Slashdot Mirror
XP/Vista IGMP Buffer Overflow — Explained
HalvarFlake writes "With all the hoopla about the remotely exploitable, kernel-level buffer overflow discussed in today's security bulletin MS08-0001, what is the actual bug that triggers this? The bulletin doesn't give all that much information. This movie (Flash required) goes through the process of examining the 'pre-patch' version of tcpip.sys and comparing it against the 'post-patch' version of tcpip.sys. This comparison yields the actual code that causes the overflow: A mistake in the calculation of the required size in a dynamic allocation."
>This comparison yields the actual code that causes the overflow:
>A mistake in the calculation of the required size in a dynamic allocation
I hope no one else makes this mistake.
Hooray! Windows vulnerabilities are so commonplace now that there are public educational documentaries about their life-cycles and internals, so that the people can stay informed. Brilliant!
OMG! I thought it might be a bug, but thankfully it's just a mistake!
Engineering is the art of compromise.
Darn pesky kids and their fancy buffer overflows. I outta HEAP on the insults, but I'll try to stick to my PROGRAM of keeping my smoke STACK cool.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Yep, the submitter's email is from the company that stands to gain from more hits to this video (the ad at the end of the video).
Lol MS sux0rz! ph34r my 1337 h4x!1one
Everyone should be forced to give up manual memory allocation regardless of the power it can afford.
#include "fucktard_troll.h"
Now that that's done with, I see things like this as an argument in favor of moving stuff off of the CPU and into dedicated hardware. Why should your CPU be tied up with things at this level? The absolutely overwhelming majority of all data on every network uses one of two network layer protocols (IPv4 or IPv6) and one of two transport layer protocols (TCP or UDP). Why shouldn't those four combinations be handled by hardware, so we can leave the computer to run the applications? We already do this with 3d rendering, why not networking?
To all IT admins: If you're planning on following this, please do note that you need to ban all knife sharpeners at the workplace plus I heard home depot just got this new shipment of these thick fiberglass cubicle walls...
*blink*
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Yes, I'm correcting myself. I know that I made an error. I should have typed "its" instead of it's." The former is the possessive form. I know better than this. :(
Or you could read about it on the Security Vunerability Research and Defense blog at http://blogs.technet.com/swi/
I smurf everything and everything I smurf is perfect.
I see things like this as an argument in favor of moving stuff off of the CPU and into dedicated hardware. Why should your CPU be tied up with things at this level? The absolutely overwhelming majority of all data on every network uses one of two network layer protocols (IPv4 or IPv6) and one of two transport layer protocols (TCP or UDP). Why shouldn't those four combinations be handled by hardware, so we can leave the computer to run the applications? We already do this with 3d rendering, why not networking?
Do you have any idea how many millions of ethernet cards have been sold? Are they all going to be made obsolete?
These days CPUs are so fast that the minor overhead of a network driver is negligible, unless you're going to ultra-fast speeds (some high-performance network cards do offload this to hardware).
However, you still could have buffer overflows in the network drivers/firmware.
This movie (Flash required) goes through the process of examining the 'pre-patch' version of tcpip.sys and comparing it against the 'post-patch' version of tcpip.sys. This comparison yields the actual code that
See? And they said without FOSS, this couldn't be done!
You see? You see? Your stupid minds! Stupid! Stupid!
win32time service is broken in their Active Directory enviroment post these updates. It is as yet unclear if they are related.
The cards won't be made obsolete, any more than 2d cards are made obsolete, a number of my machines have 2d only cards and they work fine for a large amount of the non gaming I do.
I don't think anyone advocates softmodems, so why do we tolerate mostly soft network cards.
Software is more flexible than hardware. We have plenty of hardware to do the work, and the parts that benefit from offloading (e.g. checksumming) are already offloaded. No point to adding new hardware.
Even with a buffer overflow in the firmware of the card it would be much harder to exploit it for system access, the most you could do with it is control the network adapter (granted that is still a lot but much better than root). That is unless the application using the network card just blindly read in data without sanitizing it, in which case you are back to square one.
i read about it in a blog once
Because TCP and UDP headers aren't of fixed sizes and as such are incredibly difficult to handle in hardware. Hardware switching has been tried - ATM for instance - but it's not that simple. TCP/IP was designed as a software protocol, and it's an unfortunate reality that some protocols are easily handled in hardware and others are not.
IPv6 makes some steps towards having simpler hardware handling, but as long as IPv4 is still around, we won't see hardware switching become commonplace.
Or unless it DMAs stuff over, right on top of the kernel...
Ewige Blumenkraft.
Everyone should be forced to give up manual memory allocation regardless of the power it can afford.
I beg your pardon?? What is it you're suggesting with that respect exactly?
You just got troll'd!
In flash no less! Someone's about to leave somewhere for a lot more money.
The problem is more fundamental then smarter network hardware, it's the CPU/Memory architecture. Long ago, there where computers that had dedicated hardware for memory content management. Two schemes were used: segment descriptors and memory tag bits. The segment hardware checked that addresses for the data structure fell inside the segment memory limits, and tag bit described memory contents (i.e. integer, float, pointer, etc). This was in the days when logic and memory was much more expensive then today. These design choices made the machines much more reliable.
Specifically I'm referring to Symbolics Lisp Machines and Burroughs stack machines, both of which had very low software failure rates. Even when a program crashed, the OS kept going. Note that both of these computers had all their main software written in high level languages that had automatic garbage collection that was integrated with the hardware memory support.
Unfortunately, the quest for performance eliminated these features. Realistically, without hardware support software will never be very reliable. (Even with better hardware there will still be problems, but the current situation will never be very good.) Now that logic and memory are cheap and reliability is a critical issue, we should be considering putting resources into these kind of reliability checks. What are we doing instead? Putting more cores on the die. Yeah, more multi-threading will make software even more reliable in the future.
I'm so looking forward to reconfigurable hardware; that'll make the whole argument moot. The CPU as we know it will do nothing but setup reconfigurable logic units and direct data streams. You want hardware networking? Bam. Hardware complex math? Bam. Hardware neural net? Bam.
TCP/IP offloading is already done on-chip by several network cards. Spend $10-$50 more on a network card and you would get it. Off course a lot of TCP/IP is still handled in the kernel of the OS just because it is too flexible to be done on-chip. Off course, if you need more performance along the lines of firewalling or traffic shaping, you could get an external appliance that handles it.
Custom electronics and digital signage for your business: www.evcircuits.com
Because Ethernet is a physical component of the networking chain; protocols other than TCP or UDP can (and are!) be implemented.
Besides, networking is something that barely taxes CPU power on every processor made from the Intel Pentium days to this date, unlike 3D acceleration. There's little justification to loose the flexibility provided by running it in software to get a negligible CPU performance increase.
And yes, hardware can be buggy too. There's a shitload of issues with specific hardware that are addressed on their device drivers - again, easier to solve in software than to fix in hardware. Even CPUs suffer from this.
I'm so looking forward to reconfigurable hardware; that'll make the whole argument moot. The CPU as we know it will do nothing but setup reconfigurable logic units and direct data streams. You want hardware networking? Bam. Hardware complex math? Bam. Hardware neural net? Bam.
Behold, the bright future!
Actually, there's one more comparison they've screwed up. Anyone who has installed the Event ID 4226 patch to increase the allowed number of half-open connections so their BitTorrent speeds don't suck ass just had that patch undone by this new version of TCPIP.SYS.
:-] Oh, and I'll add one more detail not mentioned here. According to F-Secure, there haven't been any exploits for this found in the wild--yet.
The only good thing is that, while the page hasn't been updated since 2006, the patch seems to work on the new TCPIP.SYS (I just tested it on my own machine).
I realize I'm sort of hijacking the first post, but given how many of us are probably downloading Linux ISOs right now, I figured it's important enough that people wouldn't mind a reminder...
Because in the end an application is going to get a packet of arbitrary size from network stack and has to allocate buffer accordingly. This is nature of asynchronous communication.
Woah...
Now, don't get me wrong. I think that's a really cool hack. I admire the effort.
Seriously though, WTF? That's a rootkit technique. Changes of this nature should be made to source code, not binaries. It's way more maintainable and sustainable that way.
I don't mean an FPGA, I mean something like a magnetologic array. Something that's both fast and quickly reconfigurable on the fly. Scientific American had a story in the August 2005 issue if you can find it.
> Seriously though, WTF? That's a rootkit technique.
Rootkits use a lot of techniques that are also used by legitimate software. Yes, that patcher (and its patch) does get detected by a few anti-virus programs because worms, like torrents, benefit from being able to connect to more peers. It's not a virus in or of itself, though, plenty of people have checked it out.
> Changes of this nature should be made to source code, not binaries. It's way more maintainable and sustainable that way.
I fully agree, but it's kinda hard to get the source for Microsoft programs. Last I heard, you had to be a big university, pay tons of money, sign NDAs, etc. Besides, this limitation wasn't an accident. It was a deliberate "feature" they put in because they thought it would slow down worms. They're not going to fix it just because people ask.
Xfce: Lighter than some, heavier than others. Just right.
"It could be that the purpose of your life is only to serve as a warning to others." http://despair.com/mis24x30prin.html
Wow! I thought I was retro with Windows 2000!
:)
Turns out this patch MS08-0001 is Patch NUMBER 100! Yea! Yea! Yes!
Finally, the number of patches to Windows 2000 is in TRIPLE DIGITS!
( actually, for us, 2K users, there are two patches, KB941644 and KB943485 )
( I found the actual patch count from a Winternals System informataion program )
( WinTernals is my bestest friend! )
Since you can 'blind' Windows 2000 to look like vista, ( if you have the graphics hardware ),
or you can 'blind' Windows 2000 to look like Windows98, I have the best of both worlds.
but ALL MY PATCH COLLECTION CDs ARE NOW OUT OF DATE.
Actually, there is one feature I need that Office 97 doesnt have, and that is the ability to read Office 2007 excel files. So, its Win2k and Office 2k for me. ( btw, I am going to set up a DOS machine to play some old games...
Some ethernet hardware can offload a number of expensive yet common operations to be done in hardware. But it doesn't always work.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
That's not really fair. OSs now use virtual memory for protection. There are schemes to use canaries on the stack so that buffer overflows are guaranteed to cause a crash rather than an exploit - software can be updated over the net to fix the crashes. There is a move to VM based software like Java and .Net that uses garbage collection and can be statically verified before it is JITted to native code.
I don't really believe that segment based protection could ever have eliminated stack overflow exploits at an acceptable performance level. Look at the assembler for a function that uses stack variables - they are all allocated by a single subtract operation. If they were allocated individually as far pointers the OS would need to be called for each one. It would need to switch to kernel mode and modify the descriptor table and then return. Once the function was done the whole process would need to be repeated. Most C functions would run hundreds of times slower if this was the case.
The performance cost of VM based solutions is far lower and they can still be run on current PCs, not some radically new architecture which would probably spend most of short life emulating old code badly anyway. E.g if you look at Itanium it is far less radical than a stack based machine and yet it still failed because it had a relatively minor performance disadvantage on old binaries.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Most Ethernet cards aren't "mostly soft". The network stack is, well, a stack. The physical layer and link layer are usually handled by the card. The stuff above that might be handled in firmware or a driver, but I'd rather not have IPv4 shove onto my Ethernet card as the only option. Some cards have gone soft to cut costs, but mid to high end cards are all hard. High-end server cards often have IP acceleration built in, but leave other options open.
(Not the original AC.)
"Bluto's right. Psychotic, but absolutely right."
- Otter, Animal House
OK, so Win9x wasn't a real OS. It had no security model. That was its unfixable weakness (instability), but that was also part of its salvation.
No network-aware services listening out of the box? No remote-unattended exploits!
And when/if something broke due to the instability - even something as bad as "registry corrupted - don't even fantasize about getting your GUI back", you just booted to DOS, extracted a "good" version of the reigstry from the last five copies in .cab files in C:\WINDOWS\SYSBCKUP, typed a few "ATTRIB" commands (i.e. chmodded it to be writable) and overwrote the "bad" user.dat and system.dat with ones that worked.
The 9x UI wasn't any better/worse than XP or Vista. How many of us took one look at XP's Fisher-Price interface and immediately "downgraded" it to the Win2K look?
Boot speed? My last gaming rig was a Pentium IV, 2.4 GHz, running at 3.2 GHz, 512MB RAM and a 120GB drive, and the fucking thing went from power-on to full-GUI-running-and-no-hard-drive-activity in 15 seconds. There were configuration files you could edit to support 1GB and (by replacing/patching WINDOWS\SYSTEM\IOSUBSYS\ESDI_506.PDR) hard drives over 128GB.
Once upon a time, Linux wasn't ready for the desktop. During those years, Win9x rocked. Crappy multi-user OS? Guilty as charged. Useless for a server? Absolutely. But as a single user OS/program-loader, it was hard to beat. DRM? Product activation? What's that?
Obligatory "Office Space" Quotes...
Tom Smykowski: It was a "Jump to Conclusions" mat. You see, it would be this mat that you would put on the floor... and would have different CONCLUSIONS written on it that you could JUMP TO.
Michael Bolton: That's the worst idea I've ever heard in my life, Tom.
Samir: Yes, this is horrible, this idea.
Because as we all know, manual memory allocation is hard to understand. Programmers shouldn't have to know basic math, right?
Why don't we just make a language that does it automatically, and then we won't have any problems like this? Right?!
Those of us who cut their teeth on assembly and C look at this and just wonder in wide amazement. A part of us wonders how anyone could be so negligent - but the other part knows how things work in proprietary software shops. (A hint - the management doesn't consider it a bug unless the customer notices it.) Yes, we've all done this before, but the solution isn't to create a language which dumbs down the programmer (Dude - you're writing directly to memory!!! You must be some kind of uber-hacker!!). Rather, there are steps you can take to virtually eliminate this kind of problem:
You know, there was a time when formal methods were taught, when programmers were expected to know how to properly allocate and release memory. When things like calculating the size of the buffer, applying basic math(!) and testing your own code were considered just a part of the programmer's job. Now we're hearing people blame languages for the faults of the programmer.
If I keep going, I suppose I'll start to sound like Bill Cosby. But consider this: the most reliable operating systems to date were built on C (UNIX) and assembly (MVS). If a bunch of old farts (well, perhaps they were young then...) can crank out correct, reliable, fast code without an IDE and a bunch of GUI tools, clearly the language is not to blame.
The old adage still applies: a poor workman blames his tools . Software engineering works, regardless of the implementation language. This isn't a failure of the language or the environment, but rather, failure to do software engineering right:
The society for a thought-free internet welcomes you.
Isn't that pretty much what a CPU already does?
For the few people, who are hanging to their Windows 2000 for dear life ?
The absolutely overwhelming majority of all data on every network uses one of two network layer protocols (IPv4 or IPv6) and one of two transport layer protocols (TCP or UDP).
You forgot ICMP. And even if you had remembered it, the bug was in IGMP, which is still not on your list, and would thus need to be implemented in software anyway. Sure, IGMP is not used that much, but it only takes one bad guy to send the packet that takes over your system.
There is a real point to his argument. It also happens to be the real flaw in his argument...
The only real reason to "upgrade" something is if you need something more. For business, need should be defined as something that will do a business function that will make money, replace labor, acquire additional business related information of value, etc... It has to do something you truly need. If all you any business need for is a computer that runs a word processor then he has a genuine point. It assumes that there is no other piece of software that serves a valid business need that anyone else might need.
A number of pieces of software have been written that require a later OS that fulfill a number of very valuable ($$$) tasks. Also Win 95 is only stable if you have hardware with extremely good drivers under it, a limited number of processes/programs on top of it, and your continuous up-time requirements are somewhat limited. This makes 95 a long way from being the one-size-fits-all solution. (I have one Win 95B station at my desk just to do drive data recovery and to do a few file tasks that XP doesn't want to let you do...)
Using that same logic there isn't a valid reason for almost anyone to use Vista instead of XP. Plus there is the "Business downside" of the end users having to relearn how to use computers that they already knew how to use.
Vista's big offerings are two fold:
- One is what I call the "raccoon" factor. Give people something bright and shiny and their eyes will roll back in their head as they start to murmur, "Gimme, gimme, gimme..." as you can hear the words, "It is new!" echoing softly in the background. This offers them nothing that is real but it does drive people amazingly hard. Look at the number of people that paid $100+ premiums to have an iPhone in the first week of release. A month later no one including themselves remember that they got their phone early and it certainly didn't pay any dividend for the expense but they will do it again: They are raccoons!
- Two, Vista includes huge DRM underpinnings. After XP was released Bill Gates publicly stated they the next version of Windows wouldn't be an OS but instead it would be a Digital Rights Management Platform. This does nothing for us but does plenty for Mickeysoft and the big media companies. I notice they aren't mentioning that fact any more either!
Basically Microsoft wrote a new OS for themselves instead of us and they made it really visually flashy so the raccoon in all of us will want to roll our eyes back in our head and buy it. The fact that they forgot to put anything we actually need in it has made its adoption really tank. The only real reason they have sold any volume of it is that you almost can't buy a computer without it. To help the process along Microsoft has pushed for new hardware that doesn't have XP driver support and you will start to see programming tools with limited or missing XP support.
We are coming up to a point where we are looking at a future where we could lose control of what is on our own computers! Vista is already trying to decide if you should be able to access your own files that are already on your computer! Take this fact and combine it with the whole limitations being rammed down our throat with HDTV and we are looking at being consumers that are buying things that we have no control over. A computer could easily act as a HDTV 'VCR' because that is an amazingly simple function but we have been forced to buy into a system where that isn't allowed. The only HDTV VCR like devices are subscription ($$) based!
You are being quietly guided into a world where you will tithe endlessly to corporations for simple things that in the past you could buy once and be done with. MS has tried to make the OS subscription based. (tithe) Limited number of play media files are subscription based. (tithe) Buying a cell with an MP3 player in it that you will just replace in a year or two is ano
bindiff.exe
But that is the primary reason for
I would have to disagree, AmigaOS was the best consumer level OS in 1995, it satisfied all the criteria you mention. Small, reasonable command line, fast/light ui, full multitasking, and the OS itself was very stable (but, like win9x and macosx could be taken down by an errant program).
However, i would never recommend such an OS to IT admins, an OS with no user separation is a terrible idea in a managed multiuser environment. You want to make sure users can't mess with other users or the system itself.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Are you sure? I always thought TOS was co-operative like MacOS of the day... That was one of the things that sold me on an Amiga instead.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Considering that Firefox crashes whenever I happen to hit the "Insert" key when writing a reply on Slashdot, and randomly otherwise, I'm inclined to agree. Programmers, in general, are apparently incapable of dealing with memory management or bounds checking, so they should just use automation.
Of course simply moving them to Java will just have them do things like starting threads from object constructors (which causes all kinds of weird and wonderfull bugs), use 100+ threads for low-volume network communication (I'm looking at you, Freenet) and in general write such inefficient code that a lookalike but less featured remake of a DOS-era game running on a 1 GHz machine feels like watching a glacier (FreeCol, that means you).
Most programmers are incompetent, there's no getting around that. And giving more power to an incompetent is propably not such a bright idea.
Sorry about the rant. I blame it on Firefox crashing three times this morning.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
I think he's suggesting the .NET framework.
Quite what I was afraid I understood. If you're afraid of doing dynamic allocation yourself you shouldn't be allowed to use a real programming language in the first place anyways. I mean seriously, that trend that consists in going "eww, dynamic allocation", "omg, a pointer, what is that thing!?" or even "I wonder how people could live without garbage collection" makes people sound like sissies.
You just got troll'd!
You do, of course, have the option of not subscribing and living without these so called "needs." Rather than blaming the media companies for wanting more control of their product, I'm more inclined to blame the modern consumer for having redefined needs from food, water, and shelter to food, water, shelter, and my favorite TV shows and music. If they're being sold with a license that you don't want to agree to, then you are perfectly free to look for alternatives that aren't as restrictive. If people want to dish out more and more of their money for a less and less valuable product, then more power to them. The only true protest against this trend is to turn to more agreeable alternatives - not whining and still dishing out the money anyway.
Forget these other retards. Your hardware idea is one of the best I've ever heard.
Write it out in VHDL, get an FPGA, and take the proof of concept to someone with money. Any web server admin with half a brain can see why having your TCP/IP stack in hardware is preferential to software, even if it does replace the ethernet card.
Fantastic!!!
Well, for starters you'd need to actually *find* the IP header in the frame before you start mooking around for the transport headers.
Try Athene, I used it on an old machine and it was super fast. The only problem was with the cursor not being properly drawn, though that didn't show up on another machine. Just make sure that you run it by itself, outside an xserver. Inside an xserver there seems to be no point to it.
Disclaimer: I don't work for Rocklyte, blahblah
"(I have one Win 95B station at my desk just to do drive data recovery and to do a few file tasks that XP doesn't want to let you do...)
"
Why?
Seriously, what can it do that XP can't? I'm interested.
File tasks are usually (IMHO) much better donw under Linux, which doesn't try to stop you doing anything.
But people keep saying "You really need to get a TV" etc. We're social animals and now social mores are based around TV.
Mind you, I now need so little money I'm able to work part time and STILL have a lot of money to enjoy it.
OK, so the poor artists (and engineers, etc) will starve because nobody is buying their product any more, so I can't see that being allowed.
It's a physical layer component ,which is not a physical component,but a logical one.
I don't know about him but the workstations at my work run either win 95 or if your lucky win 98se.
Why because with the NT line MSFT broke a lot of other companies networking protocols. So we wouldn't be able to connect to the server, which stores all files and applications.(The win95 machines being not much more than dumb terminals). Windows XP won't work as said server company never made a proper upgrade path for such a configuration. Linux might, but I would need an old school netware guru, and someone with enough knowledge of linux to configure netware inside linux but also Dosbox. As all the applications are Dos based. when this setup was first deployed Linux was at 0.9 something.
Then you have to figure out how to sell it to a computer illiterate cheapskate boss.
i thought once I was found, but it was only a dream.
pi = 2*|arg(God)|
Hear, hear. Once upon a time I designed a packet-ized format for data telemetry and storage. The design was straightforward, but it included a variable-sized record-header (but always a factor of 8) on top of variable-sized record payloads. I thought it was a good idea at the time, but it turned out to be problematic for S/W implementation, especially for inexperienced devs. I could have saved ourselves a lot of time and pain if I had made the record headers fixed-length. Mea culpa.
Makes one appreciate just how complex handling TCP/IP can be. I can't imagine how it could easily be ported to firmware. It obviously can be done, but it's no easy task.
In the course of every project, it will become necessary to shoot the scientists and begin production.
Shit, this error needs to be fixed in BSD Unix as well.
Of course simply moving them to Java will just have them do things like starting threads from object constructors (which causes all kinds of weird and wonderfull bugs), use 100+ threads for low-volume network communication (I'm looking at you, Freenet) and in general write such inefficient code that a lookalike but less featured remake of a DOS-era game running on a 1 GHz machine feels like watching a glacier (FreeCol, that means you).
Most programmers are incompetent, there's no getting around that. And giving more power to an incompetent is propably not such a bright idea.
Sorry about the rant. I blame it on Firefox crashing three times this morning.
Wow, Java programmers start threads in constructors? I admit I have no idea what havoc that would cause, but on the other hand it would never occur to me to do such a thing. Seems to me that's what the Runnable interface is for.One of my big pet peeves of the software industry is that no project I've ever been on bothers to do CPU or memory profiling unless there's an absolutely god-awful bug. I mean, something like "a tiny transaction is taking 1.5 hours" or "Our small app is bloating from 25MB to 1GB". No one on these projects but me has EVER thought "This thing should be performing faster and using less memory" and then ran the tools to figure out why. Then again, I've spent most of my time at a company that sells hardware and software, so it's probably good for business that their apps waste memory and CPU cycles.
I actually don't mind marketing that actually *is* clever. Be it entertaining, informative, or just cool, when a company spends enough bucks to make an Ad truly worth watching/reading, I won't complain. For such ads on the internet, they usually don't even need to spend much on distribution - people will pass it on of their own accord. "Viral Marketing." I do think companies that do this should include a Creative Commons type license so people know it's ok to pass it on.
Remember kids, if you need a vBlog to make your Blog interesting it may be more about you not being interesting than the format.
-
I believe the Windows 95/98 backup program is different than the one in XP. A friend of mine had his machine crash with key contents lost. He emailed me his backup files but I couldn't restore them despite some effort -- XP could not restore 9x backups. Idiotic I know but what I ran up against.
I come here for the love
"(I have one Win 95B station at my desk just to do drive data recovery and to do a few file tasks that XP doesn't want to let you do...)
"
Why?
Seriously, what can it do that XP can't? I'm interested.
Well, there is a Windows 3.1 computer in my lab. Yes, Windows 3.1, not 3.11, not Windows for Workgroups. It is used to control an old & expensive scientific instrument that still works very well. The control software only runs on Windows 3.1.
Of course, you could buy a new instrument which will be controlled by a modern PC, but the old one works just fine.
Some games don't support or in some cases won't even install with >= DX6. I've also had the odd occasion where a win9x box would have been "convenient" since I would not have had to run it under the confines of a VM.
The big thing is that XP does some automatic things whenever you hit a file system. When doing recovery work I mostly use my 95B system in DOS. (Safemode command prompt only) (I do use an XP system for certain tasks when doing recover. It just depends on what is needed.)
A simple example of Windows stupidity is if you copy a *.lnk file (shortcut) it will look into the file to see where it is pointing to and can alter it. I will use the example of recovering things from a "D" drive to the "C" drive. The contents of the shortcut points to "C:\Program Files\Example\example.exe". That program exists on the "D" drive but not on the "C" drive in your recovery computer. If you copy it in Windows it will look at the contents of the file, see that it doesn't exist on "C", see that it does exist on the source drive, and then alter the copy of the shortcut to point to "D:\Program Files\Example\example.exe".
Their are a number of directories that you can't touch either. Things like the Windows\Fonts directory for example. The desktop.ini makes it so Windows alters your access to to it. 95B is good for looking at drives that have been rootkitted too. The last little bit is I have a number of very low level DOS utilities to get straight to the HD that won't run under an NT based OS.
What language you would use to write those other languages? Most of the high-level languages are not self-hosting -- for example, Sun's Java implementation is entirely in C, as are common implementations of lisp, python, perl, etc.
There are sometimes attempts to make such languages self-hosted, but generally only as analysis tools for in-depth debugging and performance monitoring. For example, there are a couple of "self-hosted" JVMs floating around, but they all are A) dead slow B) have incomplete language coverage C) are launched by a C program that loads a hand-constructed JVM image into memory and begins execution.
So until you write a self-hosted Java implementation that's usable in the real world, I think we'll probably still be writing in C.
Yeah. And CPU's are ridiculously fast nowadays anyway. The demands put on them by stuff like networking are so low it's just in the noise in most cases.
I think if you continue your "off course" comments, you'll never stop stating the obvious.
I shall now go through the replies to my post, one by one, and judge if they are worthy uses of win95. You First!
Right, I know sod all about netware, and you still have apps that need the system. Seems a good reason to keep it around to me!
The OP mentioned file ops that I was wondering about, but your situation warrants hanging on to 95 as long as is practical.
That sucks. When I want a disk image for a backup I boot into linux and run dd if=/dev/diskIwanttobackup of=./filetostoreitin and voila, several minutes later I get a complete image.
Restoring is as easy as dd of=/dev/diskIwanttobackup if=./filetostoreitin
OTOH I recognise I'm unusual in backing up whole disks like that. And it does suck that MS broke back compat in their restore software.
That's a hell of an annoyance. You too seem to have a good reason for keeping 95 about. Shame it's a necessity.
I'd say "try wine, or maybe DOSBox, on Linux", but I've no idea what their older DX support is like. DOSBox on a later windows *might* work.
OK, this is the post my original comment was aimed at. A linux LiveCD (like Ubuntu installation media) or a linux machine will do this stuff *very* well indeed. It'll give you full access to FAT or NTFS drives, allow you to copy what you like, up to and including full drive images*.
There's no issue with windows systems that may be rooted or infected because the stuff just won't run. What do your low level DOS utils do?
I must mention here, too, that a lot of the tools provided in Linux are intuitive and easy to use. "gparted" is a godsend.
*(which is easy BTW, dd if=/dev/disktocopy of=./imagefile, restore by switching if and of)
(if you're happy using Win95, it's good with me, just felt like getting in a bit of Linux advocacy seeing as I'm using it loads for disk and filesystem stuf at the moment)
You, sir, have aperfectly valid reason for using Whatever system the control software runs on. I was more curious about somebody wanting 95 around for file operations when Linux was a very good (and more stable and modern) alternative.
Well, I seem to get plenty of 4226s when I don't patch it and I'm using uTorrent. Also, the site linked seems to rely on MSDN documentation, which I don't really trust. I've used the LVLlord patch for years now with absolutely no troubles, though I admit that I don't (and never would) use Media Center.
Moreover, the LVLlord patch (which is the one linked above, BTW) can be run again to uninstall itself and makes a backup of your TCPIP.SYS.
Anyhow, it's up to people to make their own choice on the matter. I'm not too worried about worms--I've never had one in all my years of running Windows (I do my own checks for malware, rather than just relying on a virus scanner) and the patch works for me.
*shrug* But you don't have to take my word for it.
If you're backing up a disk (especially a bigger hard disk or something), use the bs argument. bs=1M can really speed up hard drive imaging.
My blog. Good stuff (when I remember to update it). Read it.
I seem to remember assembly programmers saying the same things about high-level languages...
My blog. Good stuff (when I remember to update it). Read it.
Hopefully the GTK developers will fix this issue soon.
Hrm... doesn't seem to crash for me. What version are you using? Or do you have your Insert key somehow tied to something else? Because I just hit Insert 20 or 30 times while typing this and nothing happened.
My blog. Good stuff (when I remember to update it). Read it.
Mr. Coward, what you just said... is one of the most insanely idiotic things I have ever heard. At no point in your rambling, incoherent response were you even close to anything that could be considered a rational thought. Everyone in this room is now dumber for having listened to it. I award you no points, and may God have mercy on your soul.
Why should I *slave* for micro$soft?
Let them release the code for Win98 GPL and see how fast it surpasses Pista!
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
I seem to remember assembly programmers saying the same things about high-level languages...
Sure, we might go "wtf do you need exception handlers for? Just write bug-free code!" or even "operator overloading is for pansies", but there's no way you can turn it into making us sound like sissies.
You just got troll'd!
Now that that's done with, I see things like this as an argument in favor of moving stuff off of the CPU and into dedicated hardware. Why should your CPU be tied up with things at this level?
It's been done over and over again, and in every single case, with the excepting carefully selected benchmarketing, it's had worse performance than doing it in the CPU with a cheaper and simpler NIC.
Personally, I'm glad it's NOT in the card. Imagine a vulnerability found in a network card's stack! A PCI card can scribble all over system RAM just as easily as a buggy kernel driver. Imagine no more iptables. Imagine nobody experimenting with IPv6 at all because they'd have to get an expen$sive new card carved from pure unobtanium.
Or perhaps you've been styling it up with the rose-tinted spectacles lately?
I'm not too sure about using strlen in a loop like that. C strings are NULL terminated so each time you are going through that loop and doing your test you are also having to iterate over foo to find its length (unless foo is const variable and the compiler notices etc).
I'm not so sure about the "you forgot to terminate your string constants" bit. My understanding is that string constants are NULL terminated in C. I would be a bit cautious about assigning a string constant to a fixed sized array though (it feels wrong... If copying happened there's potential for wasted/too little memory, questions over whether you are actually throwing a pointer to rewritable memory away, are you trying to change read only memory later etc). Whether more memory is zeroed before use depends on your platform, libraries, how the memory allocation was done and your compiler (e.g. on Linux the glibc malloc function switches between brk and mmaped memory allocations depending on size and mmaped memory is zeroed by the kernel before being passed to your program).
I think you've chosen a bad example there. The TCP/IP stack is a very speed critical part of current kernels. At gigabit (or faster) speeds a very large number packets will arrive so that is code that is executed an awful lot (especially if you are running a stateful firewall). You don't want gettimeofday to be slow because it is called so many times. The same goes for your TCP/IP stack - you want it to be fast AND robust.
I don't think that using a safe self-hosting programming language like ADA or Cyclone is a thought that is difficult to formulate...
I thought it was faster to have the block size set to the HD sector size or some multiple thereof? I've always done bs=4096 for stuff like this.
I just did two tests on my system. One with bs=4096 and the other bs=1048576. Copied 1 GiB of /dev/zero to a file. Block size 4096 finished in 21.6055 seconds, with a transfer rate of 49.7 MB/s. The larger block size finished in 23.9442 seconds, with a transfer rate of 44.8 MB/s. Admittedly, this probably isn't a scientific test -- could anybody shed some light on which way is generally more efficient?
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
I was going to say, anybody that claims 9x had no remote exploits has selective memory at best. I can't help but remember the teardrop attack. Hell, back in my script kiddie mudding days, we used to bluescreen Windows 95 users all the time. Usually right in the middle of a PvP battle. Boy did they get pissed off ;) By the time they rebooted the battle was over and their corpse had been stripped of anything valuable. Yeah, those were the days ;)
Hell, for the longest time, I used an old program called Trumpet Winsock instead of the stock Winsock that shipped with 95. Trumpet was an old 16 bit program but it was mostly compatible with programs running on 95 and it was largely immune to all of the exploits of the day directed at Windows. Plus it had a packet sniffing feature at a time when utilities like Wireshark didn't exist. I learned a lot about various internet protocols thanks to this.
Of course, at least all of the exploits aimed at 95 were just DoS attacks. BSOD and reboot. Contrast it to XP, which allows script kiddies to root the box and make it part of a botnet. I'm not aware of any remotely exploitable services in 9x that allowed that and even if they had the network stack was so unstable that the box would have crashed before too long ;)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.