Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

αcτµαlly pδrταblε εxεcµταblε

justine.storage.googleapis.com

Post reply on HN
Print view View original

81–90 of 309 posts

Re: αcτµαlly pδrταblε εxεcµταblε

#81

Post by badsectoracula »

ChrisSD wrote: post #59
mrpippy wrote: post #54

Earlier quoted context omitted.

Yes, but the stable interface is functions exported from kernel32, ntdll, etc. Syscall numbers can and do change freely between builds.

Indeed. The Win32 API (and UWP et al) is the only one that's officially stable. Kernel syscalls themselves are entirely unstable. Not even just the numbers but the calling convention and everything else. Microsoft reserves the right to add, remove or modify anything in or exposed by the NT kernel. Of course they won't do so frivolously but syscall numbers are especially prone to change with a new build of the kernel.…

> and UWP et al

That remains to be seen in ~10 years at least :-P

Re: αcτµαlly pδrταblε εxεcµταblε

#82

Post by [deleted] »

ben_w wrote: post #76
axegon_ wrote: post #74

People... Please stop using foreign alphabets like that! It's a nightmare for those of us who know the alphabets. It took me a good 20 seconds to read the title. And it's magnitudes worse when someone uses cyrillic for instance and it's native to me.

Agreed. It’s not even a particularly good example of the style, given υ could have been used instead of μ, ο instead of δ.

[deleted]

Re: αcτµαlly pδrταblε εxεcµταblε

#83

Post by FeepingCreature »

mrpippy wrote: post #54
FeepingCreature wrote: post #49

Earlier quoted context omitted.

Isn't Windows also known for being committed to both API and ABI stability?

Yes, but the stable interface is functions exported from kernel32, ntdll, etc. Syscall numbers can and do change freely between builds.

Might this change now that things like game copy protections are implementing syscalls manually?

Re: αcτµαlly pδrταblε εxεcµταblε

#84

Post by renewiltord »

ocdtrekkie wrote: post #14

Is hosting web URLs at storage.googleapis.com a thing? After finding a persistent phishing campaign using it, I ended up restricting it from being loaded in the web browser in my environment. (Embedded images from it, like on blog.google, still work.) This is the first time I've seen a legitimate website with one of these URLs.

To get https don't you have to put a paid load balancer in front of it? At that point it's both more effort and costly than Netlify.

Re: αcτµαlly pδrταblε εxεcµταblε

#85

Post by nurettin »

axegon_ wrote: post #74

People... Please stop using foreign alphabets like that! It's a nightmare for those of us who know the alphabets. It took me a good 20 seconds to read the title. And it's magnitudes worse when someone uses cyrillic for instance and it's native to me.

Foreign alphabet transliteration drama thread under the best hacking-grade article in years. Thanks, hn.

Re: αcτµαlly pδrταblε εxεcµταblε

#86

Post by user5994461 »

ChrisSD wrote: post #59
mrpippy wrote: post #54

Earlier quoted context omitted.

Yes, but the stable interface is functions exported from kernel32, ntdll, etc. Syscall numbers can and do change freely between builds.

Indeed. The Win32 API (and UWP et al) is the only one that's officially stable. Kernel syscalls themselves are entirely unstable. Not even just the numbers but the calling convention and everything else. Microsoft reserves the right to add, remove or modify anything in or exposed by the NT kernel. Of course they won't do so frivolously but syscall numbers are especially prone to change with a new build of the kernel.…

I might not be following here. Windows kernel functions are those in ntdll.dll. They've been stable for a very long time as far as I am aware. Well, the 30% of them that are documented at least. It's used by drivers, antivirus and rootkits.

C headers with the prototypes are available from the Windows Driver Development Kit. It's not something you want to use though, the average kernel function takes 10 arguments to support both sync and async IO.

https://docs.microsoft.com/en-us/windows/win32/api/winternl/...

Re: αcτµαlly pδrταblε εxεcµταblε

#87

Post by maartenh »

GuB-42 wrote: post #80
userbinator wrote: post #38

Earlier quoted context omitted.

but it only used x86 instructions that were also ASCII characters That was a somewhat common approach back then. It's hard to find references to that technique now, but here's something I did find: https://news.ycombinator.com/item?id=16312562

Another common one is the EICAR anti-virus test file. X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* It is a com executable that prints EICAR-STANDARD-ANTIVIRUS-TEST-FILE! It recognized by most virus scanners.

Oh, cool! I thought this file was just prefixed with some random garbage.

Unrelated: I used this to verify that my daily scheduled full scan of my Linux laptop works. This is required by compliance at $WORK. It reports found viruses via the i3-nagbar.

Re: αcτµαlly pδrταblε εxεcµταblε

#88

Post by ChrisSD »

FeepingCreature wrote: post #83
mrpippy wrote: post #54

Earlier quoted context omitted.

Yes, but the stable interface is functions exported from kernel32, ntdll, etc. Syscall numbers can and do change freely between builds.

Might this change now that things like game copy protections are implementing syscalls manually?

Doubtful. There have long been software that abuses syscalls and other kernel level features to implement Sony rootkits and other DRM. Ironically those that implement game copy protection would be annoyed if syscalls were stabilized because the whole reason they use unstable syscalls is to obfuscate what they're doing and make the program extremely sensitive to tampering.

Re: αcτµαlly pδrταblε εxεcµταblε

#89

Post by boudin »

axegon_ wrote: post #74

People... Please stop using foreign alphabets like that! It's a nightmare for those of us who know the alphabets. It took me a good 20 seconds to read the title. And it's magnitudes worse when someone uses cyrillic for instance and it's native to me.

It's not great for accessibility neither.

Re: αcτµαlly pδrταblε εxεcµταblε

#90

Post by ChrisSD »

user5994461 wrote: post #86
ChrisSD wrote: post #59

Earlier quoted context omitted.

Indeed. The Win32 API (and UWP et al) is the only one that's officially stable. Kernel syscalls themselves are entirely unstable. Not even just the numbers but the calling convention and everything else. Microsoft reserves the right to add, remove or modify anything in or exposed by the NT kernel. Of course they won't do so frivolously but syscall numbers are especially prone to change with a new build of the kernel.…

I might not be following here. Windows kernel functions are those in ntdll.dll. They've been stable for a very long time as far as I am aware. Well, the 30% of them that are documented at least. It's used by drivers, antivirus and rootkits. C headers with the prototypes are available from the Windows Driver Development Kit. It's not something you want to use though, the average kernel function takes 10 arguments to s…

ntdll is a userspace library, not a part of the kernel. So when you call ntdll functions you aren't calling into the kernel (although most ntdll functions will do so on your behalf).

And ntdll itself is technically unstable[0], though I'll grant you that there are many functions that are unlikely to break. There's no guarantee though.

[0]: https://docs.microsoft.com/en-us/windows/win32/devnotes/call...

Post reply on HN