Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

41–50 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#41
post #22

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

We're starting with this code:

   defer->void { CoUninitialize(); };
Using the macros in the second linked file, this expands to:

   auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); };
* The 1234 is whatever the line number is, which makes the variable name unique.

* auto means infer the type of this local variable from the expression after the =.

* Defer{} means default construct a Defer instance. Defer is an empty type, but it allows the % following it to call a specific function because...

* Defer has an overloaded operator%. It's a template function, which takes a callable object (type is the template parameter Callable) and returns a DeferHolder instance.

* [&]()->void { /*code here*/ }; is C++ syntax for a lambda function that captures any variables it uses by address (that's the [&] bit), takes no parameters (that's the () bit) and returns nothing (that's the ->void bit). The code goes in braces.

* DeferHolder calls the function it holds when it is destroyed.

It's subjective but some (including me!) would say it's cursed because it's using a macro to make something that almost looks like C++ syntax but isn't quite. I'm pretty confident with C++ but I had no idea what was going on at first (except, "surely this is using macros somehow ... right?"). [Edit: After some thought, I think the most confusing aspect is that defer->void looks like a method call through an object pointer rather than a trailing return type.]

I'd say it would be better to just be honest about its macroness, and also just do the extra typing of the [&] each time so the syntax of the lambda is all together. (You could then also simplify the implementation.) You end up with something like this:

   DEFER([&]()->void { CoUninitialize(); });
Or if you go all in with no args lambda, you could shorten it to:

   DEFER({ CoUninitialize(); });

Re: I ruined my vacation by reverse engineering WSC

#42

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

Actually riddle me this: what if you want to exploit exactly the type of person to disable updates? They are potentially more lucrative targets if nobody else targets them. Just a thought. It's sort of how "delete me" services profit off paranoia, they're a lucrative market because of the paranoia.

Re: I ruined my vacation by reverse engineering WSC

#43
post #22

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

C++ sort-of guarantees that your objects' destructors will be called when they go out of scope.

So you can abuse this mechanic to 'register' things to be executed at the end of the current scope, almost no matter how you exit the current scope.

Re: I ruined my vacation by reverse engineering WSC

#44
post #39
post #35

Lmao reverse engineering WSC on vacation sounds like some real dedication - honestly can't tell if that's commitment or just a cry for help. Made me think: if tuning all this stuff gives you a headache, would you rather have max security or just peace of mind and a fast machine?

> Max security or just peace of mind and a fast machine Or, to avoid making that choice at all, just don't use Windows.

There's plenty of other insecure systems.

Re: I ruined my vacation by reverse engineering WSC

#45
post #38
post #27

Earlier quoted context omitted.

But they do: > The part of the system that manages all this mess is called Windows Security Center - WSC for short.

It needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guid…

This is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?

Re: I ruined my vacation by reverse engineering WSC

#46
post #24

Is the point to actually disable defender or to highlight a vulnerability?

I think the point is to disable defender: Air-gapped machines, kiosks, industrial applications, and so on, have no need to eat gobs of ram and waste loads of cpu checking the same files over and over again. For other applications, WD provides dubious benefits. It is annoying that there isn't a switch that says "I know how to operate a computer". Evildoers don't need to bother with this: If they have access at this po…

Why would Microsoft care how much money I spend with my CPU core vendor?

Re: I ruined my vacation by reverse engineering WSC

#47
post #40

Earlier quoted context omitted.

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

That seems like pretty sketchy reasoning. Like leaving your door unlocked, because you live in such a sketchy neighbourhood that everyone else always locks their doors.

More like, continue living in a sketchy neighbourhood because all the thieves go to the newer, more polished neighbourhoods anyway.

Re: I ruined my vacation by reverse engineering WSC

#49

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

Would suck if an exploit was present for years, sometimes decades. Would especially suck if people piled up old exploits and fell back on them as needed.

Re: I ruined my vacation by reverse engineering WSC

#50
post #25
post #3

FYI, WSC stands for Windows Security Center.

Thank you for the help. It is really frustrating when authors do not define an acronym when it is first introduced in the text.

At least that one is defined later on. I'm still scratching my head over "CTF".

[Edit - could be Capture The Flag?]

Post reply on HN