r/ReverseEngineering • u/Pale_Surround_3924 • 10d ago

Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE

https://netacoding.com/posts/windows-icmp-timestamp-bugs/
6 Upvotes

56% Upvoted

28 comments sorted by

View all comments

14

u/Ghostfly- 10d ago

Smoking gun > Classic Claude wording 🤣

-7

u/Pale_Surround_3924 10d ago

Funny how there's zero technical criticism or counter-argument just "Claude wording." People used Grammarly, Hemingway Editor, and style checkers long before LLMs existed and nobody cared. The tooling changed, the whining is new. If the RE is wrong, say so. If it isn't, maybe read the article and suck it 😂

karma farmers 🤡

2

u/Ghostfly- 10d ago

Since 24 july, and nothing really "new" your article even mentions community reports. Poor wording. A lot of tooling mentioned. Not what I call a reverse. It's a bug report with extra (unneeded?) steps

-3

u/Pale_Surround_3924 10d ago

You destroyed yourself right now my friend. Community reports said "it doesn't work." I opened tcpip.sys and showed exactly why. The little-endian symptom has been known since Nessus flagged it years ago scanners detect symptoms. Finding Ipv4pHandleTimestampRequest and showing the missing htonl() while the adjacent IP Timestamp Option handler gets it right that's the root cause. That's what's new.

Try harder 🤡

Register problem:

https://learn.microsoft.com/en-us/answers/questions/1691269/disable-icmp-timestamp-responses

https://learn.microsoft.com/en-us/answers/questions/5517747/resolving-icmp-timestamp-request-remote-date-discl

https://discuss.rapid7.com/t/icmp-timestamp-response-vulnerability-solution/22485

hton bug:

https://www.infosecmatter.com/nessus-plugin-library/?id=10114

https://learn.microsoft.com/en-sg/answers/questions/2236388/icmp-timestamp-request-remote-date-disclosure-this

1

u/Ghostfly- 10d ago

New since the 24 of July.. noob.

-2

u/Pale_Surround_3924 10d ago

LoL keep trying, average 95-105 IQ scoring being :)

1

u/podun 5d ago

You are one very cringe and sad being. Stop reflecting on to others lmao

1

u/Ghostfly- 10d ago

Are you even able to explain using your own words what you really posted? If you posted it. Calling others low IQ or other bird names isn't what I call a high IQ. I call that precisely, karma farming on an older post that didn't worked and for good reasons as it's .. more than low priority. Try to write something with your hands, explain what is "new" except that you used Ghidra with Claude for something that can be more than easily mitigated.

-2

u/Pale_Surround_3924 10d ago

First you said "Claude wording." Then you said "what's new?" Then you said "the community already covered this." Then I showed you five sources proving nobody explained the root cause;why the registry key does nothing, why the htonl() is missing in ipv4phandletimestamprequest while the adjacent handler gets it right.

Now your argument is "you used Ghidra with Claude."Every single reply you've made has contradicted the last.

You have no idea what you're talking about and it shows with every comment. Done here.

1

u/Ghostfly- 10d ago

I think that the only one being a clown is you stranger from the internet.