topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Sunday December 21, 2025, 3:21 pm
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Recent Posts

Pages: prev1 ... 143 144 145 146 147 [148] 149 150 151 152 153 ... 364next
3676
I heard about that one a couple of weeks ago, but haven't seen the sign until now. Pretty hilarious :)

Seems a bit silly though, wouldn't one have written the autoreply in both English and Welsh? And since there's bi-lingual regulations, don't you suppose that somebody, somewhere would be able to read Welsh before the sign was printed? :P
3677
Living Room / Re: What is Twitter: A Funny Sarcastic Cartoon
« Last post by f0dder on March 24, 2009, 07:32 AM »
Yeah, you found it :)
* f0dder is interested in the fail-whale thing as well.
3678
Living Room / Re: What is Twitter: A Funny Sarcastic Cartoon
« Last post by f0dder on March 24, 2009, 07:06 AM »
hmm, still can't watch it. why on earth have they blocked it for certain regions. i'm sure i can handle the horrible truth - it won't send me over the edge, i promise.
I can - sort of - understand why some music videos and such are blocked in individual countries (even though I don not agree with the idea). But blocking a thing like this? Bigtime weird :-s
3679
Living Room / Re: BIOS Level malware attack
« Last post by f0dder on March 23, 2009, 06:22 PM »
40hz: you don't need the user to do anything - it's not like the idea is to create an infected image and have the user flash that to his BIOS.

Instead, you use whatever traditional infection vector that gives you admin/root privileges. From there, you a drive (Windows) or LKM (Linux) to go kernel-mode/ring0, from where you have full access and can re-flash the BIOS.

The flashing process is going to be chipset-specific, but how much I don't know - I would assume that there's a couple of standard flash controllers, so you don't have to support a lot of different ones. Whether the type of controller can be auto-detected I don't know either. This is one part of the challenge.

The second part of the challenge is finding a "bios cave" to hide your malware in. This is probably easier than it sounds, though - scan the BIOS space for an appropriately large block of zeroes. From what I remember about BIOS initialization sequences, BIOSes will at boottime scan their memory image at <some kilobytes> boundaries looking for a magic identifier. When such a magic identifier is found, and a checksum after the chunk matches, an entry-point in the chunk is called; this is used for BIOS extensions, and you can think of this type of malware as, well, a BIOS extension. The tricky part here is exploiting the system in a way that doesn't interfere with chipset setup and such, but it's probably doable doing this relatively generically.

AFAIK there hasn't been any malware/rootkits doing this before, the closest was the CIH virus which would simply erase your BIOS... which is of course bad enough. Many BIOSes these days have "flash protection", but I'm not sure how well that works - does it disable the flash controller, and can it be re-enabled by software without a reset cycle? (certain CPU features like hypervisor support can be disabled, and once disabled requires a reset cycle to be re-enabled... should be possible to use the same design for flash controllers, but is it done that way?)
3680
Living Room / BIOS Level malware attack
« Last post by f0dder on March 23, 2009, 04:05 PM »
Uh... oh...

Via slashdot:
shot-2009-03-23@22.02.38.png

I guess the attack would have to be BIOS-specific (for finding a spot to put the malware) and slightly chipset-specific (for flashing the code to BIOS flashrom), but it's nasty nevertheless... combine this with SMM exploit and a hypervisor, and you're unremovable (except of course on motherboards where the flashrom chip can be removed from the motherboard - most seem to be directly soldered on, though).

Undetectable is still hard, even with a hypervisor, and I doubt it can be fully done. But you can go very stealthy.
3681
Living Room / Re: What is Twitter: A Funny Sarcastic Cartoon
« Last post by f0dder on March 22, 2009, 10:39 PM »
So, umm... is twitter basically just facebook status messages on amphetamine and with even less content?
3682
Post New Requests Here / Re: IDEA: Auto Set Low Priority Program for XP, etc...
« Last post by f0dder on March 22, 2009, 09:42 PM »
I haven't used Process Tamer in a while, but I'm pretty sure you could accomplish this with it. Process Tamer has an option for making itself and Task Manager high priority.

Then just adjust the options so that anything above 1% or something will lower the process. Something like that ought to do it for you.
Kinda silly though, as it doesn't help performance - and could in fact hurt performance. Consider a well-written application that does number crunching, and has set it's crunching-thread to BELOWNORMAL priority. By setting all process/thread priorities to BELOWNORMAL, all applications will be battling at the same priority level, rather than running normally and giving the heavy number-crunching thread less attention. This could result in GUIs performing sluggishly etc.

It's best keeping normal threads at normal priority, and only assigning lower priority to those ill-behaving processes that gobble up CPU and don't lower their own priorities.
3683
Post New Requests Here / Re: IDEA: Auto Set Low Priority Program for XP, etc...
« Last post by f0dder on March 22, 2009, 09:29 PM »
it keeps reources LOW and since all would equal being low priority = Faster Computer - Works great with PTamer - except I am getting tired of doing it manually...
If a program isn't using much CPU, changing it's priority is pretty meaningless - if a program sits idle in the background or is waiting for user I/O, it's not considered for scheduling, and thus doesn't fight other processes for the CPU. It really is only useful to adjust priority for CPU-gobbling applications :)
3684
Post New Requests Here / Re: IDEA: Auto Set Low Priority Program for XP, etc...
« Last post by f0dder on March 22, 2009, 09:06 PM »
Why bother with setting non-CPU-gobbling process priorities?
3685
Living Room / Re: dvd burner crisis
« Last post by f0dder on March 22, 2009, 07:54 PM »
Yeah, at that price it's definitely not a bad idea :)

plextools is overrated, though. It's supposed to do flawless rips even in burst mode, but it doesn't...
3686
C++, <algorithm>, std::next_permutation ? :)
3687
General Software Discussion / Re: Best password manager?
« Last post by f0dder on March 22, 2009, 06:46 PM »
Am I the only person in the world that has a real problem  :'( with storing a password list online, no matter who with? I don't even allow my e-mail client or browser to remember them.
I'm with you. I'd never trust my passwords to an online entity (well, storing an encrypted document that I have complete control of would work).
3688
Living Room / Re: Tech News Weekly: Edition 12-09
« Last post by f0dder on March 22, 2009, 05:29 AM »
#3 is interesting - theoretically, being able to run your code in SMM means you have 100% control over the machine; one of the interesting features of SMM is that you can trap port I/O... so, basically, if you could inject malware into the flash BIOS and use this SMM hack, you could trap the port I/O necessary to reflash the BIOS, and thus make the malware resilient to removal. This would be coupled with a custom hypervisor to avoid detection, and *b00m* - game over.

In practice, though, there's so much machine-specific stuff needed that this won't be a general threat. And it's not exactly a simple task being undetectable, even when you have a hypervisor... there's so many possible detection vectors.
3689
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 22, 2009, 03:17 AM »
Ram being occupied without use is a waste also.

Which is the point of all this about CleanMem, I believe.
A lot of people don't understand what goes into Windows (and other modern OS) memory management, though - all they see is a "free memory" figure, which they then obsess over. To be fair, it is a rather advanced subject, and the standard Windows task manager doesn't help the situation (calling commit-charge "PF usage" on XP, leading people to think they always have a lot of stuff paged out to disk, for instance).

Thing is, blindly trimming working sets just isn't a good idea. It doesn't really free up memory - it can discard 'clean' memory pages (basically limited to executable code from .exe and .dll files, which will have to be re-read from disk next time it's needed), and it can pageout 'dirty' memory pages to the pagefile (meaning costly write operation, and re-read from pagefile when needed again). When you trim a process, you will often see it's working set go low, only to shoot back up again after a few seconds.

So it doesn't look like you are in a position to talk of 'bull' -- since Shane is so far the only one who specifically talks about comparing the effect of the two functions on the page file.  It is always possible for a programmer to err, yet you acknowledge the functions are not operationally identical, a key point. So if Shane erred it would have to be demonstrated and would likely have been simply his own technical difficulty (e.g. "incorrect testing") nothing deceptive or shamistic.  And so far we are not in any position to say he erred.
-Steven Avery
I'm not saying Shane is deceptive or shamistic, and perhaps bull was too harsh a word to use. I still do find it unlikely that the two calls should have a different effect, though, since they both call the same low-level API. I acknowledge there's a risk I could be wrong, but I doubt it :)

Possible advantages -- unused RAM is not wasted -- since it is *immediately* available for usage.  Where XP seems to trip up is that at the moment that you hit enter .. XP says .. oops, I need some RAM pronto .. do this, do that, do the other .. and your keystrokes are waiting. You go out for morning herb tea or Teccino or coffee. Perhaps with this background work the new action springs into play immediately, or quicker.  More a timing and prep-chef type of thing.
-Steven Avery
The only time you will see noticable waiting time from a memory request is in the case where stuff has to be written out to the paging file. Yes, when memory is freed from one process it has to be zeroed out before being handed over to another process (security reasons), but I'd like to see a computer capable of running NT where you're able to measure the effect of this.

As for thread priorities, NT handles them quite well. The reason there's benefit from using things like process lasso/tamer (and there is, especially for single-core CPUs without hyperthreading) is simply that a lot of application developers don't bother setting their thread priorities. It's not like it's hard to set the priority of a long-running computation thread to "below normal", yet there's a lot of developers that don't bother.
3690
Living Room / Re: "50 Most Beautiful Icon Sets Created in 2008"
« Last post by f0dder on March 22, 2009, 02:42 AM »
It's nice that people make their work available for free, but... I think most of those icon sets kinda suck. But that's because I like nice-and-simple/stylish :). The origami set is kinda cute, but not something I'd use; novel idea though.

#15 (Liquidicity) - nice and stylish.
#22 (Circular Icons) - looks good, but only 16x16 available? :(
3691
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 21, 2009, 07:31 PM »
Yeah, fodder, and XP does it's job so well...

I don't know why you don't even try it.
If you haven't.
With your knowledge you could post some real figures.
I have 8GB of RAM in my workstation right now and run without pagefile, so I can't do any "testing" - what would you want me to post, anyway?

Sure thing, running a "memory optimizer" will show more free RAM - but it is a pretty pointless statistic. First, unused RAM is wasted RAM. Second, Windows does outpage/discard as necessary. Third, simply showing free ram graphs doesn't show the overheard of pagefile disk I/O. Fourth, it doesn't show the overhead a fragmented process heap causes.

So, sure thing, if you obsess over "free RAM" statistics you will feel perceived placebo value from tools like this. But the smart thing is restarting processes that leak, and not obsessing over "free" memory.

PS: I did toy with programs like this back in my less-than-a-gigabyte-memory days, and I even wrote my own "trimws" tool... so it's not like I don't have any experience with the subject.
3692
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 21, 2009, 07:20 PM »
Steven Avery: sounds like bull (or incorrect testing) to me - I haven't done very intensive RE of the APIs, but both SetProcessWorkingSetSize and EmptyWorkingSet call NtSetInformationProcess() with the ProcessQuotaLimits class. SetProcessWorkingSetSize wraps it in RtlAcquirePrivilege()/RtlReleasePrivilege(), though. EmptyWorkingSet() calls GetSystemInfo() instead of setting the necessary structure 100% manually, so stuff could work slightly differently - I very much doubt that there's any substantial difference, though.

I might just end up doing some more intensive RE of the issue, since I like getting to the bottom of things. Under all circumstances, the two function calls do the same - trim the process working set size. And, again, Windows does this by itself as needed.

Anyway, a program like CleanMem might be a stopgap solution if you simply cannot restart a leaking application... but IMHO it's more likely to be a placebo for the people who feel it does them good.
3693
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 21, 2009, 06:17 PM »
Those who use cleanmem like it.
The rest of the story is already posted.
And there's people who believe in the tooth fairy as well :)

The guy behind cleanmem is at least honest about what & how he does, and he does it the proper way - so I'm not going to label the app as snakeoil. However, it does nothing that Windows doesn't do itself, and imho it doesn't do it better.

If you're running applications the leak memory, you're much better off restarting them than using cleanmem, since restarting the leaked app will actually free up the used memory, and once restarted, the app will have non-fragmented heap memory.
3694
General Software Discussion / Re: IE8 on the loose!
« Last post by f0dder on March 21, 2009, 06:10 PM »
Hm, one thing is stuff in temporary internet files (afaik only IE and IE-based browsers use that) - but a strangely named exe file in your syswow64 folder? That sounds bad!
3695
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 21, 2009, 04:13 PM »
BOOL WINAPI EmptyWorkingSet(
  __in          HANDLE hProcess
);
Remarks: You can also use the SetProcessWorkingSetSize function to do what EmptyWorkingSet does if you pass it -1 for the minimum and maximum sizes.
-MSDN

:)
3696
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 21, 2009, 01:17 PM »
The old method of gobbling up ram was lame.

Iterating over processes and calling SetProcessWorkingSetSize(process, -1, -1) is what the "smarter" tools do, but it's still plain old silliness. Windows does this by itself as necessary, and it does it smarter by trimming the least recently used processes first.

Really, there's no reasons to use applications like this.
3697
Living Room / Re: What's the best registry cleaner? Ask Leo says: none
« Last post by f0dder on March 20, 2009, 02:12 PM »
Remember that the registry is sorted and uses binary search when looking for keys. For those of you without computer science education, this means that to find one key out of 4.2 billion, only 32 compares are needed. In other words, even cleaning out thousands of entries is pretty darn irrelevant :)

(Oh, the binary search is per key (and subkey etc), by the way - where do you find more than a few thousand sub-key entires?)
3698
General Software Discussion / Re: Rambooster. Junk?
« Last post by f0dder on March 20, 2009, 12:29 PM »
Well, once FireFox terminates (and that means all firefox processes - if you use "minimize to tray" or the likes you need to get rid of that too), memory is freed. After a day of browsing, this usually means around 800MB or more on my system. Keep in mind that FireFox isn't the only memory-hungry/leaking application out there, though. Also keep in mind that "System Cache" reported in Process Explorer can basically be though of as free memory - if there isn't enough free memory to satisfy a memory request, cache will be dropped before paging things out to disk.

None of the memory "optimizers" can work magic, none of them will do anything windows won't do by itself. Windows should actually be targeting the least-recently-used applications when it decides it needs to trim working sets, whereas the memory "optimizers" are generally pretty dumb and trim everything (and the majority don't trim processes, they try to allocate as much memory as they can, thereby being much more likely to cause pagefile activity).

The ability to trim individual processes might sound appealing, but in reality you're better off restarting an application than trimming it - that will get rid of leaked memory, reduce memory fragmentation, etc.
3699
Living Room / Re: What's the best registry cleaner? Ask Leo says: none
« Last post by f0dder on March 20, 2009, 12:21 PM »
Darwin: yup, too overzealous, and "cleaning" the registry means just about nothing wrt. performance anyway (defragging is what matters).

Wrt. pagefile, 'tweaking' the size is more or less useless, and the various "1.5x system memory", "no! 2x system memory!" etc. is silly. Either you get enough RAM to turn it off completely, or you set a bigger-than-ever-needed minimum size (to avoid ever having to grow, possibly resulting in fragmentation). If you feel you do need a pagefile, it can help moving it to "the physical disk with the least traffic" (which might very well be your system disk - the blind advise of "don't put pagefile on your system disk" is as silly as anything).
3700
Living Room / Re: dvd burner crisis
« Last post by f0dder on March 20, 2009, 11:55 AM »
My old PX-716A was a very good drive, but I've heard that today plextors aren't much better than, say, Lite-On - and definitely not worth the premium.
Pages: prev1 ... 143 144 145 146 147 [148] 149 150 151 152 153 ... 364next