Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

doublepulsar.com

Post reply on HN
Print view View original

171–180 of 184 posts

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#171

Post by rawoke083600 »

jmnicolas wrote: post #142
rawoke083600 wrote: post #83

Earlier quoted context omitted.

>" for regaining control over my own PC. Just yesterday I learned how to Run-As TrustedInstaller, and that let me remove a lot of unwanted bullshit on my windows 10 install." I understand Linux, Mac, FreeBSD, Magic-Pony-OS is not everyone's cup of tea or they might not be in a position to choose their OS (Work etc) But DAMN that quote above is really showing me how bad it is out there ! Sure it can/does happen on oth…

> Magic-Pony-OS and there I was thinking you were joking, but there's actually a PonyOS! https://www.ponyos.org/

Damn it looks "pretty" in a "Hello-Kitty" sort of way :D

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#172

Post by jaclaz »

naikrovek wrote: post #163
13of40 wrote: post #155

Earlier quoted context omitted.

The guy who implemented that really did a disservice to the filesystem metaphor, though. Instead of making values analogous to files, they're properties of registry keys, so instead of Get/Set-Content, Get-ChildItem, etc. you need to do some gymnastics with Get/Set-ItemProperty to work with them. For example, if you want to find a registry value with a particular name, you can't just do 'dir -rec SomeValueName' to fi…

well, the registry has types. files are raw binary data that is almost entirely untyped. how could they possibly enforce typed data without diverging from the filesystem metaphor?

Files are raw binary data, but a (BTW unreliable) method to understand what they contain has been in use since years: file extensions.

I can see no reason why in a filesystem-like representation of the Registry you cannot have a value.dwd (which is a DWORD), a value.bin (which is a BINary), value.esz, etc., or at least that is what I would use.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#173

Post by jaclaz »

rwmj wrote: post #51
Randor wrote: post #26

Earlier quoted context omitted.

Hi, Actually you can use the Windows Projected File System to project the registry into the file system, making registry keys and values appear as files and directories. https://github.com/Microsoft/Windows-classic-samples/tree/ma...

Something is still translating the virtual files back and forth to the half-arsed hive format. Would recommend reading the link I posted since I have actually reverse-engineered the hive format.

As an OT, side-side note, thanks for all the work you put it in hivex/hivexsh.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#174

Post by jaclaz »

jaclaz wrote: post #48
zamadatix wrote: post #36

Earlier quoted context omitted.

The Windows registry is certainly a database, perhaps just not the type you're used to https://en.wikipedia.org/wiki/Hierarchical_database_model Most of the actual technical issues you list have more to do with it being extended for the last 30 years in a backwards compatible way than anything to do with it being a hierarchical db instead of a filesystem.

I still see it as a file system, very similar to NTFS (similar in the sense of having similar features), apart the (recent) project just mentioned (ProjFS) there existed a file system like driver for it, only for the record: http://reboot.pro/topic/7681-the-registry-as-a-filesystem/ https://web.archive.org/web/20090413131629/http://czwsoft.dy... https://web.archive.org/web/20140401212651/http://pasotech.a... And: htt…

Before I forget, there is also multi-commander that uses the "filesystem approach":

http://multicommander.com/

http://multicommander.com/docs/browse-registry

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#175

Post by denton-scratch »

tjoff wrote: post #52
throwaway09223 wrote: post #41

Earlier quoted context omitted.

I have the same strong feelings about walled sites and tracking. May I recommend installing an extension to disable paywalls/tracking? Something like https://github.com/iamadamdev/bypass-paywalls-chrome (supports firefox despite the project name) which automatically wipes cookies from sites like Medium which enable "sign on" requirements after so many visits. It really improves the browsing experience. I used to open…

Then why visit such sites? I deliberately do not install extensions that hide problems for me. I want it to be cumbersome. I want to get annoyed so that I get discouraged to use the site in the first place, and I get reminded of that fact with every single visit. If the few that do care still visits there is no incitement for the site to not do it.

Me neither. The forced login just reminds me that this is a site I don't want to visit, and a tab that I want to close. I'm not going to configure a workaround for every obstacle the site operators throw in my way; if they don't want me to visit, I won't visit.

I think they'll eventually learn not to do these things (see also cookie banners). But if they don't, it doesn't matter to me. There's other content available.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#176

Post by jsjohnst »

lolinder wrote: post #166
jsjohnst wrote: post #164

Earlier quoted context omitted.

> > Yes, the conditions of side loading (needs a free developer account, must have app signing refreshed weekly , etc) might not be palatable for your taste > have to remember every single week to "refresh" my app, otherwise it won't work the next time I need it Did I not fully state that up front? Just because it doesn’t work for your needs (or mine for that matter) doesn’t change that my point is 100% correct, to s…

First, just to clear this up: I am not an Android fanboy, and not an iOS hater. My wife has an iPhone and an iPad and they are great for her use case, and I have a lot of respect for the consistency of the experience on an iPhone. I reluctantly have an Android phone because it's the only thing out there that meets my needs at the moment, but I'm under no illusions as to its flaws. On to the question of side loading:…

> First, just to clear this up: I am not an Android fanboy, and not an iOS hater.

Just to be clear, wasn’t calling you that specifically. That was expressing a frustration against the general type who responds whenever I jump in to share info on what exists and doesn’t in reality.

In your case, I made exactly your point up front and even stated it didn’t meet my needs personally. AltStore does a decentish job of smoothing along the process, but it’s still too much burden for me. But I feel I am very correct in saying it meets the technical definition of side-loading and even the “common knowledge” definition as long as you acknowledge the caveats, which I do.

So what do I do? Well, as much as I’ve spent on phones, laptops, tablets, cell service, internet service, etc I find adding another $99/year on top is just noise. I’m fortunate enough that my career allows me that option, otherwise I don’t know what I’d do as Android has dealbreaker faults for me (I do own a few Android phones, but none would remotely be my daily driver).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#177

Post by jsjohnst »

lolinder wrote: post #160
36rdydudhdh wrote: post #158

Earlier quoted context omitted.

I don't see how you can say with a straight face that getting technical just creates confusion and muddled waters when side-loading is already something that mainly technical users do. It just seems like a lazy way to dismiss valid criticism. The vast majority of users don't side-load on their phones or have any interest in learning to do so. Side-loading is already technical.

Those are two different definitions of technical. When you accuse someone of "getting technical", it has a very specific meaning: It means that they're overemphasizing the dictionary definition at the cost of more practical considerations. That's exactly what's happening here, by calling what Apple allows on iPhone "sideloading". Yes, technically, you are able to get an app on your phone without going through the app…

Sideloading is a made up term anyway with a loose meaning. The most common variant of the definition is:

> install apps that were not approved by the OS vendor and/or delivered via said company’s app store

iOS meets every letter of that.

The weekly resigning limitation is explicitly not about blocking code you wrote for your device, but about blocking piracy. That same feature that allows you to sideload an app you wrote, also allows you to take many paid apps and resign it for your device allowing you to skirt payment. I wish Apple would relax the signing for code that could be provably unique, but I’m sure there’s ways that would be exploited still and it would turn into a constant cat and mouse battle which Apple is choosing to not engage in. Does that suck, yes. Does it mean you can’t side load, no.

Long story short, I would not object to anyone who says iOS sideloading was useless without paying (even though that would be wrong in some folks’ eyes), but trying to claim it doesn’t exist when in reality it just doesn’t meet your (or my) needs feels important enough to say to lose karma over if necessary.

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#178

Post by TeMPOraL »

rwmj wrote: post #168
TeMPOraL wrote: post #151

Earlier quoted context omitted.

Don't see how this problem would be included in files. For every setting in the registry, there's a piece of software (and ultimately, a group of people behind it) that claims ownership to it, and determines the correct type for it. File-based configs on Linux have the same problem anyway. The semantics of any config file you find are defined by the application that's consuming it. Any two config files that superfici…

For Linux guests we use Augeas which offers a consistent interface to all the /etc files: https://github.com/hercules-team/augeas

The description makes it look like it's a way of presenting Linux configs as something resembling Windows registry :).

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#179

Post by Wowfunhappy »

jsjohnst wrote: post #177
lolinder wrote: post #160

Earlier quoted context omitted.

Those are two different definitions of technical. When you accuse someone of "getting technical", it has a very specific meaning: It means that they're overemphasizing the dictionary definition at the cost of more practical considerations. That's exactly what's happening here, by calling what Apple allows on iPhone "sideloading". Yes, technically, you are able to get an app on your phone without going through the app…

Sideloading is a made up term anyway with a loose meaning. The most common variant of the definition is: > install apps that were not approved by the OS vendor and/or delivered via said company’s app store iOS meets every letter of that. The weekly resigning limitation is explicitly not about blocking code you wrote for your device, but about blocking piracy. That same feature that allows you to sideload an app you w…

> iOS meets every letter of that.

Yes, in the same way that tomatoes meet the definition of a fruit. (And before you say "but tomatoes are a fruit"—exactly.†)

I respect your desire to be precise, but the problem is that it makes conversations super difficult. Detailing Apple's convoluted policies every time the topic comes up is tiresome and needlessly derails the conversation.

† See also: https://www.youtube.com/watch?v=XmxIK9p0SNM

Re: HiveNightmare a.k.a. SeriousSAM – anybody can read the registry in Windows 10

#180

Post by zamadatix »

throwaway09223 wrote: post #94
zamadatix wrote: post #74

Earlier quoted context omitted.

I'm actually with the author that if it were going to be rewritten a freshly written columnar database would be way more efficient than representing it as a filesystem but that either would be better than what we have after 30 years. I just don't think "it wasn't a filesystem originally" has much to do with why it's so crap now. Similar case: posix specifies network sockets be accessed as files/filesystems (as most e…

Sorry, I'm unfamiliar with what you mean by "network sockets be accessed as files." Do you mean unix domain sockets? These are in fact commonly used and they're certainly no less efficient (more efficient in many ways, in fact). UDS are interfaced with via the same berkeley sockets api, not via the filesystem api. Have you ever written applications that use them?

I don't mean unix domain sockets, those are known as IPC sockets. The berkeley sockets API you are familiar is actually exactly what I was talking about. It does offer both types of sockets (the other being network sockets as I originally mentioned) but it uses handles in an abstract namespace not files in a filesystem (e.g. in Linux it's still a FD but it doesn't map to an actual file on a filesystem it's just a unique handle in its own namespace).

What I was referring to were things like /dev/tcp/ and /dev/udp you'll find on Solaris (or emualated via bash on most systems) which are actual filesystem paths instead of handles in abstract namespace. A usage example of this comparable to binding to a socket with the BSD API to udp://localhost:2048 would be "echo "example" > /dev/udp/localhost/2048". The actual I/O is through the standard file/filesystem interface just like /dev/random. It's not the best for network sockets though so they tend to get a raw handle in every modern OS, even if it does mean rebuilding the wheel on some other things.

Network sockets are the canonical example of "not everything in Unix is a file". "Everything is a FD" is true but "everything is a handle" is true on any OS design, the uniqueness that things like ram and disks are just files under / did not hold true with networking.

And yes I have written plenty of apps with ipc sockets and network sockets and raw sockets and even underlying device access (for things like custom Ethernet packets). I'm in networking by profession.

Post reply on HN