傲遊「馬上看」是怎樣實現的？ ; 論野生技術&二次元

其實就是變速齒輪orz

一開始因為大幅度的宣傳，總覺得應該是傲遊什麼獨創的技術，就想是不是改了webkit的定時器，因為我看到js里的setTimeOut也縮短了時間

但是後來發現了貓膩，按住很長時間的快進按鈕之後，js運行new Date().toLocaleTimeString();與系統時間產生了較大的偏差。這就說明了並不是改了自己的定時器，而是鉤住了自己進程的一些API

用IDA打開MxVodCtrl.dll，看到的確Import了SetWindowHookExW。然後挖着挖着挖到了這些東西（見文末）。

和變速齒輪不同的是還hook了音頻輸出，因為遊戲畫面和bgm本來就可以不同步，但視頻和音頻肯定要同步。

之後還有UnHook，似乎是在標籤關閉之後觸發

既然是和瀏覽器內核無關的技術，想必不久之後就有各種瀏覽器山寨出來了。但靠着之前的大幅宣傳，傲遊顯然已經贏了一筆2333333

附：

.text:1011D290
sub_1011D290  proc near        ; DATA XREF: .rdata:1011FD10o
    push  offset aWaveoutgetplay ; "waveOutGetPlaybackRate"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F360, eax
    retn
sub_1011D290  endp

.text:1011D2B0
sub_1011D2B0  proc near        ; DATA XREF: .rdata:1011FD14o
    push  offset aWaveoutwrite ; "waveOutWrite"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F364, eax
retn
 sub_1011D2B0  endp

.text:1011D2D0
sub_1011D2D0  proc near        ; DATA XREF: .rdata:1011FD18o
    push  offset aGettickcount ; "GetTickCount"
    push  offset aKernel32_dll_2 ; "kernel32.dll"
    call  sub_10110B19
    mov   dword_1016F368, eax
retn
sub_1011D2D0  endp

.text:1011D2F0
sub_1011D2F0  proc near        ; DATA XREF: .rdata:1011FD1Co
    push  offset aTimegettime ; "timeGetTime"
    push  offset aWinmm_dll_0 ; "winmm.dll"
    call  sub_10110B19
    mov   dword_1016F36C, eax
    retn
sub_1011D2F0  endp

.text:1011D310
sub_1011D310  proc near        ; DATA XREF: .rdata:1011FD20o
    push  offset aQueryperforman ; "QueryPerformanceCounter"
    push  offset aKernel32_dll_3 ; "Kernel32.dll"
    call  sub_10110B19
    mov   dword_1016F370, eax
    retn
sub_1011D310  endp

.text:1011D290

sub_1011D290 proc near ; DATA XREF: .rdata:1011FD10o

push offset aWaveoutgetplay ; "waveOutGetPlaybackRate"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F360, eax

retn

sub_1011D290 endp

.text:1011D2B0

sub_1011D2B0 proc near ; DATA XREF: .rdata:1011FD14o

push offset aWaveoutwrite ; "waveOutWrite"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F364, eax

retn

sub_1011D2B0 endp

.text:1011D2D0

sub_1011D2D0 proc near ; DATA XREF: .rdata:1011FD18o

push offset aGettickcount ; "GetTickCount"

push offset aKernel32_dll_2 ; "kernel32.dll"

call sub_10110B19

mov dword_1016F368, eax

retn

sub_1011D2D0 endp

.text:1011D2F0

sub_1011D2F0 proc near ; DATA XREF: .rdata:1011FD1Co

push offset aTimegettime ; "timeGetTime"

push offset aWinmm_dll_0 ; "winmm.dll"

call sub_10110B19

mov dword_1016F36C, eax

retn

sub_1011D2F0 endp

.text:1011D310

sub_1011D310 proc near ; DATA XREF: .rdata:1011FD20o

push offset aQueryperforman ; "QueryPerformanceCounter"

push offset aKernel32_dll_3 ; "Kernel32.dll"

call sub_10110B19

mov dword_1016F370, eax

retn

sub_1011D310 endp