32 ms·
I ruined my vacation by reverse engineering WSC
- AtomicByte 2y agono idea there was so much going on behind the scenes of defendnot (I feel like someone sent it to me earlier; thought it was super cool)
- qbane 2y agoFYI, WSC stands for Windows Security Center.
- Washuu 2y agoThank you for the help. It is really frustrating when authors do not define an acronym when it is first introduced in the text.
- unmole 2y agoBut they do: > The part of the system that manages all this mess is called Windows Security Center - WSC for short.
- Washuu 2y agoIt needs to be closer to where the acronym is first introduced. The definition, on my screen, is below the fold so it can not be seen in context of where the acronym is first introduced. If it was defined below the title, I would understand. * https://apastyle.apa.org/style-grammar-guidelines/abbreviations/definition https://apastyle.apa.org/style-grammar-guidelines/abbreviati... * https://www.stylemanual.gov.au/grammar-punctuation-and-conventions/shortened-words-and-phrases/acronyms-and-initialisms#explain_acronyms_and_initialisms_to_all_users https://www.stylemanual.gov.au/grammar-punctuation-and-conve... * https://learn.microsoft.com/en-us/style-guide/acronyms https://learn.microsoft.com/en-us/style-guide/acronyms I do a lot of copy editing for clarity and non-native speakers so I have keep these things in mind. ¯\_(ツ)_/¯
- es3n1n 2y agoThis is a somewhat useful feedback, however I am not too sure how this can be fixed given the structure of my blog post. Do you think if I just add a line `*WSC is short for Windows Security Center` in the first paragraph this will be enough?
- magicalhippo 2y agoMy suggestion: In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly.
- es3n1n 2y agothank you! i changed the first paragraph to include these changes
- cheschire 2y agoAh that makes sense. I saw this subthread and was quite confused because WSC was clearly and obviously defined in the first sentence. Now I see why. Thanks for incorporating the feedback! It had a positive impact for me coming later to this article.
- Washuu 2y agoAppreciated, thank you!~ \(￣︶￣*\))
- alias_neo 2y agoThe typical solution, is to include the expansion in brackets after the first use. Simple rule I learned on my Electronic Engineering degree (where we're guilty of many, many acronyms): When you write an acronym/initialism in a paper (or anywhere for others to read reall), assume the reader doesn't know what it stands for and include the expansion in brackets immediately after the first use. EDIT: As my sibling comment also suggests, writing it in full the first time, and using the acronym/initialism in brackets is also acceptable.
- rschiavone 2y agoThey do. They understandably shorten it in the title, but then they define the acronym the first time they use it in the article.
- n4r9 2y agoAt least that one is defined later on. I'm still scratching my head over "CTF". [Edit - could be Capture The Flag?]
- tempaway43563 2y agoYou're right, that never gets defined. Yes, Capture The Flag cybersecurity sort of competition I think https://news.ycombinator.com/item?id=43960389 https://news.ycombinator.com/item?id=43960389
- nyanpasu64 2y agoThe most invasive but effective way I've found to disable Defender is to boot into a live Linux USB, rename "C:\ProgramData\Microsoft\Windows Defender", and create an empty file in its place.
- keepamovin 2y agoIt's weird that windows wouldn't have a signed manifest that would detect that
- vachina 2y agoYou can also disable Windows Update entirely by taking ownership of wuaueng.dll and .exe. It’s the only effective method on Windows Home.
- subscribed 2y agoBut disabling updates on the system connected to the Internet is a terrible idea. How do you update that afterwards?
- vachina 2y agoBy reinstating the ownership of those files.
- londons_explore 2y agoSince the rest of the world updates their PC's, malware authors rarely focus on exploiting older versions. Both Chrome and Windows are now in that position. Basically, unless you are of interest to state level attackers, in 2025 even unpatched Chrome/Windows wont get drive by exploited.
- eru 2y agoThat seems like pretty sketchy reasoning. Like leaving your door unlocked, because you live in such a sketchy neighbourhood that everyone else always locks their doors.
- ThrowawayTestr 2y agoIs the point to actually disable defender or to highlight a vulnerability?
- ForOldHack 2y agoThat is one possible point, but om machines with low memory, (like a lab full of 8Gb potatoes) this is a godsend. These lab PCs are so stripped down, that the only thing using most of the memory is WD. You should be able to make a normal mode to run full security and a gaming mode just run a semi large game,and yes, this does expose a vulnerability,but it can be easily brought back up.
- iforgotpassword 2y agoOof, really? Haven't really used windows much after 7, but it always seemed to me defender was pretty lightweight. At least compared to all the other products where just opening the UI would lag out the average machine.
- geocar 2y agoI think the point is to disable defender: Air-gapped machines, kiosks, industrial applications, and so on, have no need to eat gobs of ram and waste loads of cpu checking the same files over and over again. For other applications, WD provides dubious benefits. It is annoying that there isn't a switch that says "I know how to operate a computer". Evildoers don't need to bother with this: If they have access at this point you've got other problems. Microsoft may extend WD to detect/block this vector since it is using undocumented interfaces; Microsoft would absolutely prefer you buy more cores, and if you're not going to do that, collect some additional licensing revenue through some other way.
- eru 2y agoWhy would Microsoft care how much money I spend with my CPU core vendor?
- 2y ago
- ForOldHack 2y agoThis is a godsend. I should send you a jar of KimChee for this. Please return to Seoul, and enjoy the sights. South Korea is one of the most beautiful countries in the world. Try to plan into corrispond to either the cherry blossoms falling in the spring, or the leaves falling in the fall. I miss Seoul.
- s4mbh4 2y agoWhy would you want to disable WSC?
- devrandoom 2y agoPerformance reasons? Malware development? Hacking?
- fransje26 2y agoIs there a more performant, less resource-crippling, antivirus for Windows?
- bob1029 2y agoA skilled user. I understand and mostly support the idea of mandatory AV for the people who can barely handle the concept of a file system. There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Giving users choice is the best option. Certainly, make it very hard to disable the AV. But, don't make me go dig through DMCA'd repos and dark corners of the internet (!) to find a way to properly disable this bullshit.
- hoseja 2y agoThe worst is when they silently re-enable the AV with a mandatory update later.
- chuckadams 2y ago> There is also a class of user forged in the fires of the primordial internet who would never in a trillion years be tricked into clicking a fake explorer.exe window in their browser. Until they've had a couple drinks. Might still need a more sophisticated fake than that, but they exist. I'm with you on the disabling part though: I think Apple gets it right with SIP, it takes a reboot in recovery mode to disable it temporarily and a single command while in recovery mode to make it permanent.
- raptorfactor 2y agoThis is cursed: https://github.com/es3n1n/defendnot/blob/master/defendnot-loader/core/autorun.cpp#L28C1-L30C15 https://github.com/es3n1n/defendnot/blob/master/defendnot-lo... If you're curious what's actually going on there: https://github.com/es3n1n/defendnot/blob/master/cxx-shared/shared/defer.hpp https://github.com/es3n1n/defendnot/blob/master/cxx-shared/s...
- es3n1n 2y agoyeah sorry i didnt feel like implementing my own RAII stuff for all the COM thingies due to time constraints. it will be changed in the next update though
- junon 2y agoHonestly if this isn't part of a public API this isn't very cursed in terms of C++, especially if you have a lot of one-off cleanup operations. I think the only bit I don't like personally is the syntax. I normally implement defer as a macro to keep things clean. If done correctly it can look like a keyword: `defer []{ something(); };`.
- quietbritishjim 2y agoI think the syntax is exactly why they're saying it's cursed. IMO your suggestion is no better - yes it makes defer look like a keyword, but it's not! As I said in a sibling comment, I think it's clearer if you're honest that you're using a macro: DEFER([](){something();}); Or you could even make a non-macro version (but then you need to think of variable names for each defer): auto defer_uninitialise = do_defer([](){CoUninitialize();});
- junon 2y agoSure, I've used __LINE__ for this before too, and yeah I agree that my keyword construction was too clever (seemed cool at the time, since the macro had a dangling = at the end to make it work).
- 2y ago
- rootsudo 2y agoI recently read https://nostarch.com/windows-security-internals https://nostarch.com/windows-security-internals and this makes it much more relatable. I've know a bit about how alot of this back stuff works in Windows, but the timing is great - the last chapter of that book really goes into the same detail this author went about tokens and sids.
- codeulike 2y agoWhat does CTF stand for?
- raybb 2y agoA security competition of sorts https://en.wikipedia.org/wiki/Capture_the_flag_%28cybersecurity%29 https://en.wikipedia.org/wiki/Capture_the_flag_%28cybersecur...
- kristianp 2y agoCool, but why would you need to travel to do that? They mentioned they often travel with 2 laptops for CTF.
- raybb 2y ago> My current main machine for non-ctf things is an M4Pro MacBook, and usually, when I am going for a CTF I bring an another x86 laptop with me to do some extensive reverse engineering/pwn stuff as it is usually built for the x86 cpus. Emulation would kind of work for this task but it is pretty painful so I just use an another laptop for all the x86 stuff. Seems like they don't want to bother with emulation when many of the challenges are not compatible with their main computer.
- CalRobert 2y agohttps://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurity) https://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurit... I believe
- dark-star 2y agoFor those wondering: WSC stands for Windows Security Center. I had to look it up as well
- einsteinx2 2y ago> The part of the system that manages all this mess is called Windows Security Center - WSC for short. It’s in the article
- dark-star 2y agotrue, but you have to read until the 4th paragraph to find it. Putting it in the title would have been better
- einsteinx2 2y agoFair point
- gitroom 2y agoLmao reverse engineering WSC on vacation sounds like some real dedication - honestly can't tell if that's commitment or just a cry for help. Made me think: if tuning all this stuff gives you a headache, would you rather have max security or just peace of mind and a fast machine?
- kunley 2y ago[flagged]
- dinga 2y agoThis is literally Hacker News :)
- xyst 2y agoEvery time I see anime characters in pfp, I know it’s going to be a good write up. Thanks for sharing. Keeping this saved in case I return to a crappy windows env.
- einsteinx2 2y ago> As you might still remember, I was working on an arm64 macbook and there currently is no sane solutions how to emulate x86 windows on arm macbooks. What about UTM? Also Parallels recently added initial support for Intel VMs as well.
- nottorp 2y agoI tried UTM and it's unusable for x86 Windows. Maybe command line Linux would be acceptably slow, but anything with a GUI isn't. You can run arm64 Windows pretty well, but that's not x86 Windows and won't help with reverse engineering an x86 system component.
- einsteinx2 2y agoI hadn’t tried it myself I just knew it could run it, sucks to hear it’s so unusable.
- nottorp 2y agoIt depends on what you need though, because arm windows has its own rosetta-like translation and does run x86 applications. I set up a windows arm inside an UTM VM as a test, then installed visual studio (not code!) which is an x86 application and it was pretty much usable. The codebase i was working on was complaining about missing some OpenGL parts so I stopped and haven't investigated further (I have x86 boxes for working on it). But depending on your requirements the above setup may be just fine(tm).
- belthesar 2y agoThe dynarec systems in QEMU aren't as efficient as the native dynarec systems in Windows and macOS (Rosetta 2). You can definitely run x86 Windows with UTM, and it works, but the performance characteristics are pretty poor. From a utility perspective, I've found that running an ARM Windows VM and using Windows' dynarec system to run x86 apps, or using WINE (both using native compiled subsystem code) is a much better experience. It's one of those things where it's okay if you need to run a workload in a pinch. I'm not sure if performance characteristics are part of what the OP considers "sane", but if it is, I get the position.
- lepicz 2y agolol, i significantly improved my vacation by reverse engineering the virtual desktops on windows :) best memories of last year: reverse engineering is hellovafun! learned a lot of interesting thing, namely there is an undocumented messaging underlying the RPC in windows: https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC.html https://csandker.io/2022/05/24/Offensive-Windows-IPC-3-ALPC....
- rfhiurobg 2y ago[flagged]
- gwbas1c 2y ago> the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request I got really, really confused after that statement, because I don't understand what "the antivirus I was using" means and why they would have a reason to send the author a DMCA. I think it means the author reverse-engineered another antivirus and put parts of it in their open-source project. But it could also mean other things. Skimming I see a heading with "Impersonating WinDefend". So is the jist that the author somehow broke some kind of copyright law?
- dec0dedab0de 2y agoyes, they broke copywright law by copying part of an existing AV program. From the paragraph directly before the one you quoted: The way how my project worked is that it was using a thirdparty code from some already existing antivirus and forced that av to register the antivirus in WSC.
- mmastrac 2y agoMy understanding is he used the carcass of another AV tool to bypass signature requirements which is understandably grey (there's an argument for it being transformative, IMO but IANAL).
- feldrim 2y agoWhat's worse for me is that the Check Point Harmony does notnutilize the interfaces of Defender crafted for this purpose, but write a knowledge base article to tell the users to disable the Defender themselves.
- gazarubbleparty 2y ago[flagged]