Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

61–70 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#61

Post by Sebb767 »

quietbritishjim wrote: post #41
chii wrote: post #22

Earlier quoted context omitted.

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

> * Defer has an overloaded operator%. It's a template function, which takes a callable object (type is the template parameter Callable) and returns a DeferHolder instance.

Is there any reason to use operator% instead of a normal method call? Except possibly looking cool, which doesn't seem useful given that the call is hidden away in a macro anyway.

Re: I ruined my vacation by reverse engineering WSC

#62

Post by geocar »

eru wrote: post #46
geocar wrote: post #24

Earlier quoted context omitted.

I think the point is to disable defender: Air-gapped machines, kiosks, industrial applications, and so on, have no need to eat gobs of ram and waste loads of cpu checking the same files over and over again. For other applications, WD provides dubious benefits. It is annoying that there isn't a switch that says "I know how to operate a computer". Evildoers don't need to bother with this: If they have access at this po…

Why would Microsoft care how much money I spend with my CPU core vendor?

Because Microsoft charges per core:

https://www.microsoft.com/en-us/windows-server/pricing

Re: I ruined my vacation by reverse engineering WSC

#63

Post by bob1029 »

fransje26 wrote: post #48
devrandoom wrote: post #14

Earlier quoted context omitted.

Performance reasons? Malware development? Hacking?

Is there a more performant, less resource-crippling, antivirus for Windows?

A skilled user.

I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system.

There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser.

Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don't make me go dig through DMCA'd repos and dark corners of the internet (!) to find a way to properly disable this bullshit.

Re: I ruined my vacation by reverse engineering WSC

#64

Post by quietbritishjim »

chii wrote: post #54
quietbritishjim wrote: post #41

Earlier quoted context omitted.

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

That's interesting! So i assume that this macro allows code to get registered to be run after the 'current' scope exits. But from my understanding (or lack thereof), the `auto _defer_instance_1234 =` is never referenced post construction. Why doesn't the compiler immediately detect that this object is unused and thus optimize away the object as soon as possible? Is it always guaranteed that the destructor gets called…

> Why doesn't the compiler immediately detect that this object is unused and thus optimize away the object as soon as possible? Is it always guaranteed that the destructor gets called only after the current scope exits?

Yes, exactly. The destructor is allowed to have some visible side effect such as closing a file handle or unlocking a mutex that could violate the assumption of the code in that block. (Even just freeing some memory could be an issue for code in the block.) It is guaranteed that the destructor is closed at the end of the block, and that all the destructors called in that way happen in reverse order to the order of their corresponding constructors.

Re: I ruined my vacation by reverse engineering WSC

#65

Post by jeffbee »

chii wrote: post #54
quietbritishjim wrote: post #41

Earlier quoted context omitted.

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

That's interesting! So i assume that this macro allows code to get registered to be run after the 'current' scope exits. But from my understanding (or lack thereof), the `auto _defer_instance_1234 =` is never referenced post construction. Why doesn't the compiler immediately detect that this object is unused and thus optimize away the object as soon as possible? Is it always guaranteed that the destructor gets called…

Yes, this is guaranteed. The compiler cannot simply elide statements with effects.

Re: I ruined my vacation by reverse engineering WSC

#69

Post by keepamovin »

stuffoverflow wrote: post #53
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

Correct! The browser is now the key vector because it's the most promiscuous and lascivious-for-code-and-data software on most devices.

Browser-zero days are why I factored out a way to distribute "web RPA agent creation" on any device, with no download - into its own product layer for browser-isolation. It's a legitimate defense layer but main barriers to adoption are operating friction, even tho it makes the task of hackers who want to compromise your network with browser 0-days much harder.

Because of that the RBI aspect is not as popular as ways its being used where you need a really locked down browser, with policies for preventing upload/download, even copy and paste, etc - for DLP (data loss prevention), for regulated enterprises.

Even so I think the potential applications of this tech layer are just starting.

Re: I ruined my vacation by reverse engineering WSC

#70

Post by xyst »

eru wrote: post #44
0xEF wrote: post #39

Earlier quoted context omitted.

> Max security or just peace of mind and a fast machine Or, to avoid making that choice at all, just don't use Windows.

There's plenty of other insecure systems.

Windows in its entirety is security theatre. WSC is an example of this
Post reply on HN