Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A jump into the middle of an instruction from nowhere (2023)

devblogs.microsoft.com

Post reply on HN
Print view View original

71–80 of 112 posts

Re: A jump into the middle of an instruction from nowhere (2023)

#71

Post by iforgotpassword »

hiatus wrote: post #27
Ciantic wrote: post #9

Earlier quoted context omitted.

That is the weird part. My explorer.exe patch to disable flashing taskbar buttons was functioning with Microsoft Defender turned on for the whole lifetime of Windows 10 I used it. I didn't even need a UAC prompt to patch the memory. Nothing detects it, even though it goes and adds assembly instructions to three locations in the memory with WriteProcessMemory etc. It's not working by injecting DLL, it just modifies th…

Just curious, why AHK over C? Easier for users to run themselves?

I guess the C version was flagged by defender eventually? Seems to happen at some point with unsigned programs that aren't super popular these days. Using VB6 seems to be a safe bet to end up in defender quarantine. I guess because it was still used for malware a decade ago.

Re: A jump into the middle of an instruction from nowhere (2023)

#72

Post by justin66 »

bombcar wrote: post #19

Kind of sad. Even from this blog, he admits that the Microsoft of old would test software and see if it worked; the Microsoft of now obviously knows of the existence of these shell enhancements, but clearly doesn’t test patches against them at all.

> the Microsoft of now obviously knows of the existence of these shell enhancements, but clearly doesn’t test patches against them at all

Microsoft taking into account this method of modding explorer in its testing would be like asking Apple's design team to take into account the one in a million iPhone user who sticks their phone up their butt. [0] I don't know what it says about Windows or its users that there must be more than one in a million people running this stuff, but still.

[0] https://www.youtube.com/watch?v=bsbpFKDIaZ0

Re: A jump into the middle of an instruction from nowhere (2023)

#73

Post by daemin »

surajrmal wrote: post #43
jackewiehose wrote: post #11

There is an interview with Raymond Chen where he is trying to defend the reason why they crippled the taskbar with Windows 11 [1]. Watching that I was just thinking NO NO NO - it worked fine for the last 25 years and there can be absolutely no reason why they had to destroy the taskbar now. He deserves every headache he gets with these support requests. Or to quote this comment of the linked article: > There wouldn’t…

Watching the clip, the improvements he's talking about are great and very welcomed. Is this a case of any change being considered bad because you're used to how things are?

Only supporting grouped taskbar icons is a big inconvenience when actually trying to do work. Instead of clicking directly on the taskbar item which corresponds to the window you want to access it requires that you hover over the icon, then try to pick out the window you want from a very small thumbnail of it. This just adds extra time and unnecessary thought into this process. It's also quite bizarre given that wide monitors are more normal these days with plenty of space to have a long taskbar with many items on it, but instead you only get some short icons in the centre.

This may have been fixed in recent versions where they finally added the ability to change the taskbar grouping in the settings, but I haven't felt the need to test it.

Also the new start menu is a pain in the ass as the quick launch area is just an alphabetic list of applications and/or documents with no ability to group them in any other way. In Windows 10 you can group related applications together and have quick access to "secondary" applications that you might want to use. (I pin "primary" applications to the taskbar and pretty much always have them running anyway). To get to all applications there's another click where as in Windows 10 you just start scrolling as they're just there (maybe that's an option I enabled but it works well).

Those are the two general gripes I have with the new taskbar and start menu in Windows 11. Maybe I'm used to my setup in Windows 10 but I didn't see anything wrong with the way things were from a design perspective. So the change seems kind of arbitrary just to make it look more like OSX rather than from any functional perspective.

One point that I think more technical folks should consider is if we are actively harming our desires to have a functional UI design by disabling telemetry. As that tells the people at Microsoft what features people actually use, and if they only get telemetry from non-power users then they're going to prioritise for them and remove "unused" features that us technical folks use all the time.

Re: A jump into the middle of an instruction from nowhere (2023)

#74

Post by rep_lodsb »

adrian_b wrote: post #15

While in this case the jump into the middle of an instruction was not intentional, several decades ago many Microsoft programs for MS-DOS, like their BASIC interpreter, contained frequent intentional jumps into the middle of instructions. This technique had already been used in many Microsoft programs for CP/M, i.e. for Intel 8080 or Zilog Z80 CPUs. There were two reasons for the use of such jumps in the middle of in…

Rather than "jumping into the middle of an instruction" (which to me implies some crazy trickery where both the original instruction and the middle of it do something useful, like the sibling comment about biology), a more straightforward way of looking at it is that the "jumped-into" instruction is actually a single-byte jump which skips over the one or two following bytes - and those shouldn't be considered to be part of the instruction at all.

The opcode will of course perform whatever function it was normally intended for, but it will have been chosen by the programmer to be something that doesn't affect the state of the program in a meaningful way. So it really is just a shorter form of jump, not something beyond the understanding of mere humans - you could always replace it with a regular jump and get the same semantics.

CPUs at the time didn't have branch prediction. The 8086 did prefetch code, but always linearly, and even an unconditional jump would flush that prefetch queue. So having an instruction like "CMP AX,xxxx" (where xxxx=any 16 bit immediate value) would be both shorter and faster than the "proper" jump instruction, while affecting only the flag register.

And on the 8080, there was no short (8 bit relative) jump instruction, so this kind of trick even saved two bytes instead of just one.

Re: A jump into the middle of an instruction from nowhere (2023)

#75

Post by jfultz »

toast0 wrote: post #51
throwawaaarrgh wrote: post #23

Earlier quoted context omitted.

That's a lot of money and time to spend on supporting someone else's bug-riddled software. You can't test literally all software that exists before you release a security patch. Just imagine testing every single solitary Windows application that exists, or has every existed, just to see if one of them crashes due to intentionally doing the wrong thing. What are they supposed to do, fix the 3rd party software? Delay f…

> That's a lot of money and time to spend on supporting someone else's bug-riddled software. You can't test literally all software that exists before you release a security patch. Microsoft has been pushing telemetry for how long? I would think they would have a good idea of what to test so that p99 their software works for their customers. But it depends on the severity of the security issue fixed. If it's a big dea…

This can come up even with application software (which is my area). If it worked before and it's broken now, or if your application appears to be the only thing that is broken for the user, from most user perspectives, it doesn't matter that the problem may have been technically created by an OS bug, errant virus scanner, or whatever. As I tell colleagues, "It may not be our fault, but it's still our problem."

Re: A jump into the middle of an instruction from nowhere (2023)

#76

Post by mst »

layer8 wrote: post #68
saurik wrote: post #5

Frankly, it is really annoying when developers working at one of the large closed-source platform oligopolists blame their users for trying to work around the deficiencies (or even outright hostile "business model" optimizations) in their software by whatever scant means are left to them: maybe if Microsoft didn't keep removing good functionality and stopped forcing bad "features" on everyone, fewer people would see…

The “correct” way to do this would be to check that the surroundings of the code you’re injecting into are as expected, similar to how applying a diff patch file contains lines before/after to synchronize with the text being patched. When confronted with an incompatible change, the extension would just disable itself and not proceed with the patching. I’ve heard of MS Office extensions that function like that and wor…

One of the comments on the post mentions an Explorer extension that makes the effort as well.

IMO if you're doing something that far into "don a rubber glove and root around inside somebody else's rectum" territory then the responsibility rests with the author of the crazy, not the authors of the program being fettled.

(and I'd note that I have written code that was very definitely in that territory, held myself to that standard, and having planned to do so from the start didn't find it overly onerous ... I do have a certain sympathy for people who didn't, though)

Re: A jump into the middle of an instruction from nowhere (2023)

#77

Post by joeyo »

sandworm101 wrote: post #67
Ciantic wrote: post #6

I know it must be frustrating from Microsoft's standpoint, but those are needed because they keep changing things. Start All Back is one very popular explorer.exe patch that makes the Windows 11 taskbar function a lot like Windows 10. For one thing, it allows you to move the taskbar again. I've also made an explorer.exe in-memory patch to disable flashing taskbar buttons in Windows 10, it injected itself to WndProc a…

Wallpapers can be animated? This is like learning my car can count butterflies. I wonder why such a feature exists but also now feel obligated to hook VLC into the wallpaper function so i can play movies underneath all my other work. Can wallpapers have sound?

See also: https://www.geisswerks.com/drempels/

Re: A jump into the middle of an instruction from nowhere (2023)

#79

Post by mst »

One of the comments says:

> There’s at least one such utility out there that properly enough validates if their patches would work, or blocklist specific Windows builds known to break from it completely. I wish the other very-obvious-from-your-article software would do so too.

and I can't help but agree.

If you're going to reach into the guts of another process and start flipping bits, it's only Correct to take responsibility for doing so carefully enough you don't blow the entire thing up.

(I have written code that replaced/wrapped other people's function pointers for various reasons (occasionally even -good- ones) and considered any problem caused by an upgrade of the code hosting my cuckoo chick to be my bug - and while it was occasionally bloody annoying, I did this to myself ;)

Re: A jump into the middle of an instruction from nowhere (2023)

#80

Post by EdSharkey »

So these patchers are monkey patching a system executable needed to have a bootable/usable system?

Why is this allowed? This sounds like a small hell.

I left Windows the moment we shifted from "developers, developers, developers, developers" to "advertisers, advertisers, advertisers, advertisers" and never looked back.

Ubuntu is very pleasant to work with, nowadays.

Post reply on HN