Visual Studio does have a really nice C++ debugger - one would imagine the C++ debugging capabilities should translate to Rust.

Hot code reloading, and incremental linking would be great, given the build times.

Given the cost of openweight frontier models like Kimi I’m fairly sure the token prices actually make some money.

> This has nothing to do with ntdll at all.

I can only wonder where `NtMapViewOfSection` could be exported from...

Yeah, but the link talks about `ZwMapViewOfSection`. From that page:

> For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters.

How "differently" exactly? That's undocumented. And lots of other small (but very important) details are undocumented as well.

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg ZwMapViewOfSection

       2072  80F 001612B0 ZwMapViewOfSection

       2073  810 00163160 ZwMapViewOfSectionEx

> PS C:\Program Files\Microsoft Visual Studio\18\Community> dumpbin.exe /EXPORTS C:\Windows\System32\ntdll.dll | rg NtMapViewOfSection

        425  1A0 001612B0 NtMapViewOfSection

        426  1A1 00163160 NtMapViewOfSectionEx

> How "differently" exactly? That's undocumented.

https://learn.microsoft.com/en-us/windows-hardware/drivers/k...

I wonder how they handle merging upstream clanked stuff.

I guess Hex-Rays and Vector35 must be hallucinating their effects for, say, reverse engineering. OFC rev isn't be all and end all of computing but the effect LLMs had on security research and adjacent spaces (say, CTF) is interesting

https://github.com/HexRaysSA/ida-nexus

https://sidekick.binary.ninja/

In addition a bunch are documented in the driver docs, such as https://learn.microsoft.com/en-us/windows-hardware/drivers/d....

> If the call to this function occurs in user mode, you should use the name "NtMapViewOfSection" instead of "ZwMapViewOfSection".

Memories break Fable 5 for me as well in chatbot. I ask Opus a lot of sec related stuff and now if I even type “hello” in chat it gets insta-downgraded to Opus 5.

Wow, that's totally crazy. Does it happen even if you clear out the "offending" memory entries?

Assuming you want to preserve the same functionality of drivers, how would giving the userspace RGB controller driver the same set of tools (usually fun things like physical memory RW) change anything?

Just like microkernels, or macOS for that matter, where all drivers are being pushed out of the kernel.

Outside desktop, they are pretty much around on embedded RTOS, and the Switch.

Microsoft did break backwards compatibility with some drivers (packed stuff that relied on being able to write to executable sections, for instance) w/ HVCI and then with some other stuff (for instance, drivers using push+ret for obfuscating function calls + some exception handling related machinery some virtualization based obfuscators used) with KCET.

With that being said virtualization based security is not mandatory, though compliance is needed for signing new drivers (note: this is funky too and some drivers will do HVCI-noncompliant things when it’s disabled, like some anticheat drivers hooking #PF to more efficiently catch unsigned code execution in HVCI-free scenario). I think next backwards compatibility breaking move will be enabling SMAP.

Technically the hardware threshold is sort of real for making virtualization based security usable and useful.

Exactly, it was the whole set of virtualisation based security that is optional in Windows 10, and was made compulsory on Windows 11.