I ruined my vacation by reverse engineering WSC

But this isn't about the binaries. It's where definitions and configuration are stored. It's C:\ProgramData, not C:\Program Files.

The system also can't object too severely. Third party endpoint protection exists.

> The part of the system that manages all this mess is called Windows Security Center - WSC for short.

[Edit - could be Capture The Flag?]

I think the only bit I don't like personally is the syntax. I normally implement defer as a macro to keep things clean. If done correctly it can look like a keyword: `defer []{ something(); };`.

   defer->void { CoUninitialize(); };

   auto _defer_instance_1234 = Defer{} % [&]()->void { CoUninitialize(); };

* auto means infer the type of this local variable from the expression after the =.

* Defer{} means default construct a Defer instance. Defer is an empty type, but it allows the % following it to call a specific function because...

* Defer has an overloaded operator%. It's a template function, which takes a callable object (type is the template parameter Callable) and returns a DeferHolder<Callable> instance.

* [&]()->void { /*code here*/ }; is C++ syntax for a lambda function that captures any variables it uses by address (that's the [&] bit), takes no parameters (that's the () bit) and returns nothing (that's the ->void bit). The code goes in braces.

* DeferHolder calls the function it holds when it is destroyed.

It's subjective but some (including me!) would say it's cursed because it's using a macro to make something that almost looks like C++ syntax but isn't quite. I'm pretty confident with C++ but I had no idea what was going on at first (except, "surely this is using macros somehow ... right?"). [Edit: After some thought, I think the most confusing aspect is that defer->void looks like a method call through an object pointer rather than a trailing return type.]

I'd say it would be better to just be honest about its macroness, and also just do the extra typing of the [&] each time so the syntax of the lambda is all together. (You could then also simplify the implementation.) You end up with something like this:

   DEFER([&]()->void { CoUninitialize(); });

   DEFER({ CoUninitialize(); });

I personally don't find it that cursed, but for many old C++ heads this may be an overwhelming smell - adding a class to implement what should be a language feature may tweak some folks' ideology a bit too far.

So you can abuse this mechanic to 'register' things to be executed at the end of the current scope, almost no matter how you exit the current scope.

Perhaps your hardware, when connected to a network, has real effects on the rest of that network. What if your system joined a botnet and began DDOS activities for payment? What if your system was part of a residential proxy network, and could be rented in the grey market for any kind of use or abuse of others' systems? What if your system became a host for CSAM or copyright-violating materials, unbeknownst to you, until the authorities confiscated it?

And what if your hardware had a special privileged location on a corporate network, or you operated a VPC with some valuable assets, and that was compromised and commandeered by a state-level threat actor? Is it still "your hardware, your choice"? Or do your bad choices affect other people as well?

I found one such switch: Install Linux