For those wondering:
WSC stands for Windows Security Center.
I had to look it up as well
I ruined my vacation by reverse engineering WSC
21–30 of 196 posts
Re: I ruined my vacation by reverse engineering WSC
#22This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...
can someone well versed in explaining CPP magic explain what is going on and why it is cursed?
Re: I ruined my vacation by reverse engineering WSC
#23This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...
yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though
Honestly if this isn't part of a public API this isn't very cursed in terms of C++, especially if you have a lot of one-off cleanup operations.
I think the only bit I don't like personally is the syntax. I normally implement defer as a macro to keep things clean. If done correctly it can look like a keyword: `defer []{ something(); };`.
Re: I ruined my vacation by reverse engineering WSC
#24Is the point to actually disable defender or to highlight a vulnerability?
I think the point is to disable defender: Air-gapped machines, kiosks, industrial applications, and so on, have no need to eat gobs of ram and waste loads of cpu checking the same files over and over again. For other applications, WD provides dubious benefits. It is annoying that there isn't a switch that says "I know how to operate a computer".
Evildoers don't need to bother with this: If they have access at this point you've got other problems.
Microsoft may extend WD to detect/block this vector since it is using undocumented interfaces; Microsoft would absolutely prefer you buy more cores, and if you're not going to do that, collect some additional licensing revenue through some other way.
Re: I ruined my vacation by reverse engineering WSC
#25FYI, WSC stands for Windows Security Center.
Thank you for the help. It is really frustrating when authors do not define an acronym when it is first introduced in the text.
Re: I ruined my vacation by reverse engineering WSC
#26The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.
That is basically how a popular product does it,while taking down about 25% of the entire internet...
I see what you did there.
Re: I ruined my vacation by reverse engineering WSC
#27FYI, WSC stands for Windows Security Center.
Thank you for the help. It is really frustrating when authors do not define an acronym when it is first introduced in the text.
But they do:
> The part of the system that manages all this mess is called Windows Security Center - WSC for short.
Re: I ruined my vacation by reverse engineering WSC
#28This is a godsend. I should send you a jar of KimChee for this. Please return to Seoul, and enjoy the sights. South Korea is one of the most beautiful countries in the world. Try to plan into corrispond to either the cherry blossoms falling in the spring, or the leaves falling in the fall. I miss Seoul.
Will you go back? Holidays, or are you from there?
Re: I ruined my vacation by reverse engineering WSC
#29Earlier quoted context omitted.
It's weird that windows wouldn't have a signed manifest that would detect that
You can also disable Windows Update entirely by taking ownership of wuaueng.dll and .exe. It’s the only effective method on Windows Home.
But disabling updates on the system connected to the Internet is a terrible idea.
How do you update that afterwards?
Re: I ruined my vacation by reverse engineering WSC
#30This is a godsend. I should send you a jar of KimChee for this. Please return to Seoul, and enjoy the sights. South Korea is one of the most beautiful countries in the world. Try to plan into corrispond to either the cherry blossoms falling in the spring, or the leaves falling in the fall. I miss Seoul.
"Busan is Good"
<3