傲游“马上看”是怎样实现的？

fffonion

11 年前

其实就是变速齿轮orz

一开始因为大幅度的宣传，总觉得应该是傲游什么独创的技术，就想是不是改了webkit的定时器，因为我看到js里的setTimeOut也缩短了时间

但是后来发现了猫腻，按住很长时间的快进按钮之后，js运行new Date().toLocaleTimeString();与系统时间产生了较大的偏差。这就说明了并不是改了自己的定时器，而是钩住了自己进程的一些API

用IDA打开MxVodCtrl.dll，看到的确Import了SetWindowHookExW。然后挖着挖着挖到了这些东西（见文末）。

和变速齿轮不同的是还hook了音频输出，因为游戏画面和bgm本来就可以不同步，但视频和音频肯定要同步。

之后还有UnHook，似乎是在标签关闭之后触发

既然是和浏览器内核无关的技术，想必不久之后就有各种浏览器山寨出来了。但靠着之前的大幅宣传，傲游显然已经赢了一笔2333333

附：

.text:1011D290
sub_1011D290  proc near        ; DATA XREF: .rdata:1011FD10o
    push  offset aWaveoutgetplay ; "waveOutGetPlaybackRate"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F360, eax
    retn
sub_1011D290  endp

.text:1011D2B0
sub_1011D2B0  proc near        ; DATA XREF: .rdata:1011FD14o
    push  offset aWaveoutwrite ; "waveOutWrite"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F364, eax
retn
 sub_1011D2B0  endp

.text:1011D2D0
sub_1011D2D0  proc near        ; DATA XREF: .rdata:1011FD18o
    push  offset aGettickcount ; "GetTickCount"
    push  offset aKernel32_dll_2 ; "kernel32.dll"
    call  sub_10110B19
    mov   dword_1016F368, eax
retn
sub_1011D2D0  endp

.text:1011D2F0
sub_1011D2F0  proc near        ; DATA XREF: .rdata:1011FD1Co
    push  offset aTimegettime ; "timeGetTime"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F36C, eax
    retn
sub_1011D2F0  endp

.text:1011D310
sub_1011D310  proc near        ; DATA XREF: .rdata:1011FD20o
    push  offset aQueryperforman ; "QueryPerformanceCounter"
    push  offset aKernel32_dll_3 ; "Kernel32.dll"
    call  sub_10110B19
    mov   dword_1016F370, eax
    retn
sub_1011D310  endp

.text:1011D290

sub_1011D290 proc near ; DATA XREF: .rdata:1011FD10o

push offset aWaveoutgetplay ; "waveOutGetPlaybackRate"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F360, eax

retn

sub_1011D290 endp

.text:1011D2B0

sub_1011D2B0 proc near ; DATA XREF: .rdata:1011FD14o

push offset aWaveoutwrite ; "waveOutWrite"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F364, eax

retn

sub_1011D2B0 endp

.text:1011D2D0

sub_1011D2D0 proc near ; DATA XREF: .rdata:1011FD18o

push offset aGettickcount ; "GetTickCount"

push offset aKernel32_dll_2 ; "kernel32.dll"

call sub_10110B19

mov dword_1016F368, eax

retn

sub_1011D2D0 endp

.text:1011D2F0

sub_1011D2F0 proc near ; DATA XREF: .rdata:1011FD1Co

push offset aTimegettime ; "timeGetTime"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F36C, eax

retn

sub_1011D2F0 endp

.text:1011D310

sub_1011D310 proc near ; DATA XREF: .rdata:1011FD20o

push offset aQueryperforman ; "QueryPerformanceCounter"

push offset aKernel32_dll_3 ; "Kernel32.dll"

call sub_10110B19

mov dword_1016F370, eax

retn

sub_1011D310 endp