编程与软件工程kylehalladay.com
在记事本中以 30 FPS 实现光线追踪
Ray tracing in notepad.exe at 30 FPS
2020 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
作者展示了如何在记事本里以 30 FPS 实现光线追踪：把记事本的编辑控件当作输出设备，通过修改其内存中的文本缓冲区来逐行绘制图像。文章演示了用 Cheat Engine 等工具定位并操作另一个进程内存的完整过程。
为什么经久不衰：它把'跨进程内存操作'这种黑客技巧用最意想不到的方式呈现，兼具娱乐性和教学价值，是理解 Windows 进程间交互的经典案例。
HN 评论精选
从这类 hack 中总结出无障碍接口的价值、平台安全收紧的趋势，以及'尽量用高层手段'的实践原则。
这类 hack 很有趣，但有几个值得思考的点：一是支持无障碍或脚本接口的应用非常重要，它们让其他程序能以你从未想象过的方式与之交互；二是出于安全考虑，各平台一直在收紧跨应用访问，读写进程内存如今是大忌，有些系统甚至会完全禁止；三是做这类事情时应尽量找'最高层'的手段——优先用应用自带功能，其次是无障碍 API，再是调用二进制中的函数，最后才碰内存数据结构，因为高层 API 更不容易破坏程序内部状态。
saagarjha查看英文原文
Hacks like these are fun; but there's a number of interesting takeaways from something like this. One is that applications supporting accessibility or scripting interfaces are really, really important: they let other apps interact with your program in ways you may have never imagined, "for free". Another is that platforms have been locking down on cross-application access for quite a while, for security reasons. Reading or writing a process's memory is a big no-no these days, since it effectively lets you inherit the privileges of that application, and some operating systems will prevent you from doing it altogether no matter how much privileges you have. The latter operating systems have also begin to lock down the APIs that give programmatic control as well, which is somewhat sad… Finally, when doing things like this try to see if you can find the "highest level" to do such hackery at. Ideally, the app has functionality built-in to do what you want, and if that doesn't work see if the accessibility APIs can help. Then see if you can find functions in the binary to call, and then as a last resort you can touch data structures in memory. This is because using higher-level APIs is more likely to keep things working: you might be changing the string in memory, but some code at a "higher level" might not expect that and misbehave. Perhaps it cached the string's length or thinks it has exclusive access to that memory so it overwrites your modifications. Have fun with your hacks, but be careful!
怀念沙箱化之前那种可以直接检查和修改任意 Windows 程序的自由。
我很高兴这个 demo 存在，因为它展示了现代沙箱安全正在扼杀的东西之一。小时候我用 Spy++ 玩 Windows 玩得很开心：共享软件禁用了'继续'按钮？我直接进去重新启用它。它就像 Windows 本身的 DOM 检查器。后来我用这些技能把一个 Firefox 扩展移植到 IE 上，虽然做出来了，但讽刺的是项目最后死于安装程序做不好。
tomc1985查看英文原文
I am so glad this demo exists, because it identifies one of the many great things that modern sandbox security is trying to destroy I had a lot of fun as a kid fucking with Windows in Spy++. Oh your shareware program disabled the "Continue" button?? Let me just go in there and reenable it. It was like the DOM inspector but for Windows itself. Later I got to use these skills to port a Firefox addon to Internet Explorer. It was a contraption, and it worked. Ironically that project died because I couldn't get the installer to work right
分享 Detours 库的趣闻：微软为修复自家 API 的无障碍缺陷而造的钩子库，同时带有防滥用的检测痕迹。
我多年前做扑克机器人时做过 Windows 钩子/劫持。有趣的是，微软研究院为无障碍需求编写的 Detours 库是当时最常用的 Windows API 钩子库。有些 Windows API 会把文字直接按位图渲染到屏幕上，导致无法读取文本，这会破坏屏幕阅读器——于是微软只好再造一个库来'修复'自己的 API，我觉得很滑稽。另外该库在客户端有足够权限时能被检测到，像暴雪这样的公司知道如何发现你在用 Detours。
milesvp查看英文原文
I did some windows hooking/hijacking years ago when I was working on a poker bot, and found that I couldn't get access to some text output of the poker client. Fun fact. The C++ hooking library I found, Detours, which at the time was the most common (only?) library for hooking windows API calls. It was written by microsoft research for accessibility reasons. There are 2 windows API functions (maybe more) that will render text to the screen basically as a bmp making it impossible to gain access to the text being written. Not sure if this was an oversight by the MS windows group, or it was intentional to allow for developers to obfuscate text output in various ways. Thing is, this breaks screen readers. So microsoft got to create a library that unbreaks their API, which I personally found very amusing at the time. Also you should know, that the library makes it obvious it's being used if the client has enough privileges. I don't remember the details because I never needed to care. But it's some combination of adding a process in task manager, and making an obvious fingerprint in memory. I think this was to appease complaints of use by more nefarious purposes than screen readers. My understanding is that companies like Blizzard know how to find you're using detours, if you don't go out of your way to modify the library before compiling it. https://www.microsoft.com/en-us/research/project/detours/
质疑直接发 WM_SETTEXT 消息可能比改内存更简单，但理解作者意在演示 Cheat Engine 的用法。
很喜欢这篇文章，不过我想问：通过 WindowFromPoint 拿到编辑控件的 HWND 然后发 WM_SETTEXT，岂不是比翻内存更简单？我猜重点可能在于学习如何用 Cheat Engine 实际地 hook 东西，这更符合作者其他文章的风格。
anaisbetts查看英文原文
Love this though I have to ask, wouldn't getting the HWND of the Edit Control via WindowFromPoint and sending WM_SETTEXT be easier than digging through memory? I guess the point may be to learn how Cheat Engine can be used in a practical way to hook things which is definitely more along the lines of some of the author's other posts!
历次讨论
同类还值得读
开源应用架构
The Architecture of Open Source Applications
《开源软件架构》（AOSA）是一本在线免费书，邀请知名开源项目的作者亲自剖析其内部设计，涵盖 SQLAlchemy、LLVM、Audacity、Apache、Bash 等系统。
编程与软件工程上首页 9 次 · 2011–2024aosabook.org编辑精选编程语言简史：简短、不完整且多半错误
A Brief, Incomplete, and Mostly Wrong History of Programming Languages
一篇以戏谑、故意不准确的方式回顾编程语言史的博客文章，用夸张轶事和讽刺定义串起 Lisp、C、C++、Java、JavaScript、PHP 等语言。
编程与软件工程上首页 8 次 · 2009–2021james-iry.blogspot.comSQLite 是如何测试的
How SQLite is tested
SQLite 官方文档页，系统介绍 SQLite 的测试体系：多种测试方法（TCL 测试、模糊测试、回归测试、静态分析等）和海量测试用例，展示了这个小型开源项目如何靠极致测试获得…
编程与软件工程上首页 8 次 · 2009–2025sqlite.org编辑精选高级编程语言（2009）
Advanced programming languages (2009)
Matt Might 的经典文章，按用途推荐“高级编程语言”：如果追求就业就选主流语言，如果追求表达力、学术研究或创业，则推荐 Haskell、OCaml、Scala 等函数式语…
编程与软件工程上首页 8 次 · 2009–2022matt.might.net我的 Forth 与栈机器经历
Yosefk - My history with Forth & stack machines
作者以亲身经历回顾了使用 Forth 语言和栈式机器的历程：既赞叹其简洁优雅、代码量小、可自举的优点，也坦率指出栈操作在实际编程中的痛苦，以及 Forth 社区文化中的问题。
编程与软件工程上首页 8 次 · 2010–2024yosefk.com编辑精选