 |
nomanskyV2EX member #283728, joined on 2018-01-17 17:54:00 +08:00Today's activity rank 512 |
 |
Per nomansky's settings, the topics list is hidden |
Deals info, including closed deals, is not hidden
nomansky's recent replies
10h 43m ago Replied to a topic by Donahue › 随想 › 一口香蕉一口牛奶口感更好。 |
牛奶会从香蕉里喷出来吗
10h 45m ago Replied to a topic by Giaorui › 职场话题 › 救命 上班看微信被领导谈话了。。。 |
那我下班的时候还想着工作上的事是不是得付我加班费？ 看这老板言论就知道是个国产周扒皮。
14h 35m ago Replied to a topic by wa007 › 生活 › 现在还是否要继续给父母买城乡居民基本养老保险？ |
在这里问还如找 AI 帮你算下
1 day ago Replied to a topic by lynn1su › 程序员 › 我发现写病毒居然很有意思。无害的那种 |
@lynn1su 不懂。但我也好奇 vibe 了下，让 Gemini 分析了下这个流程图和这个帖子，他说你是业余的，哈哈。技术太老了，根本破不了 Windows defender 带有驱动签名和内核隔离。
Summary
The V2EX post confirms that:
The author is an amateur enthusiast experimenting with AI code generation, not an APT or seasoned kernel security researcher.
The techniques in the diagrams are recycled legacy Windows XP/7 tricks (tampering with hosts, CR0 write-protection toggles, unexported PspTerminateThreadByPointer byte scanning, and sideloading against old 360 utilities).
The author tested in an isolated VM with weakened security settings and mistook "the file isn't in VirusTotal's database yet" for "this can bypass all modern antivirus systems."
Against a standard Windows 10/11 system with default settings, Windows Defender, Driver Signature Enforcement (DSE), and Core Isolation (HVCI) would block this pipeline before the driver ever reached kernel space.
Summary
The V2EX post confirms that:
The author is an amateur enthusiast experimenting with AI code generation, not an APT or seasoned kernel security researcher.
The techniques in the diagrams are recycled legacy Windows XP/7 tricks (tampering with hosts, CR0 write-protection toggles, unexported PspTerminateThreadByPointer byte scanning, and sideloading against old 360 utilities).
The author tested in an isolated VM with weakened security settings and mistook "the file isn't in VirusTotal's database yet" for "this can bypass all modern antivirus systems."
Against a standard Windows 10/11 system with default settings, Windows Defender, Driver Signature Enforcement (DSE), and Core Isolation (HVCI) would block this pipeline before the driver ever reached kernel space.
1 day ago Replied to a topic by lynn1su › 程序员 › 我发现写病毒居然很有意思。无害的那种 |
是哪个杀毒软件查不出来？
1 day ago Replied to a topic by m997267238 › 分享创造 › 整理了一份《深入理解计算机系统》（CSAPP）的完整中文 Markdown 版 |
这种大头书古法编程时代读过，现在都忘得差不多了。
现在我选择不清楚的就问 AI 大人。
现在我选择不清楚的就问 AI 大人。
1 day ago Replied to a topic by helloword123 › 生活 › 女友第一次去我家 不是很想住我家里 |
没有浴室和旱厕谁受得了。旱厕夏天蹲上面一看里面全是白花花的蛆
2 days ago Replied to a topic by tianhehechu › 奇思妙想 › 具身机器人不能装福，天才发明家陨落（悲 |
机器人的福会黑吗?
Select Language