Jump to content

#ifdef

Members
  • Content Count

    65
  • Joined

  • Last visited

  • Days Won

    1

Posts posted by #ifdef


  1. 5 hours ago, Brandon Staggs said:

    After CrowdStrike bricked thousands of PCs across the globe I don't know why anyone would be willing to trust it

    🔥

     

    My problem is exclusively and only in CrowdStrike (not in clients, and certainly not in Delphi), but in the absence of ways to influence CrowdStrike, I am now trying to remove the line using Delphi, that's all.

     

    It looks like I'm confusing cause and effect, I know, but I can't fight them alone 🙂


  2. In fact, the problem is idiotic, and it should not exist at all: CrowdStrike cannot even prove their false accusations (I asked what kind of danger this "wine_get_version" string carries and how exactly my application exploits it, but they, of course, ignored all my questions), but customers do not need any evidence from me — software from other providers successfully passes all checks, and my software is considered dangerous, and this is enough for any bureaucratic machine.

     

    I would never trust a heuristic that considers a file version to be an IPv4 address, and moreover — considers "0.0.0.0" to be a valid IPv4 address:

     

    9198657_36C7CC3A-2140-4067-B28C-4B004E4D1B08.png.aad4af1eb2d600959dfb5a3168aa78d3.png

     

     

    But "the customer is always right" 🥲


  3. Clients have a system for selecting the software they use: according to the rules and regulations, at the selection stage they are forced to give priority to software that is impeccable in terms of security. When selecting, they do not figure out whether the software is actually dangerous or not, the verdict of competent and proven online services is enough for them. If the online services unanimously recognize the file as safe, the software goes to the next stage, and so on. It's like a face control 🙂

     

    These are their rules, I cannot change them. All that is required of me is simply to comply with them and provide code that 100% passes any security checks.

     

     

     

    As is:

     

     image.thumb.png.20967eef5e14498ebad0bdfd10cb1a2c.png

     

     

     

     

     

    Should be:

     

    image.thumb.png.1a1be5b79b6bf1742c3df5d12c424a1c.png


  4. Of course, my code is signed:

     

    555422329_6755A5C0-78B1-4D59-95E5-62D484F3C108.png.d2ad53e71fa77dd08c8e3100106fbd73.png

     

     

     

    And it has always been signed:

     

    1875120863_8E995E75-E0E8-409C-B07A-38755E00FCD3.thumb.png.aeddd6bf541ea1d49a67dbfa0122cdd2.png

     

     

     

     

     

    And yes, I contacted CrowdStrike.

     

    Everything is useless, that's why I'm here.

     

    For the guys at CrowdStrike it doesn't matter how exactly the "wine_get_version" string is used — they hate the very fact of its presence, so by default they consider any executable file containing it to be "malicious". This is the root of the problem, but they don't see any problem with this approach and therefore have no intention of fixing it, they're completely fine with it 😑


  5. Ok, thank you.

     

    And how can I permanently remove the "wine_get_version" string from my EXE? Because with this string CrowdStrike considers my EXE "malicious":

     

    image.png.354716af174722ef859b55c9cabe2089.png

     

     

     

    ... but without this string (when I remove it in a HEX editor) it's just "suspicious"

     

    image.png.60be1e7082983c7c4419c0c92e1cb914.png

     

     

     

     

     

    I suspect that CrowdStrike has been reading others' blogs and set up a simple trigger for this string, thus shifting this burden from their head to mine, because Delphi adds this string to all EXEs by default 😞

     

    Right now, I'm patching each file, but what if I want to both get rid of the string and don't want to patch the file each time?


  6. Do you remember that show last summer? 😶

     

    Well. These same guys recently launched their own "VirusTotal" analog and, obviously, their new service is very stupid and dangerous too:

     

    1859803663_36C7CC3A-2140-4067-B28C-4B004E4D1B08.thumb.png.f4d2bfef683efe53cb146ef0977cfb83.png

     

    image.thumb.png.171861943060cf8790c7ff3590c180d5.png

     

     

     

     

     

    But I suppose it's gaining popularity and/or is being actively promoted, because recently some clients (suffering from a special form of paranoia) started complaining: "VirusTotal" and "Hybrid Analysis" have started marking my signed (say "Hi" to CrowdStrike!) app as malicious:

     

    1209955377_C9D295F2-F482-408A-BF41-430F659416C4.thumb.png.1b5b091913339bfabc9b788b4f5b3440.png

     

    1808649790_ECDE47E4-6837-4459-B04F-67C7897708CF.thumb.png.cb4f5f8e645e4115b47695e713303973.png

     

     

     

     

     

    As you can see, the problem is specifically with the "wine_get_version" string, which Delphi for some reason includes even in a completely empty EXE (to verify, you can create a new empty "VCL, 32-bit, Release" project without a single line of code):

     

    1899073429_9E76816C-C405-46FF-96B1-DEDC87508067.thumb.png.36a97ff131df0dc806083e4c3eb55bc7.png

     

     

     

     

     

    Of course I reported this to CrowdStrike, but these guys definitely know how to make a problem out of nothing:

     

    1792199599_5F43C942-D295-4C4B-ADD0-EC2BEFC58768.thumb.png.536d6077d792a0be854c325aea5c8160.png

     

     

     

     

     

    So... Any ideas why Delphi does this, and how to avoid it? I don't need the "IsWine" check from SysInit.pas, but I can't figure out how to disable it:

     

    690177514_EC4EF537-E1F5-4417-A3D8-826306A251C4.thumb.png.2a958323d1f81e8f0e4617a75d307fb3.png

     

     

     



    Yes, I know this string can be fixed in HEX, but I need a more reliable solution, I don't want to patch each of my files every release 🥲


  7. 2 hours ago, Die Holländer said:

    Yes, but its only resizing/displaying a small part of the text height, while the HTML is showing the entire text..

    I wonder what your user case is. Who is going to read that much text at once when you can't use pagination, etc..

     

    That's why I chose the TControlList — it allows to instantly move to any place, all that remains is to fix the fixed row height 🙂


  8. Yes, I'm sure :classic_smile:

     

    THtmlViewer + 10000 (start is ~5 seconds, resize is slow):

    unit Unit1;
    
    interface
    
    uses
      Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics, System.Math,
      Vcl.Controls, Vcl.Forms, Vcl.Dialogs, HTMLUn2, HtmlView;
    
    type
      TForm1 = class(TForm)
        HtmlViewer1: THtmlViewer;
        procedure FormCreate(Sender: TObject);
      private
        { Private declarations }
      public
        { Public declarations }
      end;
    
    var
      Form1: TForm1;
    
    implementation
    
    {$R *.dfm}
    
    function setCaption: string;
    var
      Lt: string;
      Li, Ll: integer;
    begin
      Ll := RandomRange(10, 1000);
    
      Lt := '';
    
      for Li := 1 to Ll do
        begin
          if (Random(10) = 0) and (Li < Ll) then
            begin
              Lt := Lt + ' ';
            end
          else
            begin
              if Random(2) = 0 then Lt := Lt + Chr(RandomRange(65, 90)) else Lt := Lt + Chr(RandomRange(97, 122));
            end;
        end;
    
      Result := Lt;
    end;
    
    procedure TForm1.FormCreate(Sender: TObject);
    var
      Li: integer;
      Ls: string;
    begin
      for Li := 1 to 10000 do Ls := Ls + '<div>' + Li.ToString + ': ' + setCaption + '</div><br>';
    
      HtmlViewer1.Text := Ls;
    end;
    
    end.

     

     

     

    TControlList + 10000 (start is ~1 second, resize is ok):

     

    unit Unit1;
    
    interface
    
    uses
      Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics, System.Math,
      Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ControlList;
    
    type
      TForm1 = class(TForm)
        ControlList1: TControlList;
        Label1: TLabel;
        procedure FormCreate(Sender: TObject);
        procedure ControlList1BeforeDrawItem(AIndex: Integer; ACanvas: TCanvas; ARect: TRect; AState: TOwnerDrawState);
      private
        { Private declarations }
      public
        { Public declarations }
      end;
    
    var
      Form1: TForm1;
      FList: TStringList;
    
    implementation
    
    {$R *.dfm}
    
    function setCaption: string;
    var
      Lt: string;
      Li, Ll: integer;
    begin
      Ll := RandomRange(10, 1000);
    
      Lt := '';
    
      for Li := 1 to Ll do
        begin
          if (Random(10) = 0) and (Li < Ll) then
            begin
              Lt := Lt + ' ';
            end
          else
            begin
              if Random(2) = 0 then Lt := Lt + Chr(RandomRange(65, 90)) else Lt := Lt + Chr(RandomRange(97, 122));
            end;
        end;
    
      Result := Lt;
    end;
    
    procedure TForm1.ControlList1BeforeDrawItem(AIndex: Integer; ACanvas: TCanvas; ARect: TRect; AState: TOwnerDrawState);
    begin
      Label1.Caption := FList[AIndex];
    end;
    
    procedure TForm1.FormCreate(Sender: TObject);
    begin
      FList := TStringList.Create;
    
      ControlList1.ItemCount := 10000;
    
      for var Li := 0 to ControlList1.ItemCount - 1 do FList.Add(Li.ToString + ': ' + setCaption);
    end;
    
    end.

  9. 23 hours ago, Die Holländer said:

    I started to display your test just in a THTML viewer.

    Nice, because you can continue to format the text with whatever you want (colors, fonts, etc)

    The wordwrap is very fast. Maybe you can even add an onClick in code to capture a click on one of the <div>

     

    
    procedure TForm1.BitBtn1Click(Sender: TObject);
    var
      idx: Integer;
    begin
      for idx := 1 to 10 do
      Begin
        HtmlViewer1.Text:=HtmlViewer1.Text+'<div>'+IntToStr(idx)+': '+setCaption+'</div><br>';
      End;
    end;

     

    image.thumb.png.25902d61d5a5628a4bc46c2813286f01.png

     

     

    HtmlViewer 10.2 is still available at: http://code.google.com/p/thtmlviewer/
    HtmlViewer 11.x is available at: https://sourceforge.net/projects/htmlviewer/
    HtmlViewer development is hosted at: https://github.com/BerndGabriel/HtmlViewer

    It looks really good, but on older computers 1000+ lines are too slow to render when resizing the canvas — and I can’t use pagination because the entire list must be available. But thanks anyway!


  10. 3 hours ago, Die Holländer said:

    Do you need to be able to edit/use the textblocks or is it just for display?

    No, I don't (anyway, TControlList is for TGraphicControl only).

     

     

    3 hours ago, Die Holländer said:

    word splitting = word wrap?

    Yes.


  11. 1 minute ago, Kas Ob. said:

    So these are TMemo(s) in the list ! not even simple and plain text lines in a list box.

     

    Anyway, same recommendation as for single Memo or ListBox, switch to owner drawing, then limit what you are using/rendering/showing to the visible ones, while simulate/emulate a scroll bar on the side, or it might support its own scrollbar, who knows.

    Nope. TControlList if for TGraphicControl only:

     

    image.thumb.png.6b74643b961fcae172065d21ffeeb4aa.png


  12. 11 minutes ago, Kas Ob. said:

    Se, same behavior is visible with Windows Notepad, you can try it, open a big text file something around few MBs and make sure that Word Wrap is enabled, and see for your self, same behavior, disabling the Word Wrap will make it fast like it was few lines.

    I know but... in Notepad++ everything is ok 🥲


  13. 1 hour ago, Serge_G said:

    So, I have a look and test with 11.3 and 12.1 (entreprise) and no slow comportment found. So, for me, you got it.🙌

    You said you use which version, community ok but last one (which is now a 11.2 or 11.3 version don't remember exactly ) ?

    As I see in your code, the key is the  TControlList.FHeights I never found (for my discharge, I just deep dive in this component at the first occurrence and never run back in it)

    Thank you for your kind words, but no, I don’t think I succeeded, that's why I decided to contact you personally 😞

     

    I have 11.3 CE (28.0.48361.3236), you are right, but it probably should look and work the same on 12.1: the problem occurs when the form changes size.

     

    What about the "FHeights" - it's just a temporary storage of row sizes (like a cache or something).


  14. On 8/9/2023 at 12:24 PM, Fr0sT.Brutal said:

    Hi!

    Do you mean postal addresses? If so, there's separate HUGE area that requires huge database. I'm not aware if OSM provides such API but they have the database and are able to search for an address.

    If there's a 3rd party service that converts an address to coords via REST or something, this is doable.

    Sorry, can't find your main topic here, so here is another GUI control pack for Delphi/Lazarus: https://github.com/Alexey-T/ATFlatControls

×