0patch Blog
blog.0patch.com · Company blog · on HN since 2018
0patch is a company that makes small binary patches for Windows flaws, and its blog covers micropatching of Microsoft and legacy software bugs.
What HN saysHN commenters recommend 0patch for keeping unsupported or end-of-life Windows systems secure at low cost, and praise its binary patch for Equation Editor.
22HN people shared it
12linked it in comments
11stories submitted
71story points
5 months agolast shared
2018people per year2026
Most-shared posts
- 1Did Microsoft Just Manually Patch Their Equation Editor Executable? (2017)7 people · 2 points · first shared 2018 · discussion on HN
- 2End of Windows 10 Support Looming? Don't Worry, 0patch Will Keep You Secure3 people · 2 points · first shared 2024 · discussion on HN
- 30patch Blog: No Source Code for a 14-Year Old Vulnerable DLL? No Problem1 people · 54 points · first shared 2019 · 6 comments on HN
- 4Micropatching “Ms-Officecmd” Remote Code Execution (No CVE)1 people · 3 points · first shared 2021 · discussion on HN
- 5Microsoft Edge Uses a Secret Trick and Breaks Internet Explorer's Security1 people · 2 points · first shared 2019 · discussion on HN
- 6The MSRD3X40 patch debacle1 people · 2 points · first shared 2018 · 1 comments on HN
- 7URL File NTLM Hash Disclosure Vulnerability (0day)1 people · 2 points · first shared 2024 · discussion on HN
- 8Analyzing and Micropatching with Tetrane Reven (Part 1, CVE-2021-26897)1 people · 1 points · first shared 2021 · discussion on HN
- 9Micropatching Brings the Abandoned Equation Editor Back to Life (2018)1 people · 1 points · first shared 2026 · discussion on HN
- 10Our First Weeks of Securing Windows 7 and Windows Server 2008 R21 people · 1 points · first shared 2020 · discussion on HN
- 11One Two Three Micropatches for Three Windows 0days1 people · 1 points · first shared 2019 · discussion on HN
- 12Homepage1 people · first shared 2020
- 13Keeping windows 7 and windows server1 people · first shared 2019
- 14Two more years of critical security1 people · first shared 2022
- 15Remote code execution vulnerability in1 people · first shared 2020
What HN people wrote when they linked it
Snowbirth · 2020-09-19
1472 patched here too
https://blog.0patch.com/
https://0patch.com/
Great for old systems where updating breaks stuff
ndiddy · 2026-05-26
If you look at the first binary patch for Equation Editor, it's very well done: https://blog.0patch.com/2017/11/did-microsoft-just-manually-patch-thei… . The problem was that when they fixed it once, other researchers started fuzzing Equation Editor and found many more bugs. Bringing a C++ program from 2000 up to modern security standards when you don't have the source code isn't really feasible, it would be an endless series of whack-a-mole binary patches. I don't really blame Microsoft for dropping support, especially when there's been a replacement equation editor in Office since 2007.
layer8 · 2025-01-02
There will be paid security updates from Microsoft [0], 0patch [1] (if you trust them), the LTSC version (which however takes you back to 21H2), and lastly you can still take your chances with just Windows Defender signature updates. I know a couple of people who still run Windows 7, including a security researcher (and not for research purposes), which still receives Microsoft Defender signature updates.
[0] https://learn.microsoft.com/en-us/windows/whats-new/extended-security-…
[1] https://blog.0patch.com/2024/06/long-live-windows-10-with-0patch.html
cookiengineer · 2024-12-01
CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns.
I remember some Windows Fax Service related CVEs and some Wi-Fi drivers that couldn't be fixed directly, too, but don't remember the CVE or whether that was related to the Broadcom driver/module sideloading fuckup.
> The link you gave just gives me a long list of patches.
The link I gave you is the only disclosure/advisory page that Microsoft offers, don't blame me for them not offering a better UI. Ask them to do better.
- https://nvd.nist.gov/vuln/detail/CVE-2017-11882
- https://blog.0patch.com/2017/11/did-microsoft-just-manually-patch-thei…
- https://cert.europa.eu/publications/security-advisories/2022-034/
thewrinklyninja · 2024-10-15
You could also get 0patch to keep it secure. They're adopting Windows 10 for security updated from the EOL date. Pretty reasonable price as well, around 30 euros per year.
https://blog.0patch.com/2024/06/long-live-windows-10-with-0patch.html
tr9f0tv · 2022-12-17
Windows Embedded POSReady 7
Extended Security Update Year 3 - End Date 2024-10-08
https://learn.microsoft.com/en-us/lifecycle/products/windows-embedded-…
and you also have 0patch
https://blog.0patch.com/2022/10/two-more-years-of-critical-security.ht…
Anunayj · 2021-12-16
I seem to remember Microsoft in the past also manually patched the binary for it because they probably lost the source code to it. [1]
[1] https://blog.0patch.com/2017/11/did-microsoft-just-manually-patch-thei…
jefftk · 2020-12-08
> I used the zoom native client and not the web one
You might want to reconsider that; they have a pretty bad security track record: https://www.securemac.com/news/zoom-security-flaw-puts-you-at-risk-eve… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1055 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1056 https://blog.0patch.com/2020/07/remote-code-execution-vulnerability-in…
icebraining · 2019-10-02
Seems like there's a company offering those patches to individuals: https://blog.0patch.com/2019/09/keeping-windows-7-and-windows-server.h…
As a Windows 7 user myself (on a personal computer) for whom upgrading seems clearly net negative, I'm tempted. Has anyone here used their stuff?
Bartweiss · 2019-07-18
So the specific story I was referring to was an obscure security fix to their equation editor in binary, rather than source. The impressive bit wasn't just editing a binary but patching a bunch of security holes without altering any other instructions: https://blog.0patch.com/2017/11/did-microsoft-just-manually-patch-thei…
That said, I'll bet this kind of 10x programming is genuinely rarer these days. Not because programmers have gotten worse, but because new tools and relaxing hardware constraints make this sort of near-metal optimization less necessary and less valuable. The sort of data-reuse hacks that made e.g. Pokemon Red/Blue possible would just be a pointless headache today, so those same skills are getting spent on code golf instead.
therein · 2018-08-31
> Remember that in some cases people don't have the source code for programs, or the tools that could build it. Microsoft preserves that.
And even if they failed to preserve the source code or the toolchain for whatever reason, they go to extreme lengths to get fixes in:
https://blog.0patch.com/2017/11/did-microsoft-just-manually-patch-thei…