name to all caps.

(Also, I tend to agree that `defer { ... };` is still cursed -- it requires the trailing semicolon, which further breaks the illusion of a keyword that takes a block scope.)

Re: I ruined my vacation by reverse engineering WSC

#163

Post by amne »

keepamovin wrote: post #69
stuffoverflow wrote: post #53

Earlier quoted context omitted.

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

Correct! The browser is now the key vector because it's the most promiscuous and lascivious-for-code-and-data software on most devices. Browser-zero days are why I factored out a way to distribute "web RPA agent creation" on any device, with no download - into its own product layer for browser-isolation. It's a legitimate defense layer but main barriers to adoption are operating friction, even tho it makes the task o…

Just the other day I went to a website to flash a new firmware on a zigbee dongle. Straight from a chrome tab. wild!

Then it hit me: the only thing keeping a rogue website from sweeping your entire life is a browser's permissions popup.

Re: I ruined my vacation by reverse engineering WSC

#164

Post by kjs3 »

londons_explore wrote: post #36
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

Those of us who actually do this stuff for a living still routinely see probes for Slammer, Zotob, Blaster and more from when we booted our computers by rubbing two sticks together.

Re: I ruined my vacation by reverse engineering WSC

#165

Post by smileybarry »

devwastaken wrote: post #57
71bw wrote: post #7

Earlier quoted context omitted.

Group policies still work so effectively that I've set up a local domain using a controller in my homelab that does nothing but change the defender policies automatically for all users.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

I thought so too, but if you switch everything off (including Tamper Protection) in the UI, then turn it off via (local!) Group Policy, it sticks. I’ve set up a few Windows 10 22H2 & 11 24H2 test VMs this way and they still have Defender disabled.

(I think you need to disable Tamper Protection first, otherwise you later get a threat detected of “WinDefendDisable”, but if you allow/unquarantine it doesn’t auto-enable again)

Re: I ruined my vacation by reverse engineering WSC

#166

Post by smileybarry »

grishka wrote: post #149
devwastaken wrote: post #57

Earlier quoted context omitted.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

Group policies and registry keys are gentle suggestions. Deleting or renaming files is "I wasn't asking, it's my computer not yours" kind of approach.

…until Windows Update Repair or the like undo your changes.

Re: I ruined my vacation by reverse engineering WSC

#167

Post by smileybarry »

e12e wrote: post #152
stuffoverflow wrote: post #53

Earlier quoted context omitted.

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

> browsing all kinds of sketchy sites with Firefox and chrome How did you install those - downloaded via another system? Because with that old system, you are missing ssl certificates (Firefox and Chrome bring their own).

Maybe, but with good old Windows PKI you’re bound to still have a working chain of trust with Mozilla/Google.

…either that or the machine cheated and updated root CAs in the background (which isn’t Windows Update-controlled anymore).

Re: I ruined my vacation by reverse engineering WSC

#168

Post by tbrownaw »

grishka wrote: post #149
devwastaken wrote: post #57

Earlier quoted context omitted.

group policy no longer works on win11. updates will reverse it. additionally defender detects turning off realtime monitoring as malware.

Group policies and registry keys are gentle suggestions. Deleting or renaming files is "I wasn't asking, it's my computer not yours" kind of approach.

Oh, I thought the "I wasn't asking" option was to just reimage it with Linux.

Re: I ruined my vacation by reverse engineering WSC

#169

Post by Suppafly »

dangus wrote: post #113
hoseja wrote: post #87

Earlier quoted context omitted.

It's called no antivirus. It's what this is supposed to do. Antiviruses are useless malware.

Ah yes, I have my Windows power user bingo card dusted off! So far in this thread I’ve got: - Antivirus software is malware - We have to disable Windows Updates because I didn’t like them 30 years ago - Windows Defender hogs resources, laptop reviews showing Windows systems getting 10 hours of web browsing battery life are lying, Windows Defender actually ruins the performance of your computer - It’s better to compla…

>Windows Defender hogs resources, laptop reviews showing Windows systems getting 10 hours of web browsing battery life are lying, Windows Defender actually ruins the performance of your computer

There are definitely times when I wish I could disable it outright. Often someone will want my help reviving an old computer or laptop and it'll have to sit for a day in a loop of windows update fighting windows defender for resources with neither of them making much headway before one or the other will finish enough to let the other run for a bit.

Re: I ruined my vacation by reverse engineering WSC

#170

Post by grishka »

smileybarry wrote: post #166
grishka wrote: post #149

Earlier quoted context omitted.

Group policies and registry keys are gentle suggestions. Deleting or renaming files is "I wasn't asking, it's my computer not yours" kind of approach.

…until Windows Update Repair or the like undo your changes.

You can do this to Windows Update too.
Post reply on HN