Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I ruined my vacation by reverse engineering WSC

blog.es3n1n.eu

Post reply on HN
Print view View original

81–90 of 196 posts

Re: I ruined my vacation by reverse engineering WSC

#81

Post by da_chicken »

keepamovin wrote: post #5
nyanpasu64 wrote: post #4

The most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.

It's weird that windows wouldn't have a signed manifest that would detect that

It does have that. Windows uses code signing and either DISM or SFC to do that.

But this isn't about the binaries. It's where definitions and configuration are stored. It's C:\ProgramData, not C:\Program Files.

The system also can't object too severely. Third party endpoint protection exists.

Re: I ruined my vacation by reverse engineering WSC

#82

Post by animuchan »

OsrsNeedsf2P wrote: post #60
71bw wrote: post #59

Earlier quoted context omitted.

And yet I have none of these issues on 11 LTSC 24H2? Sounds like you forgot to disable Tamper Protection

As someone who moved to Linux 10 years ago, this comment chain shows Windows became the real hacker distro

In a sense, it has been for a long time.

With Linux, there's often a good clean way to do a thing, and then there are weird hacks.

On Windows, it often starts with weird hacks, as Microsoft is further enclosing its ecosystem.

(I use Windows mostly for gaming and VR, and still have to constantly fiddle with the system to keep it working on a basic level, sad face emoji. Who would've thunk that merely playing a 8K European documentary in VR would require configuring DirectShow filters found on GitHub.)

Re: I ruined my vacation by reverse engineering WSC

#84

Post by SecretDreams »

AStonesThrow wrote: post #71
xyst wrote: post #68

Earlier quoted context omitted.

It’s my hardware. I’ll do what I want with it, m8. Simple as that.

Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…

I got measles just reading this

Re: I ruined my vacation by reverse engineering WSC

#86

Post by aa-jv »

chii wrote: post #22
raptorfactor wrote: post #15

This is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...

can someone well versed in explaining CPP magic explain what is going on and why it is cursed?

This is a class which implements a 'defer' mechanism, similar to Go and Javascript constructs, which do the same thing - delay execution of the given block until the current block scope is exited. Its pretty clever, actually, and quite useful.

I personally don't find it that cursed, but for many old C++ heads this may be an overwhelming smell - adding a class to implement what should be a language feature may tweak some folks' ideology a bit too far.

Re: I ruined my vacation by reverse engineering WSC

#87

Post by hoseja »

fransje26 wrote: post #48
devrandoom wrote: post #14

Earlier quoted context omitted.

Performance reasons? Malware development? Hacking?

Is there a more performant, less resource-crippling, antivirus for Windows?

It's called no antivirus. It's what this is supposed to do. Antiviruses are useless malware.

Re: I ruined my vacation by reverse engineering WSC

#88

Post by VMtest »

AStonesThrow wrote: post #71
xyst wrote: post #68

Earlier quoted context omitted.

It’s my hardware. I’ll do what I want with it, m8. Simple as that.

Well this is a straightforward sentiment with a real "my body, my choice" ring to it, isn't it? Until it isn't. Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of oth…

I guess I have to start audit all devices that connect to my home internet...oh wait

Re: I ruined my vacation by reverse engineering WSC

#89

Post by eru »

TeMPOraL wrote: post #80
eru wrote: post #40

Earlier quoted context omitted.

That seems like pretty sketchy reasoning. Like leaving your door unlocked, because you live in such a sketchy neighbourhood that everyone else always locks their doors.

It would make sense if the cost/danger for the thieves to check every door would be prohibitive. Unfortunately, with networked computers, checking the doors is usually both riskless and effectively free.

And turning off your old door checker, just because someone fixed the vulnerability in the latest version, is probably more hassle than it's worth.

Re: I ruined my vacation by reverse engineering WSC

#90

Post by hoseja »

bob1029 wrote: post #63
fransje26 wrote: post #48

Earlier quoted context omitted.

Is there a more performant, less resource-crippling, antivirus for Windows?

A skilled user. I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system. There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don'…

The worst is when they silently re-enable the AV with a mandatory update later.
Post reply on HN