Patrick's System32 Deletion Trick
Patrick knows how to delete System32, a feat that many thought was impossible. This example serves as a reminder of how assumptions and folk knowledge can be wrong, and how humbling it can be to learn the truth. Windows File Protection is also discussed.
![Author profile image](https://pbs.twimg.com/profile_images/1640099481084411907/cRDGyLV1_normal.jpg)
📺Out Of Context SwiftOnSecurity📺😵💫
computer security person at a place. former helpdesk. they/them/tay. Microsoft MVP, Client Security @SwiftOnSecurity@infosec.exchange
-
Patrick knows how to actually delete System32. Patrick is good at his job.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
(In seriousness, I thought Windows File Protection would have intervened for integrity, but who knows if they maintain that for new files anymore. Last time I saw that trigger was XP.) https://t.co/j0GyumwMee -
This is a GREAT example of how people like me, who think they know something about the integrity of a system based on experiences a decade+ ago can fall to people just... seeing if an assumption or folk knowledge is actually true.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
Prepare for a humbling. -
(This is NOT about @KaoAtlantis)
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
I've found there are situations you need to tell a mentee/junior person, "no that's not possible" to guide them to the right answer.
But often... you should just let them find out and gain muscle. Your relationship is not to flatter yourself. -
🧵...Here's another in the series of" IT Experiences That Made Me Who I Am."
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
I work for a fairly large firm that does backoffice stuff for many major firms around the country. Reps in every state.
Randomly, people's fonts would turn italic. A lot of Windows interfaces. Italic. -
This "bug" has been going on for years. windows XP system fonts turning italic.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
Here's the critical bit: It doesn't _stop_ anyone from doing their job. It doesn't cause errors. It's just... what the hell? And nobody even asked because it was folk knowledge Helpdesk didn't care. -
Well I arrive and I'm young and eager and this just annoys the ****ing shit out of me when I'm remote-controlling machines to fix them.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
Eventually I get a laptop from someone who retired with this problem. I login as myself. I'm going to ****ing figure this out.
Look @ settings -
(Clarification: Former employer I'm talking about)
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
XP was adaptable and let you change interface fonts very liberally. I had modded XP shell, so I was very familiar with this. You went to settings, everything was set to Arial Italic.
And (trying to remember) there was no Arial. -
I don't fully understand fonts, nobody who thinks they do actually does. But Arial Italic for some reason was a different font.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
So I go looking for Arial in the Fonts folder. It's not there. Wtf? This is a core system file. It comes in Windows.
No way to find out what happened. -
Months/year later I'm helping a tech with one of the pieces of software we sell. I determined a service was screwing with the system and they didn't need it, so whatever easy fix kill it.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
We remove it and reboot.
Everything is italic. What. The. Fuck.
(Going to start swearing) -
I go to the team who makes this software. They're just coders. They have no idea how to make a Windows installer. They needed to move to another installer system.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
So what they did was make a recording of everything the installer touched and recorded that into their own installer -
TURNS THE FUCK OUT the installer recorder noticed their old installer relies on the Arial font. That's fine.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
SO NEW UNINSTALLER REMOVES THE ARIAL FONT ON EVERY SYSTEM ON PRODUCT UNINSTALL. And XP, missing that, would go to next interface font, which was
Arial. Fucking. Italic. -
The software was embedded dedicated-PC stuff shipped as-is to customers. IT WAS NEVER UNINSTALLED EVER IN THE FIELD. And if it was, it was full screen, nobody would notice XP fonts being screwed.
— SwiftOnSecurity (@SwiftOnSecurity) April 4, 2023
BUT SALES AND SERVICE PEOPLE DID UNINSTALL IT.
AND IT MADE EVERYTHING ITALIC.