Hacker News Reader

not_a9on Entering and Breaking the Avast Antivirus Sandbox Part 2

Technically most malware should generally be able to rely on the syscall interface, no? As generally it doesn’t need a GUI or anything

not_a9on Rust is tier-1 language at Microsoft

Visual Studio does have a really nice C++ debugger - one would imagine the C++ debugging capabilities should translate to Rust.

not_a9on HelloAssembly: The smallest possible complete Windows application (2021)

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg ZwMapViewOfSection

       2072  80F 001612B0 ZwMapViewOfSection

       2073  810 00163160 ZwMapViewOfSectionEx

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg NtMapViewOfSection

        425  1A0 001612B0 NtMapViewOfSection

        426  1A1 00163160 NtMapViewOfSectionEx

> How "differently" exactly? That's undocumented.

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

not_a9on How accurate have Ed Zitron's AI skeptic predictions been?

Given the cost of openweight frontier models like Kimi I’m fairly sure the token prices actually make some money.

not_a9on HelloAssembly: The smallest possible complete Windows application (2021)

> This has nothing to do with ntdll at all.

I can only wonder where `NtMapViewOfSection` could be exported from...

not_a9on Asahi Linux Progress Report: Linux 7.2

I wonder how they handle merging upstream clanked stuff.

not_a9on How much of HN is AI?

I guess Hex-Rays and Vector35 must be hallucinating their effects for, say, reverse engineering. OFC rev isn't be all and end all of computing but the effect LLMs had on security research and adjacent spaces (say, CTF) is interesting

https://github.com/HexRaysSA/ida-nexus

https://sidekick.binary.ninja/

not_a9on HelloAssembly: The smallest possible complete Windows application (2021)

In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/d....

> If the call to this function occurs in user mode, you should use the name "NtMapViewOfSection" instead of "ZwMapViewOfSection".

not_a9on Claudette: Make Claude stop talking like a BuzzFeed article

https://x.com/_can1357/status/2090360068529111530

Should be pretty difficult to ignore

not_a9on How do functions like alloca allocate memory from the stack?

The significantly increased capabilities of cheats if you can read/write memory and the dogshit that AI-oriented anticheat approaches continue producing (look at VACnet, though I am sure there are other companies producing better things like Anybrain - the thing is, 99% of the time the products of said companies are integrated along with a proper strong anticheat like EAC) will ensure kernel mode anticheats will be alive and well.

not_a9on How do functions like alloca allocate memory from the stack?

While I’m not sure if this is a bot (where did vidya enter the convo?), game hacking on both cheat and anticheat side has genuinely deep Windows internals knowledge (admittedly somewhat lopsided, but deep nonetheless)

not_a9on AI Is Solving CTF Challenges in Minutes

OK, but is that fun for people who don’t wanna clankermaxx? In addition this does not address the paytowin aspect of clankermaxxed CTFs

not_a9on AI Is Solving CTF Challenges in Minutes

The talk about DEFCON CTF this year on Twitter seems to imply having LLMs allowed in CTF (or, at least, allowing autoslopping without significant restrictions) kinda kills the game. There’s a ton of sentiment about CTF being effectively dead.

Outside of DEFCON I think this is an interesting article: https://osec.io/blog/save-ctfs-fund/

not_a9on AI Is Solving CTF Challenges in Minutes

Safeguards don’t really trigger for CTF stuff. I’m sure most people are on the subscription plans instead of suffering through API pricing

not_a9on Learning more about Claude's mathematical capabilities

To the best of my knowledge: doesn’t the current build of Claude Code use the Rust port of Bun?

not_a9on Datalog Disassembly

Generally binary rewriters will add a new section for the rewritten code/other stuff that needs regeneration (relocations, exception info, the like)

not_a9on Xbox goes down. You can't play games you own on disc

To add to this, the obfuscation used for their anticheat seems to be… kinda bad? Worse than Epic’s virtualizer/Griffin probably

https://k0mkc.hatenablog.com/entry/2026/08/06/032440

Mind you, odds are their anti-tamper/DRM is a different case.

not_a9on Xbox goes down. You can't play games you own on disc

back.engineering folks seem to imply that Denuvo is another case of virtualization based obfuscator being vulnerable to a symbolic execution/optimization approach.

> As AI assisted static deobfuscation continues to improve we will see more virtual machine based obfuscators fold away. In an upcoming article we will publish details on how we fully statically devirtualized Denuvo anti(tamper/cheat). One of the most attacked pieces of software second only to anticheats.

…or you can not bother with analyzing at all and just feed correct CPUID/shared data/whatever values to Denuvo, like the hypervisor thing does.

https://back.engineering/blog/31/07/2026/

not_a9on The Art of 64-bit Assembly

Out of idle curiosity: can NASM emit Windows unwind information? For the matter, can any assembler do so automatically?

not_a9on Valve Sponsors Work Bringing Open-Source RADV Driver to Windows

The service where Counter-Strike actually gets played competitively, FaceIT, does not work on Linux.

not_a9on User Interfaces of the Demo Scene

Kinda offtopic, but I was somewhat surprised by Assembly having an “exclusive AI partner” this year.

not_a9on Cracking Windows Open: Porting RADV to Win32

Throw a lawn dart at the contents of https://vx-underground.org/Archive/Driver%20Collection/Bulk%... all drivers download, load the resulting driver and try to get into Fortnite or something. It'll probably get in fine assuming driver isn't Unknowncheats superstar already

not_a9on Cracking Windows Open: Porting RADV to Win32

Sandboxie/WinFSP/KVM guest drivers for Windows are open source too

I’m sure there are more open source examples. A newer one is https://github.com/namazso/PawnIO/tree/master I guess?

not_a9on Cracking Windows Open: Porting RADV to Win32

If anti-cheats actively whitelisted drivers playing competitive video games would be impossible for people using any rarer HW/utilities. Vulnerable drivers are generally blacklisted when found.

Getting your driver signed seems like a pain these days, yeah

not_a9on Claude Opus 5

Reversing for the most part, though lately I’ve been doing some code obfuscation/binary rewriting stuff. Fable will switch to Opus instantly on these and I’m unsure how this will perform. I suppose the only way to find out is to test.

not_a9on Claude Opus 5

5.6-Sol is a lot more permissive than Opus/Fable even w/ CVP (once you sign your soul away to Palantir via Persona, anyway), while maintaining better capabilities

not_a9on Claude Opus 5

> Opus 5’s safeguards match those of Claude Fable 5’s, with one change: it now permits source-code vulnerability discovery at all access levels. This means that the model can support defensive cybersecurity work while still blocking vulnerability discovery in compiled binaries, which is more commonly used offensively.

Okay so it’s worse than Opus 4.8 for my purposes I guess?

not_a9on Roblox Officially Supports GrapheneOS

Are the other Zero IT Lab products like their code virtualizer of similar quality to Theia? My only exposure has been that one RE//verse presentation and shitposts on UC.

not_a9on Roblox Officially Supports GrapheneOS

While the page decryption trick should work in Wine just fine (ZeroIT Lab Theia does that too, right?), I don’t remember if Wine provides workingset info like Windows.

not_a9on Roblox Officially Supports GrapheneOS

EAC is a kernel mode anti-cheat on Windows, though?

And given the whining on UC it seems to be fairly effective.