Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

71–80 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#71

Post by AStonesThrow »

xyst wrote: post #68
s4mbh4 wrote: post #11

Why would you want to disable WSC?

It’s my hardware. I’ll do what I want with it, m8. Simple as that.

Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't.

Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of others' systems? What if your system became a host for CSAM or copyright-violating materials, unbeknownst to you, until the authorities confiscated it?

And what if your hardware had a special privileged location on a corporate network, or you operated a VPC with some valuable assets, and that was compromised and commandeered by a state-level threat actor? Is it still "your hardware, your choice"? Or do your bad choices affect other people as well?

Re: I ruined my vacation by reverse engineering WSC

#72

Post by quietbritishjim »

Sebb767 wrote: post #61
quietbritishjim wrote: post #41

Earlier quoted context omitted.

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

> * Defer has an overloaded operator%. It's a template function, which takes a callable object (type is the template parameter Callable) and returns a DeferHolder instance. Is there any reason to use operator% instead of a normal method call? Except possibly looking cool, which doesn't seem useful given that the call is hidden away in a macro anyway.

If you used a normal method call then there would need to be a corresponding close bracket at the end of the overall line of code, after the end of the lambda function. But the macro ("defer") only occurs at the start of the line, so it has no way to supply that close bracket. So the caller of the macro would have to supply it themselves. As I mentioned near the end of my comment, it seems like the defer macro is specifically engineered to avoid the caller needing a close bracket.

If you don't mind that, I said that you can "simplify the implementation" - what I meant was, as you say, you don't need the overloaded Defer::operator% (or indeed the Defer class at all). Instead you could do:

   template 
   DeferHolder _get_defer_holder(Callable&& cb) {
       return DeferHolder{std::forward(cb)};
   }
   #define DEFER(my_lambda) auto COMMON_CAT(_defer_instance_, __LINE__) = _get_defer_holder(my_lambda)
Disclaimer: I haven't tried it and I don't normally write macros so this could have glaring issues.

Re: I ruined my vacation by reverse engineering WSC

#73

Post by quietbritishjim »

junon wrote: post #23
es3n1n wrote: post #17

Earlier quoted context omitted.

yeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though

Honestly if this isn't part of a public API this isn't very cursed in terms of C++, especially if you have a lot of one-off cleanup operations. I think the only bit I don't like personally is the syntax. I normally implement defer as a macro to keep things clean. If done correctly it can look like a keyword: `defer []{ something(); };`.

I think the syntax is exactly why they're saying it's cursed. IMO your suggestion is no better - yes it makes defer look like a keyword, but it's not! As I said in a sibling comment, I think it's clearer if you're honest that you're using a macro: DEFER([](){something();});

Or you could even make a non-macro version (but then you need to think of variable names for each defer):

   auto defer_uninitialise = do_defer([](){CoUninitialize();});

Re: I ruined my vacation by reverse engineering WSC

#74

Post by tempaway43563 »

n4r9 wrote: post #50
Washuu wrote: post #25

Earlier quoted context omitted.

Thank you for the help. It is really frustrating when authors do not define an acronym when it is first introduced in the text.

At least that one is defined later on. I'm still scratching my head over "CTF". [Edit - could be Capture The Flag?]

You're right, that never gets defined. Yes, Capture The Flag cybersecurity sort of competition I think

https://news.ycombinator.com/item?id=43960389

Re: I ruined my vacation by reverse engineering WSC

#75

Post by lawgimenez »

es3n1n wrote: post #45
Washuu wrote: post #38

Earlier quoted context omitted.

It needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guid…

This is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?

Just wondering is this Slack? Just wondering what kind of logging flow you’re using.

https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/pics/p...

Re: I ruined my vacation by reverse engineering WSC

#76

Post by mr_toad »

stuffoverflow wrote: post #53
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way. I installed Windows 10 2016 ltsc on a VM at the end of last year out of curiosity to test that. Disabled wupdate and defender before letting it access the internet so that it was basically 8 years behind on any updates. I tried browsing all kinds of sketchy…

> I have yet to see concrete evidence that disabling Windows update and windows defender would elevate risk of having the system compromised in any meaningful way.

It’s much less likely than it was 20 years ago. A lot of attack vectors have already been fixed. But hypothetically a bug in the network stack could still leave an internet connected machine vulnerable.

Re: I ruined my vacation by reverse engineering WSC

#77

Post by shakna »

londons_explore wrote: post #36
subscribed wrote: post #29

Earlier quoted context omitted.

But disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

There are still active attacks against DOS and Win98. Automated driveby attacks, just looking to increase the size of a bot farm. There are still new exploits being released against rather old systems.

Re: I ruined my vacation by reverse engineering WSC

#78

Post by jeffbee »

quietbritishjim wrote: post #41
chii wrote: post #22

Earlier quoted context omitted.

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

A way to do the same thing that is less gross: https://github.com/abseil/abseil-cpp/blob/master/absl/cleanu...

Re: I ruined my vacation by reverse engineering WSC

#79

Post by [deleted] »

Sebb767 wrote: post #61
quietbritishjim wrote: post #41

Earlier quoted context omitted.

We're starting with this code: defer->void { CoUninitialize(); }; Using the macros in the second linked file, this expands to: auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); }; * The 1234 is whatever the line number is, which makes the variable name unique. * auto means infer the type of this local variable from the expression after the =. * Defer{} means default construct a Defer instance. Def…

> * Defer has an overloaded operator%. It's a template function, which takes a callable object (type is the template parameter Callable) and returns a DeferHolder instance. Is there any reason to use operator% instead of a normal method call? Except possibly looking cool, which doesn't seem useful given that the call is hidden away in a macro anyway.

[deleted]

Re: I ruined my vacation by reverse engineering WSC

#80

Post by TeMPOraL »

eru wrote: post #40
londons_explore wrote: post #36

Earlier quoted context omitted.

Since the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.

That seems like pretty sketchy reasoning. Like leaving your door unlocked, because you live in such a sketchy neighbourhood that everyone else always locks their doors.

It would make sense if the cost/danger for the thieves to check every door would be prohibitive. Unfortunately, with networked computers, checking the doors is usually both riskless and effectively free.
Post reply on HN