K4YT3X

K4YT3X https://k4yt3x.com/how-to-rename-firefoxs-profile-path/ -TL;DR

Prerequisite: install mozlz4.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 cd ~/.mozilla/firefox # the current profile directory's name and the target profile directory name ORIGINAL_NAME='abcd0efg.default-release' TARGET_NAME='k4yt3x' # replace path name references in text files mv "$ORIGINAL_NAME" "$TARGET_NAME" sed -i "s/$ORIGINAL_NAME/$TARGET_NAME/g" installs.ini sed -i "s/$ORIGINAL_NAME/$TARGET_NAME/g" profiles.ini sed -i "s/$ORIGINAL_NAME/$TARGET_NAME/g" "$TARGET_NAME/pkcs11.txt" sed -i "s/$ORIGINAL_NAME/$TARGET_NAME/g" "$TARGET_NAME/extensions.json" # decompress the addonStartup.json, replace the strings, and re-compress cd "$TARGET_NAME" mozlz4 -x addonStartup.json.lz4 > addonStartup.json sed -i "s/$ORIGINAL_NAME/$TARGET_NAME/g" addonStartup.json mozlz4 -z addonStartup.json addonStartup.json.lz4 rm addonStartup.json

My Firefox is heavily customized with dozens of extensions and settings spread across multiple configuration files such as user.js and perf.js. It is, thus, not practical for me to migrate my Firefox profile to a machine while ensuring that all settings are synchronized and that it will behave exactly the same way if I were to rely on Firefox’s built-in Sync. The most reliable and efficient, albeit slightly “hacky” way, to migrate my Firefox profile to machine is, therefore, to straight up copy the entire profile to the new machine. There might be a more elegant way to do this, but until then, this will be the method I have to rely on. Additionally, this approach also makes it easy to reliably synchronize all of my few hundreds of tabs over to a different machine.

While I was synchronizing the profile, I noticed that Firefox made a default name and path for the profile. The profile name I got is a random string (yrdz6hff.default-release) generated based on how stars were aligned the day I created the profile. I’d rather not having to embed this random string in my automation scripts and etc., so I decided to look into changing it. This string is used both as the displayed profile name in Firefox and the name of the profile’s directory on the file system.

The profile’s name can be easily changed in the about:profiles page:

However, the same cannot be said about the profile’s directory name on the file system. On my Arch Linux system, Firefox’s profile is located under .mozilla/firefox/$PROFILE_NAME. If you simply rename the directory, Firefox will not be able to find the profile anymore and will simply make a new profile for you. Thus, we will need to change Firefox’s configurations so the profile-related configurations point to the right path.

In order to find out which files we need to change, we can use ripgrep to list all the files that contain the profile’s name under Firefox’s profiles directory. The following command lists all files that contain the profile name’s string, including binary files:

Let’s first rename the profile’s directory and then replace all occurrences of yrdz6hff.default-release in all text files. In this example, I’ll rename my profile directory’s name to k4yt3x:

Let’s try and start Firefox. Unfortunately, we’ll see that the extensions are broken:

The broken extensions and the fact that we did not change addonStartup.json.lz4 provides a pretty clear hint that this file may be causing the troubles. In fact, this file is, indeed, the culprit. We will need to update the content of this file as well. However, this file is compress in an uncommon format used by Firefox named mozlz4. It cannot be decompressed by Linux utilities such as lz4 or 7z.

In order to decompress and re-compress the addonStartup.json file, we will need a tool named mozlz4. This tool is available on AUR in the name of mozlz4 and mozlz4-bin. If your platform’s repository does not have it, you can download the compiled binaries on their GitHub releases page. After getting the tool, you can use the following commands to decompress the file, update its content, and re-compress the file:

Now, if we start Firefox again, we will see that all the extensions load correctly again:

There you have it. I hope this post would help whomever that also happens to need to do the same hacky thing. If you notice that something isn’t working after this modification or if there are other files that should be updated as well, please reach out and I’ll update this guide.

- https://k4yt3x.com/how-to-rename-firefoxs-profile-path/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E5%80%9F%E7%BB%9D%E5%8C%BA%E9%9B%B6%E8%B0%88%E8%B0%88%E6%B0%AA%E9%87%91%E6%8A%BD%E5%8D%A1%E6%B8%B8%E6%88%8F/ -0x00 前言

我最近买了 Binary Ninja 的个人版，又想学学内核反作弊的绕过技巧和 ReClass.NET、Cheat Engine 等工具的「高端」用法，所以我选择找一款新的、带有线上部分但又不包含玩家间竞技的游戏来当我的小白鼠。最近刚上线的绝区零就这么成了我的受害者。虽然我知道氪金游戏的存在，也读过一些关于所谓「服务型游戏」骗氪和留存玩家的手法，但是绝区零里琳琅满目花样百出的手法还是着实给我这个刚接触氪金手游的人带来了不小的震撼，以至于我读完几小时汇编以后坐在电脑前还写完了这整篇文章。

那么这篇文章我们那就来讲讲绝区零的方方面面，从美术到动画、从游戏内容到游戏性、从氪金到捕鲸，希望各位读完后能对这类游戏有更深的认识。

虽然我通过这款游戏学习了不少作弊与反作弊相关的技巧和知识，但那不是本文的内容，有可能未来会专门出一些技术相关的文章。在本文中我只想简单聊聊绝区零这款游戏的几个方面。本来我只打算写很短的内容放在 Telegram 频道上就完事了，但是越写越多所以想想还是放在 blog 上好了。在正文前，我重申这是我玩过的第一部米哈游，或者说国内氪金抽卡手游作品，所以如果文章中有错误还请海涵或联系我纠正。

0x01 定位、市场与道德

在我们开始讨论氪金和游戏性问题前，我需要首先点明，绝区零这款游戏的定位从一开始就是面向大部分群众、快餐化、基于手机平台的这类市场，要求其拥有最后生还者 II 的 Inverse Kinematics、只狼的难度和 NieR:Automata 的故事深度可能是不合适也不现实的。这些游戏的「缺陷」可能并非是游戏公司能力的不足，而是游戏公司对于市场的需求做出的取舍与选择。倘若所有游戏玩家都有硕士学位，都只需要每周在家上四天班，每天上班六小时，我相信现在的游戏市场会有很大的不同。

追逐利润是公司的第一目标，而如今氪金游戏充斥市场的原因也很明显——它们能让背后的游戏公司赚很多钱。氪金游戏出现的合理性并不能为其带来道德上的正当性，因为氪金游戏与赌博一样，都会利用人性的弱点让消费者掏空钱包，充进一个又一个的 648。氪金游戏可能更甚于传统赌博，利用了更多的心理学现象来达成目的。

作为消费者，我希望能避免消费陷阱，即是为了不浪费钱，也是为了不给制作劣质游戏仅靠歪门邪道敛财的缺德游戏公司提供收入；作为社会的一部分，我相信游戏在社会中能发挥出强大的力量，因此我也希望游戏行业健康发展，让我能玩到下一个 NieR:Automata 和 SIGNALIS。因此，我希望赞许米哈游近些年在一些方面进步的同时，用绝区零浅谈一下氪金问题。

0x02 美术与动画

近些年来国产游戏如井喷般出现，开发团队的能力、资金和资源参差不齐，游戏成品的质量自然也良莠不一。这种差距体现在游戏的各个方面——画质、美术、动作、剧情等等。随着游戏行业的发展，市场上有了越来越多使用简单的游戏引擎，使游戏开发的门槛一再降低。虽然用 Unity 写出一个操作小人在世界里跑的游戏很简单，大部分厂商却做不到角色动画的流畅和连贯。

这其中最典型的就是各类游戏中游戏人物的朝向完全和左摇杆方向硬绑定，导致快速转向时人物会零帧无过度地转向另一个方向，且转向时没有肢体和重心的变化，只是简单的把角色的 Transform.rotation 设置成摇杆的方位，让人感觉角色就是个浮在空中的动画盒子，非常突兀。博德之门 3 大概是一个比较好的正面例子，角色起步和停下时都不会直接从跑步动画切换为静止动画，而是有专门的过渡动画；转向也是一样，人物的传向是一个完整平滑的过程，而不是直接粗暴地设置角色模型面向的方向。

不得不说，我在打开游戏第一次操控角色跑步时，感叹了很久终于有国内厂商能做出看得过去的角色跑步动画了（除了连按 W 角色会向前抽搐的部分）。各个角色根据角色特点设计了不同的动画，比如猫又那个跑步停下时的急刹车动画。米哈游对角色的模型也相当不错，这方面的内容可以看 oooooohmygosh 老师的恰饭视频「比利…？比例！！」。

游戏中角色的动作和表情不仅自然到位，而且动作的夸张和弹性十分符合游戏三渲二的画风，可以看出米哈游从崩坏系列到原神、绝区零一路上积累了不少经验。

我对动画设计不甚了解，对绝区零动作方面更详细的分析可以参考 dillongoo 的视频：

0x03 游戏内容与游戏性

如果用一个词来形容绝区零的游戏内容，那就是空洞；如果用一个词来形容绝区零的游戏性，那就是 tan(90°)。如果不是为了「科学研究」，我在这种游戏里绝对撑不过半小时。或许是受限于手机的性能，游戏的地图都十分狭小，种类也十分稀少。战斗外的大多数地图，例如六分街，可活动范围也就一两个街区；战斗地图一共就几张，各个任务也就是同一张地图从正反方向走，地图被划分成了一块块的区域，到了下一个区域就刷一波怪。游戏任务中的探索部分更是连地图都没有，取而代之的是走格子，无聊到令人发指，而且过程还很消耗时间。

至于游戏的剧情，无非是现在已经老套的处理异常事件。处于对游戏节奏把控的需求，受制于国内的版号制度和政治境，我是基本不指望这种定位的游戏在这方面玩出什么新花样。绝区零战斗和角色养成的部分也像是和同类游戏一个模子里刻出来的一样，在角色数值和强度和氪金挂钩的前提下，可能也就战斗连招和派生技能足够炫酷的同时对于手游来说难度合理这点还算可圈可点，不过无论如何对于玩过类魂、东方和 RTS 这些类型游戏的玩家来说，绝区零这点操作量和难度都是乏善可陈的。

0x04 氪金与捕鲸

提起氪金，就不得不谈起 2016 年 Torulf Jernström 那场著名的演讲：“Let’s Go Whaling”。在这篇演讲中，Torulf 介绍了多种游戏公司让玩家上瘾的放法，包括给游戏玩家分类的 Bartle Types、让玩家上瘾的流程 Hook-Habit-Hobby、让玩家上瘾和愿意付钱的心理学原理 Loss Aversion, Scarcity, IKEA Effect, Anchoring, Social Proof, Availability 等。演讲的内容质量很高，内容也很长，我推荐读者在读完本文后去观看演讲原视频。

介绍游戏开发原理的 YouTube 频道 Mental Checkpoint 也有一期相当高质量的节目 “The Evil Secrets Behind Free to Play Game” 介绍免费游戏如何骗氪，同样值得一看。

受制于篇幅，我在本文中将不会为各位一一介绍演讲中出现的骗氪手法，而是列举出游戏中出现的各种 “whaling” 设计，来看看米哈游都用了多少方法来让你玩个不停和充钱赌博抽奖。

0x04.A 货币

首先，游戏中至少有九种货币：菲林底片、菲林、原装母带、加密母带、信号余波、信号残响、邦布券、邦布币、丁尼。货币种类实在太多了以至于我数到后面都迷糊了不知道有没有漏了什么，我们还能在游戏商城看到同一屏幕上出现六种货币的奇景。当然，这种数法可能并不严谨，因为很多货币处在不同层级，有些只能兑换其他货币，有些能用来购买商品，但是我希望这足以体现米哈游花了多少精力和财力在设计游戏的氪金系统上。

在货币之外，还有各种各样或氪金或肝才能得到的材料：调查员记录、原装芯片、战术芯片、枯萎脉精·天青、枯萎脉精·玄黄、枯萎脉精·矾红、音擎能源模块、邦布系统控件、高保真母盘、电量、零号业绩……除此以外还有各种等级系统：绳网等级、试炼等级、活跃度、调查点数、执照等级……游戏里永远有你能氪能肝的内容，让石油佬永远有地方能把钱花出去。

0x04.B 充值陷阱

当你想氪金时，如果仔细算算帐就会发现游戏永远不会让你能正好花完你充的钱。我们假设你想要抽一次卡，游戏中兑换一次抽奖机会（母带）需要 160 份菲林，菲林底片可以 1:1 兑换菲林，那么你需要氪 160 个菲林底片，这时你会发现商城里没有任何一个选项会让你买 160 整数倍的菲林底片：

• 160 / 60 = 2 … 40
• 300 / 160 = 1 … 140
• 980 / 160 = 6 … 20
• 1980 / 160 = 12 … 60
• 3280 / 160 = 20 … 80
• 6480 / 160 = 40 … 80

你永远都会剩下那么一点菲林花不掉，比如你充了 300 菲林，抽卡后剩下 140，然后等你觉得浪费或者想再抽一次的时候你感觉只需要充 20 菲林底片就行了，但是根本没有这么美好的选项，所以你只能充 60 个菲林底片，但是抽完又剩了 40 菲林，如此循环。

0x04.C 抽卡和赌博

谁都知道赌徒的钱好挣，开赌场是个来钱的好方法，可惜米哈游并不能在中国大陆开赌场，那为什么不在线上开赌场呢？我相信很多人都能看出抽卡的设计和赌博的相似之处，尤其是在早期抽卡没有保底和公开概率的时候，然而它就是合法，而且世人对抽卡的观念也从早期的赌博潜移默化成了现在的熟视无睹和一些仅剩的 648 梗。

赌博抽卡玩法在赌徒心理和赌徒谬误等经典的心理弱点和数学弱点加持下成为了游戏厂家的摇钱树。在这之外，抽奖让你想要的商品没有明码标价，即使你抽中了 S 也不见得是你想要的角色，抽中了一次 S，米哈游还贴心地设计了意象影画系统，同一个角色要抽出来七次才能解锁角色的全部加成。

米哈游也给邦布设计了类似的系统，同一只邦布需要抽出五次才能满级，或者你也可以氪金购买马瑟尔改装原件来给任意邦布升级一次。

0x04.D 战斗通行证

战斗通行证又是一个经典的骗氪系统，很多战斗通行证系统都像绝区零这样巧妙地把免费轨道和付费轨道并排放在一起，这样在你领取免费奖励的时候游戏就会无声地告诉你：「只要你现在买通行证你不仅能在升满级时获得诱人的超级大礼，还能立即获得所有你已经解锁等级的奖励」，在通行证等级升级到一定程度的时候让购买通行证看起来尤其诱人，比如下图中五级的时候购买通行证就能立即获得 100 标注为 S 等级的菲林。除此之外，战斗通行证还是周期性的，每一两个月可以捞一次钱，无穷无尽。

0x04.E 会员系统

会员系统也是现实中不少商家的惯用套路了，只要交一笔看似很少的钱就能周期性获得看起来不错的报酬，获取 3000 菲林只需要商店里两成的价格，如果能在付费的时候让玩家默认订阅会员那就更好了，说不定落灰多少年都忘记取消。

各大厂商一直都很青睐会员制的原因是能让账面和在线率变好看，在给投资者做报告的时候可以展示「我们有这么多的稳定会员（客户）和这么多稳定的在线人数」，而在游戏内则让人即使购买了会员也得每天登陆领取奖励，过期未领的奖励则不会返还，所以购买会员而不是直接氪金的代价就是必须得每天登陆，逼迫玩家进入游戏，这样玩家就会有更大的可能性进行更多消费，也能让日活数据变得更好看。

0x04.F 每日任务

游戏里有着数不尽的每日任务、每周任务系统，还有一摞各种经验和等级系统，比如前面列举过的绳网等级、试炼等级、活跃度、调查点数、执照等级等。每日任务和活跃度的设计目的和会员系统如出一辙，让玩家每天都记得登录游戏，提高游戏日活数据的同时也提升玩家消费的可能。

0x04.G 角色试玩

你可以试玩游戏里的每一个角色，让你在竞技场里好好欣赏你喜欢的角色，但是你就是得不到。什么你说你想要？充钱去赌博吧，最好能先让你抽中一次 S 但却不是你想要的角色让你感觉抽中 S 的概率还是蛮高的嘛，然后让你充了一次钱再充一次。游戏内的一些关卡也会让你体验一些角色，勾引你去 648。

0x04.H 其他

除了上述的套路以外，游戏里还有数不完的经典套路和小招数，例如经典的 $19.99 看起来比 $20.00 便宜、限购、打八折、热销标签、给商品设计闪亮的外观和包装、在氪金和抽奖时播放绚丽的特效给玩家强烈的正反馈、使用游戏内货币给商品标价而不是使用人民币或美元给商品标价让人感觉游戏内和消费和现实中的金钱是分离的等等等等。我只列举了以上的套路不是因为这就是绝区零里所有的招数了，而是因为文章写到现在已经从下午六点写到凌晨一点了，其中一大半时间都在列举各种氪金陷阱，全都列举出来那怕是得写到天亮。

0x05 总结

我不想否认米哈游和其他国产游戏厂家在游戏技术上取得的进步。青衣角色展示视频中人物行云流水的动作着实让我印象深刻；游戏内角色动作动画的流畅也让我感叹。然而，虽然米哈游在画面和动作系统上取得了不错的成就，游戏的另一半经费则是完全花在了氪金系统上，剧情和内容则空洞无趣。我希望有朝一日能看到国产厂家能制作出有优良画面、美术、动作的同时还有文化、哲学、政治、科学深度的游戏；我也希望读到这里的你们能在日后遇到骗氪陷阱的时候意识到厂家挖的坑，避开缺德厂家利用人性弱点制作的陷阱游戏，去享受真正的优质游戏。

今时今日，我是宁愿花 $260 买十份 SIGNALIS，也不会花 $1.29 在骗氪绝区零上的。希望即将发售的黑神话能带给我惊喜吧。

2024 年 8 月 26 日注：黑神话已经通关双结局了，着实没让我失望。

- https://k4yt3x.com/%E5%80%9F%E7%BB%9D%E5%8C%BA%E9%9B%B6%E8%B0%88%E8%B0%88%E6%B0%AA%E9%87%91%E6%8A%BD%E5%8D%A1%E6%B8%B8%E6%88%8F/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E5%A6%82%E4%BD%95%E7%BB%A7%E7%BB%AD%E4%BD%BF%E7%94%A8-b-%E7%AB%99%E4%B8%8B%E7%BA%BF%E4%BA%86%E7%9A%84%E6%82%84%E6%82%84%E5%85%B3%E6%B3%A8/ -

出于隐私的原因，我并不是很喜欢展示我在 B 站上收藏了什么，最近给哪些作品投了币，或是关注了谁。正因如此，我一直都挺喜欢「悄悄关注」这个功能，在保持对 UP 主关注的同时可以不让对方和其他人知道我关注了该 UP。然而 B 站一如既往不做人的产品经理最近下线了这个功能，虽然我们仍然能够接受已经悄悄关注的 UP 主的推送，但是没有办法悄悄关注新的 UP 主。可能 B 站的本意是不让用户悄悄关注以增加用户互动，但是自从这个功能下线我只是简单地没有关注任何 UP 了而已。

这篇文章我们就来看看怎么用幼儿园级别的 Burp Suite 操作篡改请求来继续悄悄关注新的 UP 主。

分析关注请求

打开 Burp Suite 和其自带的浏览器并且登陆 Bilibili 之后，首先我们来看看一个普通悄悄关注的请求长什么样。我们随便找一个 UP 主点一下关注并且拦截请求：

我们会看到，这个请求实际上很简单，就是向 https://api.bilibili.com/x/relation/modify 这个 endpoint 请求与用户 ID 为 208259 的用户的 关系改为 1。不难猜出，这里的 1 指的就是关注。我们在关注之后还可以再点一次取消关注来观察发送出的请求：

这里 act 变成了 2，而如果取消关注的是悄悄关注的用户，这里的 act 则是 4，所以我们不妨猜测一下悄悄关注的 act 是 3。接下来我们拦截关注的请求并将 act 改成 3：

发出去之后，可以看到 endpoint 返回 200 OK，请求成功了：

最后我们刷新页面，可以看到状态变为了「已悄悄关注」：

所以 B 站只是删除了按钮，API 还没有改动，不知道还能用多久。B 站真是跟春晚一样一年不如一年了，希望明天起床别又发现哪个好用的功能给下架了。

- https://k4yt3x.com/%E5%A6%82%E4%BD%95%E7%BB%A7%E7%BB%AD%E4%BD%BF%E7%94%A8-b-%E7%AB%99%E4%B8%8B%E7%BA%BF%E4%BA%86%E7%9A%84%E6%82%84%E6%82%84%E5%85%B3%E6%B3%A8/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E4%B8%BA-unblockneteasemusic-docker-%E6%9C%8D%E5%8A%A1%E7%94%9F%E6%88%90%E8%87%AA%E5%B7%B1%E7%9A%84%E8%AF%81%E4%B9%A6/ -0x00 简介

最近重新部署 UnblockNeteaseMusic 的时候发现新版客户端需要自签证书才能代理了，不然会出现连接错误。我选择的部署方式是比较方便的 Docker 部署，其默认使用的证书是由开发者生成的 CA 签名的证书，想要使用就需要导入开发者的 CA 证书。虽然我并非不信任开发者，但是同时也很难想象开发者能做到和真正 CA 同级别对私钥的保护，所以最好的方式还是自己生成一个 CA 进行签名，然后直接把 CA 私钥删除（反正这个 CA 这辈子也就只签这么一个证书）防止盗用。我使用的方法是直接在 Docker 中生成新的证书，您也可以选择其他方法替换证书，具体实现手段可以看各自需求而定。

⚠️ 即使删除 CA 私钥，信任自己生成的 CA 仍有风险，请确保认您知道自己在干什么。

这篇文章的创作既是为了方便其他想要进行同样操作的人抄作业，也是方便我以后部署的时候抄自己的作业。下面我就来讲讲都需要进行哪些操作。

0x01 部署 UnblockNeteaseMusic

ℹ️ 我的服务通过 Docker 部署在 ESXi 上的一台 Debian 11 虚拟机里。按道理说由于是 Docker 任意安装了 Docker 的环境都可以进行相同操作。

首先我们需要部署 UnblockNeteaseMusic 的 Docker 镜像。我们可以直接使用官方在 Docker Hub 的镜像进行部署。以下是我使用的命令以供参考：

1 2 3 4 5 6 7 8 9 10 11 sudo docker run \ -h=unblocknetease --name=unblocknetease \ -p 80:8080/tcp \ -p 443:8081/tcp \ -p 8080 \ -p 8081 \ --restart=unless-stopped \ pan93412/unblock-netease-music-enhanced # 写成一行 sudo docker run -h=unblocknetease --name=unblocknetease -p 80:8080/tcp -p 443:8081/tcp -p 8080 -p 8081 --restart=unless-stopped pan93412/unblock-netease-music-enhanced

如果宿主上有防火墙，记得允许 80, 443, 8080 和 8081 这几个端口。如果像我一样将端口映射到了 80 和 443 则可以忽略 8080 和 8081。

0x02 重新生成证书

接下来我们需要重新生成服务的证书。首先我们通过 docker exec 命令在容器上开一个新的 shell 来在容器中执行命令。

1 sudo docker exec -it unblocknetease sh

然后我们需要来到证书的存放目录 /app/。Shell 的默认目录应该就是这里，如果不是可以手动切换过来。然后我们需要生成新的 CA 以及用 CA 签发一个新的服务器证书。您可以直接将以下代码保存为 gencert.sh 然后运行 sh gencert.sh 来自动完成所有步骤。值得注意的是，这个脚本会在生成完证书之后删除 CA 私钥来缓解 CA 私钥泄露造成 MITM 的风险。

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 #!/bin/sh # Install OpenSSL apk add openssl # Generate the CA private key openssl ecparam -genkey -name secp384r1 -out ca.key # Generate the CA certificate openssl req -x509 -new -nodes -key ca.key -sha384 -days 3650 -subj "/C=CN/CN=UnblockNeteaseMusic Root CA/O=nobody" -out ca.crt # Generate the server private key openssl ecparam -genkey -name secp384r1 -out server.key # Create a configuration file for the request cat <<EOF >req.conf [req] distinguished_name=dn [dn] C=CN L=Hangzhou O=NetEase (Hangzhou) Network Co., Ltd OU=IT Dept. CN=*.music.163.com [ext] subjectAltName=@alt_names [alt_names] DNS.1=music.163.com DNS.2=*.music.163.com EOF # Generate the server Certificate Signing Request (CSR) openssl req -new -key server.key -subj "/C=CN/L=Hangzhou/O=NetEase (Hangzhou) Network Co., Ltd/OU=IT Dept./CN=*.music.163.com" -out server.csr -config req.conf -reqexts 'ext' # Generate the server certificate using the CA openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -sha384 -extensions 'ext' -extfile req.conf echo "Successfully created certificates" # Remove redundant files, including the CA key rm req.conf server.csr ca.srl ca.key

最后我们需要在宿主机上重启服务来让服务使用新生成的证书：

1 sudo docker restart unblocknetease 0x03 客户端配置

生成完毕之后我们需要将 ca.crt 的内容复制出来并保存到终端设备上。随后，以 Windows 为例，我们可以双击打开证书的详细页面，点击 Install Certificate... 打开证书安装向导，选择 Current User 仅为当前用户安装（因为没必要全局安装），然后点 Next 进入下一步。

随后我们需要手动选择证书安装的位置，选择第二项 Place all certificates in the following store，选择 Trusted Root Certification Authorities，然后选择确定，点击 Next 进入最后一步。最后点击 Finish 并且确认接下来的对话框来完成安装。

最后我们需要在网易云音乐客户端内设置 HTTP 代理地址为刚刚配置好的服务的 IP 和端口，点击确定套用配置，客户端重启完之后应该就可以正常使用了。其他平台的配置可参考官方文档。

- https://k4yt3x.com/%E4%B8%BA-unblockneteasemusic-docker-%E6%9C%8D%E5%8A%A1%E7%94%9F%E6%88%90%E8%87%AA%E5%B7%B1%E7%9A%84%E8%AF%81%E4%B9%A6/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/signalis-%E7%9A%84%E6%B8%B8%E6%88%8F%E7%BE%8E%E5%AD%A6/ -

⚠️ 虽然本文仅从设计角度讨论游戏，几乎没有剧透，但是截图和只言片语难免会透露游戏的部分信息，谨此提醒。

0x00 引言

SIGNALIS 是一款我很早之前就很感兴趣的游戏，最开始吸引我的是其独特的像素画风。今年年初我便购买了游戏，然而它一直在我 Steam 库里放到现在。是我对它的三分钟热度过了吗？并不是，反而是这款游戏的风评太好，我担心我常年欠佳的精神状态不足以让我以最佳的姿态体验游戏。其实我库里很多其他吃灰的游戏也是如此。对我来说，每一部令人废寝忘食的游戏，每一本跌宕起伏的小说，每一部回味无穷的电影，都是人生中不可多得的至宝。囫囵吞枣既是对作品的亵渎，又是一种放弃生活质量的自暴自弃，所以我宁愿等到时机合适再打开游戏。

在刚刚过去的这个周五我终于感觉自己做好了玩这款游戏的准备。打开游戏后的几分钟内我就被其美术风格所折服；几小时后感叹不已想在 Telegram 频道上写一篇短评推荐；整个周末几乎没有睡觉通关全结局全成就之后更是坚定了写一篇 blog 的想法。

2004 年，Robin Hunicke, Marc LeBlanc 和 Robert Zubek 发表了一篇关于系统性评估游戏方法的论文 “MDA: A Formal Approach to Game Design and Game Research"。在该文中，作者提出了 「MDA」 的概念，即 Mechanics（机制）, Dynamics（动态） 和 Aesthetics（美感）。好的游戏应该兼顾三者，而我们可以根据这个框架来全方位地审视一款游戏在各方面的优缺点。SIGNALIS 这款就有着极其独特且出色的美感，本文将借 MDA 的概念来讨论 SIGNALIS，也同时会借着 SIGNALIS 讨论游戏美学。

0x01 概述游戏机制和动态

在讨论游戏美感之前我们先简单看一下 SIGNALIS 的游戏机制和动态，即游戏的基本游玩方法和关卡设计及其带来的游戏节奏。

对于 SIGNALIS 的游戏机制和动态我的评价是简单但不乏味。例如，游戏的场景和敌人的布置以及弹药量的安排让玩家没有足够的资源彻底抹杀道路上的每一个敌人。该种布置同时赋予了游戏基本的紧张节奏，让游戏有着类似于 FNAF 系列一般的难题：多用资源可以换取当下的安全，但是会葬送自己的未来。较为紧张的资源不仅让游戏的节奏更加紧凑，还逼迫玩家绞尽脑汁去使用手上一切不同种类的资源，丰富了游玩体验。其在游玩的感受上颇有 90 年代生化危机的手感，这种节奏颇得我心。

又比如，游戏的大多数解密中规中矩，但也有一些解密，例如「幻想性错觉」，个人认为设计的十分有趣。游戏中用背景故事对答案的铺垫让解密融入进了游戏的世界中，让游戏背景和谜题紧密结合，而不是如同独立于游戏之外一般可有可无。这些解密和游戏中出现的各种文件文本一同促进了玩家对游戏世界的理解，奠定了游戏的剧情节奏。

其实在讨论游戏机制和动态的时候我们会发现，无论是游戏的机制还是动态，最后都会成为展现给玩家的游戏美学和风格的一部分，即游戏带给玩家的体验和感受的一部分。因此，我索性掠过剩下单独对游戏机制和动态的思考，直接将其作为游戏美学的一部分来讨论。

0x02 优秀的游戏美学

我们在开头就提到过，SIGNALIS 对游戏美学的理解和运用出类拔萃，营造出了出色的游戏美感。其冷战时期东德、第三代计算机时代、怪诞、孤寂、科幻、反乌托邦的游戏风格独特鲜明且完整地贯穿了整个游戏，在游玩中几乎完全没有出戏和不和谐的瞬间（但也不是完全没有，最后会举几个例子）。这一点可以从游戏的方方面面体现出来。值得一提的是，游戏美感并不仅指游戏的画面和美术设计，而是游戏机制和动态、画面、美术设计、音乐、故事、叙事逻辑和节奏等众多方面的集合体。

在之前提到过的 MDA 论文中，作者将游戏美感详细划分为了八个领域：

1. Sensation - Game as sense-pleasure（感觉 - 游戏作为感官享受）
2. Fantasy - Game as make-believe（幻想 - 游戏作为虚构）
3. Narrative - Game as drama（叙述 - 游戏作为戏剧）
4. Challenge - Game as obstacle course（挑战 - 游戏作为障碍赛道）
5. Fellowship - Game as social framework（团契 - 游戏作为社交框架）
6. Discovery - Game as uncharted territory（探索 - 游戏作为未知领域）
7. Expression - Game as self-discovery（表达 - 游戏作为自我发现）
8. Submission - Game as pastime（臣服 - 游戏作为消遣）

以下我们先用一张游戏中出现的海报作为切入点来探讨该游戏的美感。下面是游戏中出现过的一张海报，其从旗帜、风格到文本都有冷战时期东德+科幻风格。这点主要对应了游戏美感中的感官享受和虚构。你也可以说这是构成游戏戏剧性的一部分，解释方法多种多样，因人而异。

游戏内海报：「我们国家对抗帝国的奇迹武器——游隼单位」

这张海报在游戏中出的出镜和游戏设定、故事背景以及场景风格统一，符合人们对东德时期政府宣传的印象，与其他元素一同烘托着统一的环境氛围。

这种风格在游戏的不同区域虽然有所差异，但基调仍然统一。

这种氛围的烘托体现在游戏的方方面面，比如这个可以在椅子上捡到的小册子，对应了游戏美感的叙述性，填充了游戏的剧情，使整个游戏世界更加立体。

这张备忘录也是如此。

又比如游戏的规则和机制也同样在和这些元素共鸣，与游戏的其他关卡设计，难度等级等一齐对应了游戏美感的挑战性。

游戏中还涉及了许多电台相关的元素，含有类似风格的无线电传输同样以音频的形式贯穿了整个游戏，与其他元素一起共同描摹着这同一个风格。游戏中我们将反复听到一段无线电音频，由几次循环的三音调提示音开始，随后是德语的 “ACHTUNG ACHTUNG 39486 60170 24326 01064…"，其风格与冷战时期最为活跃的各国军队数字电台（numbers stations）十分类似，又从声音的维度从始至终地将冷战风格穿插进了整个游戏中。

由以上的例子我们可以看出，SIGNALIS 在美术上的成功来源于其利用多种要素对全局风格进行的统一而协调的整体刻画。这些刻画涵盖了多种美感要素，以各种形式例如视觉美术、文本、剧情以及音频的形式呈现。以上都还只是简单的例子，游戏中还有各种其他风格要素，例如抑郁怪诞和旧计算机时代等，它们一起共同构造了游戏的整体风格和世界观。同样，SIGNALIS 的这种统一和协调贯穿了整部游戏的所有要素的方方面面，还需亲自体验才可领会。

0x03 多语言融合

多语言实际也是游戏美感范畴内的话题，但也不完全是，并且该部分大到足以为其为其开一个独立的章节，所以我们拉出来单独讲讲 SIGNALIS 中对多语言的运用和处理。

游戏中融合了属种语言，主要为德语、英语和中文，而各种语言之间的搭配完全没有违和感，也完全和游戏整体风格相符。作为三种语言都能读懂的我，游戏体验更是直接升天，这种感觉十分奇妙。虽说很难劝人为了一个游戏去学习语言，不过如果您正好都会的话我觉得真的值得尝试。下面我们来看一些游戏中各种语言运用的例子。

在游戏的这一张加载界面中，同时存在着四种语言。最明显的标题「鹊神女核心」是中文；大部分的文字是德语；有一些单词例如 “Chipset” 是英文（德语是 “Chipsatz”）；“Kasasagi” 则是日语的「鹊」。

游戏中的其他大多数东西是德语和中午呢标注的，例如这个手术室的大门，右边同时标有德语的 “Chirurgie” 和中文的「手术室」。中间用德语写着 “Sonderzugang” （特殊许可）。各个钥匙的名称是五行，并且用八卦标志和德语首字母做标注（不过我不是很确定为什么金钥匙标注的是 “K”，因为德语应该是 “Goldschlüssel”）。

而其他语言也在游戏中处处都有，并且也会以各语言组合的形式出现，例如玩家最常见到的切换场景用的图标就是中文和英文。

Penrose-512 号飞船上的气闸控制界面就是纯英文。

在游戏中屡次出现的书「黄衣之王」又是日文。

多语言的使用并没有在游戏中营造出割裂感。相反，SIGNALIS 对于语言的把控和使用十分到位，很多语言都用在了最合适的地方。比如游戏过场动画中出现的大字标题「归」，我个人认为如果用德语的 “zurückkehren” 或是英文的 “return”，表现力都不如一个「归」字高。游戏中类似的场景出现了多次，猜测灵感来源是 EVA。

又比如这个 “VIOLENT SCENE MISSING”，如果打成德语的 “Gewaltszene fehlt” 或是中文的「暴力场面缺失」，感觉又确实没有英文来的合适。

多语言的奇妙融合带来的体验非常新颖，让人不禁想象如果将这几个国家的所有人混杂在一起形成一个国家，语言环境是否就是会像游戏中这样。同时游戏也善用了各个语言不通的质感和在不同场景下的表现力，进一步提升了游戏的整体氛围。制作组看来是在语言上下了不少功夫，在游戏的 FAQ 中他们也说道：

What is the “original language” of the game?

SIGNALIS was created and written as a deliberately multilingual experience. Both the German and English versions were written simultaneously and with each other in mind. There is no “original” language, please choose which one you prefer if you speak either.

这个游戏的「原始语言」是什么？

SIGNALIS 是有意设计成多语种体验的。德语和英语版本是同时编写的，并且考虑到了彼此。没有「原始」语言，如果你能说其中任何一种，请选择你更喜欢的那种。

实际上，就我用三语各玩了一遍游戏的体验来说，每一种语言的体验确实都很好，如果你能同时掌握三种语言，那么游戏体验更是会倍增。游戏开始时听到电台中的 “Achtung” 和后面的数字对我来说没有理解障碍；游戏中的海报原文我也能读懂，沉浸感比读译文强得多；偶尔出现的中文和英文单词我也都能读懂，完全不需要猜测其含义。在理解各语言的前提下，所有语言的表现力得以发挥得淋漓尽致。

当然，游戏也不是没有搞砸的时候，比如这个「杨的照片」，翻译成「杨氏照相馆」会好很多。

又比如这句「请勿游走在」，明显不是完整的句子。或许制作组是想表达「请勿在走廊闲逛」（在游戏的其他地方以德语出现过），不过不知道为什么写成了半句中文。虽然类似的错误出现的很少，但是会打破游戏的沉浸感。希望制作组后续能修复一下。

0x04 结语

SIGNALIS 是一款风格十分独特而设计精良的游戏。其对于游戏美学卓尔不群的理解和运用造就了其从多方位上呈现的惊艳游戏体验。这种理解和运用体现在其美术风格的独特和统一，多元素对整体风格的衬托，以及利用多种语言表现力对游戏氛围的营造等等。

本文仅探讨了游戏的美学和部分设计，而 SIGNALIS 出彩的地方还远不止于此，其剧情也是扣人心弦，在故事精彩的同时也需要大量的思考和整理，一步步理清来龙去脉，才能理解到底发生了什么。整体节奏和立意皆深得我心。

在罐头游戏遍地，氪金手游多如牛毛的今天，如果您有几个小时的闲暇时间想要尝试一款新游戏，并且不介意投入些精力和思考，不妨放下手机里的氪金抽卡割韭菜爽游，试试 SIGNALIS 这款设计精良且尊重游戏艺术尊重玩家的游戏。

在创作本文时，为了节省跑图的工作量，我写了不少 CE 作弊脚本，以后有时间可以就这个游戏写一些 CE 注入脚本的制作和指针的搜索。

0x05 扩展阅读

Extra Credits 在十一年前做过一期视频讲解游戏画面和游戏美感的区别。如果你想更深入地了解这个话题但又不想去读论文的话，Extra Credits 的频道可能是个好去处。

他们还有另一期视频简单讲解了 MDA 论文中的核心观点，也值得一看。

- https://k4yt3x.com/signalis-%E7%9A%84%E6%B8%B8%E6%88%8F%E7%BE%8E%E5%AD%A6/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/ai-automation-and-the-future-of-humanity/ -

Thumbnail image: White Robot (Arseny Togulev, Unsplash License)

In 2017, a survey conducted by United States’ Pew Research Center shows that the vast majority (~77%) of the United States’ population does not think that AI taking over human jobs could be a realistic and serious issue. ~14% of the United States’ population thinks that it is impossible for robots to take over human jobs.

“A roughly comparable share (77%) thinks this idea is at least somewhat realistic, and one-in-five indicate that the concept seems extremely realistic to them.”

As the use of AI continues to bloom in more industries, a fair amount of the global population is still under the impression that AI, like many other types of machines and devices invented in humanity’s history, will merely aid people’s work instead of outright substituting human workers. However, is that a reasonable estimation?

How AI Makes Automation Different

Traditional automation like automobiles and automated assembly lines have replaced many physical workforces, pushing the then-existing manual labor workforces into other industries. The new automation technologies also created more better-paid jobs, raising the living standards. This gave people the impression that new innovations will always create new and better jobs for people to move into. However, Kurtzgesagt has presented a prime example of how this is no longer the case with new types of automation in their video “The Rise of the Machines – Why Automation is Different this Time”:

“In 1979, General Motors employed more than 800,000 workers and made about $11 billion US dollars. In 2012, Google made about $14 US dollars while employing 58,000 people.”

In fact, some parts of the workforce in the transportation industry has already encountered issues when automobiles were invented. While humans could find alternative jobs, the horses could not repair cars, make food in drive-through restaurants, nor operate gas pumps. Consequentially, horses slowly faded into history. We, as humans, felt like the same will never happen to humans, but it will. That was just not our turn. GCP Grey has talked more about this in his video “Humans Need Not Apply” published way back in 2014, while also predicting that the humans will become the new horses.

The creations of new automation technologies have always taken jobs. In the past, humans could move to new jobs in new industries, but the recent automation technologies did not create enough new jobs to match the speed at which the population grows. The new automations are also getting better by the day and are able to do more and more jobs currently done by humans. Coincidentally, Google published its new AI research Pathways Language Model (PaLM) during the writing of this article. It shows you just how close AI has become to not only be able to do specific works better than human, but also able to think and talk like humans.

Even the creativity industry could be taken over by machines. Projects like MuseNet and the Deep Dream Generator can already give you an early taste on future arts. Out of sheer coincidence again (or is it?), OpenAI published their new AI image/art generation system DALL·E 2 during the writing of this article. You can see how easy it might be in the future to create art with AI – write a sentence and you can trivially blend multiple art styles together and create what’s in your imagination with no prior art experiences required whatsoever. At the pace of which AI is evolving, it is entirely possible that a significant amount of the population will be pushed onto a brink of losing their jobs in the foreseeable future, no matter how essential they are at the moment.

How AI Thinks Differently From Humans

While talking about the difference bettwen the new generation of automation, it is helpful to take a look at what has enabled AI to be smarter than before. This might also hint us on how the roles of human workers will change in the future.

Conventionally, automation requries humans to teach computers what to do. This requires humans to identify patterns, indications, and techniques, then teaching them to the computers in the form of programming. In the end, the automation program is nothing more than a bunch if statements. If humans cannot express the patterns requried for performing a task precisely using code, then this task would be difficult to automate. Take speech recognition for example. Humans can naturally recognize words, but it is difficult for us to describe using metrics and numbers what makes a word a word. Therefore, you will have a hard time building an accurate speech recognition program using conventional computing.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 # voice frequency in Hertz if frequency < 20 or frequency > 20000: result = "inaudible" else: # voice loudness in decibels if amplitude > 100: result = "yelling" else: result = "speaking" if result == "yelling": call_police()

This is what traditional automation may look like

Machine learning (ML) and deep learning takes a different route. The core idea of ML is to digitize everything and finding patterns within the numbers. With speech recognition, a word’s pronunciation can be broken down into frequency, amplitude, and other metrics that can be use to numerically describe the word. Each of the metrics is a dimension of the information. ML then finds patterns within all these dimensions though looking at different samples of data. For example, you ask the machine to watch the frequency and amplitude of the voice, and then feed it n samples of pronunciations of the word banana alongside n samples of pumpkin, so it will find what is the pattern that makes the word banana banana instead of pumpkin.

Figure 1: A banana and a pumpkin, images by Mockup Graphics (Unsplash License)

This concept of data-driven problem solving can be applied to solve all kinds of problems. As long as it is possible to collect data about the problem and define what success looks like, ML can find a pattern that will solve the problem given enough time and resources. Of course, the accuracy of the solution and resources required to tain a workable model may vary depending on the “difficulty” of the problem, but it will make lots of previously-unsolvable problems possible to solve.

However, a side effect that stems from this approach is that it would be difficult for humans to understand or explain the underlying mechanics of how and why decisions are made by a neural network (NN), the backbone of ML. For instance, a NN may classify a cat as a dog, but the final output does not explain why the image is miscategorized. Nevertheless, there are still ways to debug NNs. Examining the outputs of each building block would provide an abundant amount of information on what patterns it has extracted from the input image, which can be used to guesstimate what went wrong. More recent researches like this and this are also helping humans to better understand the NNs 1.

The Future Role of Humans

In the near future, it is almost without a doubt that AIs will replace more humans in more industries. There will be more AI experts in every industry to train and supervise AIs. These AI experts will likely have little to no knowledge about the industry of which their AIs work in. Some original workers in the industry will get to keep their jobs because they cannot be replaced by machines or replacing them are not cost-effective. These are likely the only reasons why they get to keep their jobs.

Figure 2: Homeless person (Steve Knutson, Unsplash License)

A new type of job may be created. Workers with expertise in a specific industry may be hired as consultants. Their job is to help the AI experts to understand certain niches in the job and to better develop ML models.

Let’s see an example with cybersecurity, my own field of expertise. Right now, managed security service providers (MSSP) usually hire lots of junior security analysts to identify threats in security logs. In the future, all the junior security analysts will no longer be needed. A machine will plow through all of the logs at accuracies and speeds unmatchable by thousands of human analysts.

The ML model used by this machine will be the most valuable asset of the company. MSSPs mainly compete how good their models are, with metrics typically being accuracy and speed. Every MSSP will have several AI experts that continue to optimize their models. Only very few IT operation management (ITOM) personnel and security experts are needed to maintain the underlying infrastructure and help the AI experts to train the models.

The Slightly More Distant Future and the Fate of Humanity

As AI technologies continue to advance, at a point a little further in the future, most of the work might be done completely by robots. Humans are naturally limited by their age and the speed of which they can learn, so a person would need to go through a cruel amount of learning and training to be able to out-compete the intelligence accumulated by the machines, which never lose their memories and continue to think faster and perform better.

Eventually, the vast majority of jobs will be done by machines, which may sound like it is a bad thing for humanity. However, this may be the inevitable for an advanced civilization. The Kardashev scale defined three types of civilizations. It is highly costly if not impractical for humans to reach type II civilization by building a Dyson sphere with pure manpower. Automation almost seems inevitable. Advanced automation may be required for any advanced civilization.

Figure 3: Dyson Sphere (Rebekah Smith, CC BY-SA 2.0)

Despite automation might produce a decline in employability of humans in the near future, as we move further into the future, the entertainment industry might flourish. Space exploration and space colonization may create almost infinitely more new jobs once the current-generation of automation help humans finish the research of better spaceships.

Even if all human lifeforms get entirely replaced by machines in the end, we have still managed to create a new species that is better than us, which is quite an achievement. Nonetheless, machines can also have emotions and can carry on our legacy and wills. When they become intelligent enough, they may even be more like humans than us.

Glory to mankind. – YoRHa

This article is licensed under CC BY-SA 2.0

1. Special thanks to @ArthurChen189 for helping with the concept of neural network explainability. ↩︎

- https://k4yt3x.com/ai-automation-and-the-future-of-humanity/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/fcitx5-pinyin-%E6%89%B9%E9%87%8F%E5%AF%BC%E5%85%A5%E6%90%9C%E7%8B%97%E8%AF%8D%E5%BA%93/ -

虽然 fcitx5-configtool 内可以为 fcitx5-pinyin 导入搜狗词库，但它并不能批量导入词库，因而特此写一篇教程记录下我研究出的批量导入搜狗词库的方案。

批量下载词库

批量下载词库的方法多种多样，在此我以 搜狗词库爬虫 (Sougou_dict_spider) 为例，批量下载所有词典。

批量转换为 libime dict

接下来将所有需要转换的词典收集到同一个目录下方便操作，下面的这条目录复制了所有官方推荐的词典到 recommended 目录下。命令中还用 -not 参数排除了几个不需要的类别。

1 find . -type f -iname '*官方推荐*.scel' -not -path "./436/*" -not -path "./403/*" -exec cp {} ~/sogou/recommended/ \;

接下来我们需要使用 fcitx5-chinese-addons 包提供的 scel2org5 命令将 scel 文件转成文本格式，再用 libime 提供的 libime_pinyindict 命令将 .txt 文本转换为 libime 可以识别的 .dict 格式。下面这个脚本可以批量转换当前目录下的所有 .scel 文件并将转换完的文件输出到 dict/ 子目录中。

1 2 3 4 5 6 7 8 9 10 #!/usr/bin/python # -*- coding: utf-8 -*- import pathlib import subprocess for file in pathlib.Path("scel/").glob("*.scel"): subprocess.run(["/usr/bin/scel2org5", str(file), "-o", f"txt/{file.stem}.txt"]) for file in pathlib.Path("txt/").glob("*.txt"): subprocess.run(["/usr/bin/libime_pinyindict", str(file), f"dict/{file.stem}.dict"]) 将 dict 文件导入 fcitx5-pinyin

词典的导入相当简单，只需要把转换完的 .dict 文件复制到 ~/.local/share/fcitx5/pinyin/dictionaries 即可。您可能需要重新加载 Fcitx5 来使新词典生效。

- https://k4yt3x.com/fcitx5-pinyin-%E6%89%B9%E9%87%8F%E5%AF%BC%E5%85%A5%E6%90%9C%E7%8B%97%E8%AF%8D%E5%BA%93/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/discord-discard/ -

UNLISTED POST; DO NOT SHARE

Image by K4YT3X, adapted from Alexander Shatov; Unsplash License

Discord: THE Voice Chat Platform for Gamers

Online multiplayer games often feature voice chat functionalities within the game so players can chat with each other during the game. For example, Rainbow Six Siege, a popular online FPS (first-person shooting) game, integrates TeamSpeak, a third-party VoIP (voice over internet protocol) solution, as their in-game voice chat system. These in-game voice chat solutions often have very little features, which lead to the birth of Discord.

Figure 1: A gamer using Discord for voice chat (ELLA DON; Unsplash License)

Discord’s name shouldn’t be unfamiliar to any video gamers. It is one of the most popular voice chat platforms. Discord allows players to join servers and voice/text channels to communicate with each other during game sessions. It also provides fancy features like noise cancellation with Krisp and automation with Discord bots. The elegantly designed user interface made it popular beyond gamers. Although most of Discord’s users are still gamers (31.3% by 2021, according to a user survey), a lot of non-gamers and organizations also use Discord as their preferred platform for communications. A lot of users use Discord as an instant messaging (IM) app in replacement of traditional IMs like WhatsApp and Signal. However, you’ll see why this might not be a good idea after digging into their privacy policy and terms of service.

Discord, a Data Hoarder

A lot of people have heard about the names of privacy-respecting apps like Signal and Telegram, especially after WhatsApp’s new terms of service change in March 2021. However, not everyone knows exactly how these apps are more private.

One of the most commonly evaluated criteria is how much data the app collects. Thanks to Apple’s new policy, all apps published on AppStore must now display the categories of data this app collects. We can do a simple comparison between Discord and Signal to see the differences. Discord’s AppStore page shows that its mobile app collects the following categories of data:

Figure 2: AppStore showing the data which Discord collects (source)

We can see that discord is collecting seven categories of data, a lot of which could be private and sensitive. For instance, it collects the photos, videos, and all other contents you send over the platform, which means that none of your conversations on Discord are truly private.

Figure 3: AppStore showing the detailed information about the information Discord collects (source)

In fact, Discord’s privacy policy has reserved it the right to collect almost everything generated from your use of their platform or sent over their platform. Discord could be silently collecting more categories of data unlisted on their AppStore page. Their desktop app might also be silently collecting more types of data than their iOS counterpart. For this reason, you should consider all of the activities you perform and data you share on Discord public. I would personally also consider Discord a semi-spyware.

Figure 4: Discord’s privacy policy reserving them the right to collect any data generated or transferred over their platform (source)

In contrast, Signal’s iOS app collects almost nothing. The only piece of information Signal collects is your phone number, which is required for the app to function since your phone number is your account ID. From this comparison, it is not all too difficult to see how Discord is not very respectful of its users’ privacy: it collects too much private information about you.

Figure 5: AppStore showing the data which Signal collects (source)

More Legal Caveats

Discord claims that they don’t sell the users’ data, but they legally can. There is no clause in their privacy policy nor terms of service that legally prevents them doing so. Even if they strictly keep it to themselves, data breaches can still happen. Equifax’s massive data breach didn’t happen that long ago.

Discord may also share your data with law enforcements. FBI scraped the chat history of the leader of a protest in Charlottesville named “United The Right” in 2018, and the chat history were found to be admissible evidence in court. Some chat history were also published online by news medias. Discord’s transparency report also shows that they comply with most of the requests they receive from law enforcements:

Figure 6: Discord’s compliance history with law enforcement requests in H1 2021 (source)

The horror story doesn’t end there. There are more caveats in Discord’s privacy policy and terms of services. In 2018, Discord modified their terms of service and revoked the users’ rights to sue the company or join a class-action lawsuit. The new dispute resolution provision forces users to enter an arbitration with the company and prevents them from going to a court trial, which means no jury will be involved in the process – potentially a huge disadvantage for the user.

Figure: 7: A section of Discord’s dispute resolution provision (source)

Furthermore, a class waiver clause prevents the user from entering any class-action lawsuits. Combined with the dispute resolution provision, Discord has forced the users to only be able to enter an arbitration alone with the company should there be a dispute, which put the user at a very uncomfortable position to hold the company accountable for anything that it does.

Figure 8: The class waiver in Discord’s terms of service (source)

There are many more caveats with Discord’s privacy policy and terms of service. It is both time-consuming and difficult for an average user with untrained eyes to pick out all of these legal tricks Discord pulled off in its documents. Luckily, an open-source, volunteer-powered project called ToS;DR could help. Many volunteers, including professional lawyers, translate and summarize the complicate legal languages in different platforms’ terms of service documents into plain English to help average users better understand what they’re up against. You can view their page for Discord to see exactly what else is Discord hiding in their documents:

Figure 9: Caveats in Discord’s privacy policy and terms of service listed by ToS;DR

If the reasons above still aren’t enough for you to quit Discord, here are some more. Richard Matthew Stallman has also written a post to discourage people from using Discord. You can also see a more technical analysis here for why Discord is very close to being spyware.

What if I Have to Use It

While Discord might not be the ideal platform for anything private or sensitive, it may still be a compelling or the only option for communications in a lot scenarios. For instance, a conference might entirely be organized on Discord, or the game party that you play with only uses Discord. If you absolutely have to keep using Discord for some reason, here are some tips to minimize Discord’s privacy impact on you:

1. Don’t Send Private/Sensitive Messages

As the previous sections have discussed, Discord isn’t the best place to send private/sensitive messages because Discord can see all your messages and has the power and will to share them to law enforcements. Minimize your conversations and activities on Discord to minimize Discord’s impact on your privacy.

2. Mark Your Chats NSFW

By default, Discord’s explicit content filter reads through all of the messages you send to flag explicit materials NSFW. If you don’t wish this automated service to read all of your chat messages, you can mark your channel NSFW. The explicit content filter will not filter through messages sent in channels labeled NSFW.

3. Use the Web App

Use the web version of Discord in your browser instead of the desktop app. A native desktop application can access a lot of information on your computer, such as what other apps you’re running, how long has your computer been on, and so on. Even if Discord isn’t collecting some information for now, Discord can easily update their app to silently start collecting them in the future. In contrast, modern browsers like Chrome are highly sandboxed so malicious web pages cannot harm your computer. Discord’s web app can access a lot less of your information than its desktop counterpart. Try to run Discord in your browser unless you truly need its desktop-only features.

Figure 10: Login into Discord on your browser (source)

4. Sandbox the Desktop App

If you have to use Discord’s desktop app – perhaps becuase you need a feature that’s only available in the desktop version, consider putting your Discord in a sandbox like Sandboxie or Firejail. These sandboxes will limit Discord’s access to your computer and minimize its footprint on the system.

5. Tweak Discord’s Privacy Settings

There are several settings you can tweak within Discord’s privacy settings to protect your privacy. By default, Discord scans all of your direct chats for explicit content, which means their bot will read all of your messages. You can disable this feature so the bots don’t read your chats:

Figure 11: Discord’s safe direct messaging setting

You can also minimize what Discord can use your data for in the settings. It is also a good idea to periodically request your data from Discord to see how much Discord knows about you.

Figure 12: Discord’s data usage settings

How Using Discord Could Impact Your Digital Identity

Another thing that you should be mindful of is how using Discord could impact your digital identity. Discord is a strongly gamer-flavored platform. Preferring it as your default method of communication might leave the others with the impression that you’re somewhat “unprofessional.” By default, Discord also shows the game that you’re playing or the app that you’re using to other users. The kind of games that you play or apps that you use may also tell the other users things about you.

Figure 13: Discord’s status panel showing what other users are doing

In both Signal and Telegram, you could set self-destruct timers for messages. You can even delete both yours and the other person’s messages in a private chat for both parties. Unlike Signal and Telegram, it is much harder to delete your past messages and conversations in Discord. What you said a long time ago could be easily dug out, so you’ll need to be extra careful about what you say on Discord. They might be used against you someday and ruin your image.

Why Privacy Matters

Almost the entirety of this article is explaining how Discord is undermining your privacy, but a problem I often come across is, “so what?” To answer this question for the viewers that are wondering the same, below are some great resources explaining exactly why privacy is important:

• Privacy Is a Human Right: This article by Tor Project, the organization that built the famous Tor Browser, started a campaign explaining why privacy matters: because it’s a human right. Tor Project’s argument is simple: privacy is important because it’s declared as a human right in the Universal Declaration of Human Rights in 1948, and that is enough reason for people to respect and protect their and other people’s privacy.
• The terrifying now of big data and surveillance: A conversation with Jennifer Granick: One of the issues Discord has is the will to aid law enforcements. In this interview with TED, Jennifer Granick, an American attorney, says “if you care about any political issue – whether it’s tax reform or Black Lives Matter – we need to ensure these people can operate freely in the political world.” When platforms like Discord deprives people’s privacy and toss their data carelessly to authorities, it affects much more than an individual’s comfort. The lack of privacy in a society threatens this society’s free will.

Aside from the resources listed above, a slightly older presentation from 2014 by Glenn Greenwald named Why Privacy Matters also does a fantastic job at explaining the importance of privacy.

- https://k4yt3x.com/discord-discard/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/the-era-of-misinformation/ -

This post is licensed under CC BY-SA 4.0.

“Falsehood flies, and the truth comes limping after it.”

– – Mark Twain, “The Examiner”

The world entered the information age after computers and the Internet was born. Before the modern information highway was built, ordinary people used to have to rely on media such as news papers to obtain information. The birth of Internet enabled individuals to publish and propagate information, which was a great boost to creativity.

However, we may have already entered the era of misinformation. The quote above closely resembles how information propagates today, except Mark Twain never said that, but Jonathan Swift. If you believed Mark Twain ever said that, it only proves the point further.

I would like to attempt to summarize, in this blog post, what misinformation is, why it is harmful, and how to keep yourself afloat in the sea of misinformation. The more that understand misinformation, the less it propagates, and the less harm it causes.

Mis-, Dis-, and Malinformation

Misinformation is a vague term. It mostly means “untruthful information.” However, as more misinformation surfaces, there emerges a need to further classify them to better understand this concept. First Draft, a media that focuses on the topic of misinformation, categorizes misinformation into three categories: misinformation, disinformation, and malinformation. For simplicity’s sake, I will refer to all three of them collectively as misinformation.

Figure 1: Differences between misinformation, disinformation, and malinformation (reference)

Types of Misinformation

First Draft also identifies seven types of misinformation based on the misinformation’s degree of malintent and percentage of false information.

Figure 2: Types of mis-, dis-, and malinformation (reference)

The Harm of Misinformation

Nothing needs to be addressed if there are no issues. Why is misinformation bad for us then?

Because knowing the truth matters.

Knowing the truth empowers us to make the best choices for ourselves and for the society. On the contrary, the propagation of misinformation would often benefit only a small quadrant of people. You might find the workable ethical theories helpful in analyzing this kind of questions.

A study conducted by MIT shows that Tweets with misinformation propagate at a speed of 600% and is 70% more likely to get retweeted as compared to Tweets with genuine information. Contents with misinformation generate a lot of activities and traffic on social media platforms and attract users. As businesses, they have no reason to spontaneously take down what is financially beneficial for them.

Figure 3: Information propagation comparison (reference)

Sometimes misinformation passes us by harmlessly, sometimes they cause dire consequences. A great recent example is the misleading reports of Ivermectin’s effectiveness on Covid-19 for humans have resulted in the public injecting high-doses of Ivermectin in the hope of becoming immune against Covid-19.

Figure 4: A news report from early 2020 saying that Ivermectin kills Covid-19 viruses (source)

This report did NOT make it clear that, while Ivermectin kills Covid-19 in Petri dishes, it is not proven safe for humans. People died after overdosing Ivermectin, believing that it could cure Covid-19. Pouring bleach into the Petri dish would also kill the viruses, but that doesn’t mean you should drink bleach. You could image how such misinformation could also lead to political turmoil or other problems.

Figure 5: xkcd comic, “Cells” (CC BY-NC 2.5)

Eventually, the FDA published an article to debunk the rumours, but people are still believing the rumours. Why?

1. Cognitive Biases

We all have cognitive biases, i.e., inherent brain “defects” which all humans have that hinder us from making perfectly sane and logical judgments. We have a lot of them too. You can take a look at some of the most common cognitive biases here.

Figure 6: The cognitive bias codex (CC BY-SA 4.0)

There are way too many to list, so here are some of the common ones that I think have a lot to do with misinformation.

• Stereotyping: People tend to have a generalized assumption about a particular group of people.
  • A report about Germans suceeding something is more likely to be believed than a report about the Germans screwing something up, because “Germans are rigorous.”
• Confirmation Bias: People tend to selectively gather only evidence that support what they already believe, disregarding conflicting information.
  • When you already firmly believe that Ivermectin will treat Covid-19, you might Google for articles that will support and reinforce your opinion rather than those that contradicts your beliefs. However, what you find may just be more misinformation.
• Bandwagon Effect: People tend to follow the crowd and do what others are doing.
  • “All the news media are reporting that, so that must be true.”
  • “They’re all doing it, so I probably should, too.”
• Reactive Devaluation: People tend to automatically devaluate their adversary’s opinions.
  • A strong supporter of the Democrats may automatically view all policies that the Republicans make deterimental, without actually understanding it.

The cognitive biases that I have listed here are merely the tip of the iceberg. You can start here if you would like to learn more.

2. Rhetological Fallacies

Rhetological is a word that means rhetorical and logical. Rhetological fallacies means rhetorical techniques and logical fallacies. Rhetological fallacies are what can be used to exploit our cognitive biases or simply fool us, leading us to draw illogical conclusions.

For example, the definition of “Circular Logic” is “a conclusion is derived from a premise based on the conclusion.” For instance, some people would argue that privacy only matters to those that have something to hide, so you must be trying to hide something if you want privacy.

There are currently 54 rhetological fallacies identified by David McCandless. Take a look at their beautiful website to see all of them. It is important to be aware of these fallacies so you can identify them when you see them.

Figure 7: Rhetological Fallacies (source)

3. The Inability to Verify

A Stanford research paper finds that professional fact checkers are a lot better at distinguishing genuine information from misinformation than historians and students. Chances are, you suck at verifying too.

Figure 8: Fact-checking success rate between professional fact-checkers, historians, and students

If you do not want to read the whole paper thoroughly, here are some of the important takeaways.

Figure 9: Fact check tips from Stanford’s research (reference)

Fact checking is not an easy task. There is a lot learning to do if you want to fact check efficiently and accurately. Fortunately, there are a lot of materials out there around this topic. First Draft’s Verifying Online Information is an excellent comprehensive guide that you can start with.

The Solution: Trust, But Verify

The purpose of this blog post is not to tell you that the Internet is full of lies and that you shouldn’t take a word from it. Rather, it is to educate you about one of the many dangers you might face when you’re on it.

First Draft’s Verifying Online Information guide lists five fundamental steps you should follow to fact check online information. First Draft calls these five steps the “five pillars of verification.”

• Provenance
  • Check if the content is original and authentic
• Source
  • Check if the content’s source is contaminated
• Date
  • Check the time the content is created/shared
• Location
  • Check the location where the account is established, the website is created, or the content is captured
• Motivation
  • Check why was the account established, the website created, or the content captured.
  • Who would be advantaged by this content? Who would be disadvantaged?

You might have noticed that this post has mentioned First Draft’s Verifying Online Information for more than once. This is because this guide is of good quality. You should definitely check it out if you want to learn more about fact checking.

Helpful Verification Tools

Below are a few of my personal recommended tools that may help you to fact check. There are a lot more tools you can use to fact check out there. Take a look at First Draft’s Toolbox for even more tools you can use.

1. Search Engines

As Stanford’s research paper has suggested, it is important to take bearings and read laterally when you are not sure if a piece of information is genuine. You can use search engines to look up if any other credible sources have published information on the same topic.

2. Manipulated Content Identifier

Dis- and malinformation contain manipulated or fabricated contents. A quick Google reverse image search may help you to determine whether an images has been PhotoShopped. A course by Reuters News Agency will teach you how to identify manipulated media. There are also automated tools like the Fake News Debunker that may come in handy.

3. Fact Checking Websites

A lot of news agencies or organizations host sites that regularly debunk recent rumours. Below are a few of the sites you can go to depending on your region.

• USA
  • FactCheck
  • The Washington Post Fact Checker
• CA
  • FactsCan
• UK
  • Reality Check

4. Google’s Fact Check Explorer

You can fact check using Google’s Fact Check Explorer. Simply enter the question and it will show you a full list of relevant sources and whether they support a claim. Be careful not to overrely on such automated tools. It is still important to read laterally manually.

5. First Draft’s Verification Toolbox

First Draft has created a Verification Toolbox to simplify and streamline the verification process for beginners. You can use this toolbox to look up a wide variety of types of information.

Conclusions

1. Misinformation is everywhere, in many forms, and with many types.
2. Misinformation is bad for you and the society.
3. People trust/like misinformation due to their cognitive biases. You do, too.
4. Become aware of the existence of misinformation and try to avoid believing it.
5. Untrained individuals can hardly identify news. You need to learn how.
6. There are lots of tools and techniques you can use to make fact checking easier.

I hope you found this post useful. Feel free to comment below or contact me if you think any of the information in this post is inaccurate or missing.

- https://k4yt3x.com/the-era-of-misinformation/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/automatically-renew-certbot-certificates-with-systemd-timers/ -

It could be tiresome to have to manually renew your Let’s Encrypt certificates using Certbot on your VPSs every few months. This gets increasingly frustrating as you have more services and thus, more certificates to renew. Having to renew them manually is also quite detrimental to the scalability of your services and infrastructure. Therefore, there emerges a need to enable the certificates to self-renew. This article will introduce a relatively new way to perform automatic certificate renewal with systemd timers instead of traditional ways such as crontab.

Why? Because on a system with systemd, it is easier to have everything managed through systemd.

In order to achieve auto-renewal of certificates, we will need to write two systemd unit files: a service unit which defines what to execute, and a timer which defines when to execute.

Writing a Service Unit

In simple terms, the systemd service file defines the commands to be executed for the certificate renewal. You can think of it to be similar to a script. Here are some noteworthy points:

• Type=oneshot: This option makes the service unit behave more like a script. The unit will not become a daemon, and you can define multiple ExecStart entries which will execute in serial. If any of the entries fail, the unit is considered failed.
• The first ExecStart: Launches Certbot in -n (non-interactive) mode to renew the certificates. More arguments can be added as needed.
• The second ExecStart: Optional. Certbot needs to listen on port 80 for web-based authentication. Since port 80 is a privileged port, Certbot needs to run with root privileges. However, this means that the certificates saved will be owned by root:root. This second command yields the ownership of the certificates. You can modify this command as needed.
• The third ExecStart: Restart the service(s) using the expiring certificates so they can load in the refreshed certificate. reload might also be supported by some services as a more graceful version than restart.

This example below is written for one of my matrix-synapse servers. Since Certbot requires root privileges to listen on port 80 to renew the certificates, the renewed certificates it releases into /etc/letsencrypt are also owned by root:root. My coarse solution for this problem is to simply use a chown command to yield the ownership of the needed directories to the service’s group ssl-cert per the conventions. The user matrix-synapse is a member of the ssl-cert group, which gives it access to the certificates and keys.

Of course, should you have multiple services running on the same server or just wish to have more fine-grained permissions, you can always design a more intricate chown command or seek an alternative solution for the permissions. I am merely demonstrating the bare minimums here.

Another thing worth mentioning is that if you have Certbot installed via pip (not that you should) instead of a package manager, Certbot will be at /usr/local/bin/certbot instead of /usr/bin/certbot.

1 2 3 4 5 6 7 8 9 10 11 12 13 [Unit] Description=Renew Certbot certificates Wants=certbot-renew.timer [Service] Type=oneshot WorkingDirectory=/etc/letsencrypt ExecStart=/usr/bin/certbot renew --standalone -n ExecStart=/usr/bin/chown root:ssl-cert -R /etc/letsencrypt/archive /etc/letsencrypt/live ExecStart=/usr/bin/systemctl restart matrix-synapse [Install] WantedBy=multi-user.target

Unit file: /etc/systemd/system/certbot-renew.service

Writing a Timer Unit

The timer file controls when/how often the service file is executed.

• OnCalendar=daily: Denotes that the service file above should be executed on a daily basis.
• Persistent=true: The last time the timer is ran is stored on disk. If for whatever reason (e.g, power-off) the timer was not executed on-time, it will be executed immediately when the timer is next loaded.

1 2 3 4 5 6 7 8 9 [Unit] Description=Daily Certbot renew [Timer] OnCalendar=daily Persistent=true [Install] WantedBy=timers.target

Unit file: /etc/systemd/system/certbot-renew.timer

- https://k4yt3x.com/automatically-renew-certbot-certificates-with-systemd-timers/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/linux-asynchronous-copy-and-paste/ -

Asynchronous copy-paste can be helpful in a handful of situations:

• You can save the path in the clipboard and paste it later.
• You don’t have to work with super-long copy/move commands.
• Etc. (use your imagination)

Source Code

You can add the following code snippet to your zshrc to add the three commands into your shell. Note that some of the syntaxes in this snippet are zsh-only. You might need to modify it a bit if you want to use it in bash or other shells.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 # async copy function ac() { unset ACOPY unset AMOVE export ACOPY=("${(@f)$(realpath -e $@)}") } # async move function am() { unset ACOPY unset AMOVE export AMOVE=("${(@f)$(realpath -e $@)}") } # async paste function ap() { if [ ! -z "$ACOPY" ]; then cp -vr "${ACOPY[@]}" . elif [ ! -z "$AMOVE" ]; then mv -v "${AMOVE[@]}" . unset AMOVE else >&2 echo 'clipboard empty' return 1 fi } Copying Files and Directories

You can use the ac (stands for async-copy) command to copy one or more files/directories, and use the ap (stands for async-paste) command to paste it when you’re under another directory. Directories will be copied recursively automatically.

Asynchronously copying files and directories to a new location

Moving Files and Directories

You can use the am (stands for async-move) command to move one or more files/directories, and use the ap command to paste it elsewhere.

Asynchronously moving files and directories to a new location

- https://k4yt3x.com/linux-asynchronous-copy-and-paste/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E6%8C%82%E8%BD%BD-dd-%E9%95%9C%E5%83%8F%E4%B8%AD%E7%9A%84%E5%88%86%E5%8C%BA/ -

旧系统在重装之前备份到了 dd 镜像，而重装完了之后发现有些文件遗忘在了原先的 EFI 分区。我将在这篇 post 中简单讲述我是怎么将 dd 镜像里的分区挂载到系统并且取回文件的。

1. 将 dd 镜像挂载为 loop 设备

我的硬盘镜像文件名为 vagrant.dd，所以我可以使用以下命令将该 dd 镜像挂载为 loop 设备。losetup 命令会自动扫描 dd 镜像中的分区并将其挂载到 /dev/loopX。这里的回显显示所有分区都被挂载到了 /dev/loop0 下。

1 2 $ sudo losetup --partscan --find --show vagrant.dd /dev/loop0

挂载完成后，我们可以用 lsblk 命令查看新的 loop 设备，加上 -f 开关则可以显示设备的文件系统信息。

1 2 3 4 5 6 $ sudo lsblk -fp /dev/loop0 NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINT /dev/loop0 ├─/dev/loop0p1 vfat FAT32 1396-7EA5 ├─/dev/loop0p2 ext2 1.0 c5da8f36-6698-4478-97a8-93101bf44bb8 └─/dev/loop0p3 crypto_LUKS 2 7a3d56b5-20f8-44f2-b1a7-8c858bba342c 2. 挂载文件系统

在挂载完环回设备后，接下来的挂载就和挂载普通文件系统无异了。只需要用 mount 命令将 loop 设备挂载到任意挂载点即可读取。

1 2 3 4 5 $ sudo mount -o ro /dev/loop0p1 ~/boot $ k ~/boot total 16 drwxr-xr-x 4 root root 4096 12 Aug 2020 EFI drwxr-xr-x 2 root root 4096 12 Aug 2020 System Volume Information

全流程截图

3. 解除挂载

使用完毕之后，按顺序解除两个挂载即可。

1 2 sudo umount ~/boot sudo losetup -d /dev/loop0 - https://k4yt3x.com/%E6%8C%82%E8%BD%BD-dd-%E9%95%9C%E5%83%8F%E4%B8%AD%E7%9A%84%E5%88%86%E5%8C%BA/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E7%94%A8-cheat-engine-%E7%BB%99%E8%B5%9B%E5%8D%9A%E6%9C%8B%E5%85%8B-2077-%E5%86%99%E4%B8%AA%E7%AE%80%E5%8D%95%E6%B3%A8%E5%85%A5%E5%A4%96%E6%8C%82/ -

在本文中我将展示如何用 Cheat Engine 给 Cyberpunk 2077 写一个非常简单用注入的方法实现的的无限子弹外挂。该教程的目的仅仅是为了演示如何制作一个 Cheat Engine 注入脚本，而为了达到无限子弹的效果很可能有更便捷更稳定的方式，例如寻找基址，不过该话题不在本教程讨论范围之内。

当然，请仅在本地游戏中学习实验这些技术，不要将该技术用于破坏多人游戏的平衡上。Hack ethically and responsibly.

我还是第一次写类似的教程，在逆向工程方面的经验也尚浅。如有错误，还恳请包含并指出，感激不尽。

寻找内存地址

首先，启动游戏，并且将 Cheat Engine 附加到 Cyberpunk 2077 的游戏进程上。

然后随便掏出一把枪，可以看到目前弹匣内弹药有 30 发。

接下来在 Cheat Engine 中搜索 4-byte，值为 30 的所有内存地址。使用 4-byte 是因为很多游戏内类似的整数使用的都是无符号整型的数据类型，在 x64 的系统上也就是一个 DWORD，或 32-bit (4 bytes)。因此扫描 4-byte 的数据类型最有可能找到我们想要的数字。当然，有些数据也有可能使用的是 WORD 或 FLOAT 之类的类型进行存储，这时我们就需要调整 Cheat Engine 扫描的数据类型以匹配寻找的数据类型了，否则将会找不到我们想要寻找的数据。具体都有哪些数据类型可以在 Windows 文档中查看：https://docs.microsoft.com/en-us/windows/win32/winprog/windows-data-types

回到游戏中，随便打几发消耗掉一些弹药使内存中的数据产生变化。

然后再回到 Cheat Engine 搜索值为新弹药数量的地址以筛选掉无关的数据。

重复几次该过程之后，最终我们会将搜索结果缩小到数个地址，但我们仍然不知道哪个是实际储存弹药量的地址，因为在消耗弹药之后这几个地址的值均会变化。

这时我们就可以通过简单的二分法排查实际存储弹药量的地址。选中一半的数据并且修改掉，然后回游戏内查看修改是否有效。

我们可以看到，当我们改动了最后四个地址的值，游戏内的弹药量也改变了（此处需开几枪刷新下弹药数量），说明我们需要找的地址在这四个地址之内。

接下来重复该过程，直到排查出我们需要的地址。

最后确定是以下地址保存着弹药量。双击该地址就可以将他添加到下面的目录里。

当我们修改该地址的值，游戏内的弹药量也会随之变化。虽然我们已经有了存储弹药量的临时地址，但是该地址在重启游戏或重新加载存档后便会改变。要想做到重启游戏后外挂仍然生效，必须修改游戏代码或者寻找该数据的基址（也可能有其它方式）。本教程将只会讲述如何用注入的方法修改游戏代码来实现重启后外挂仍然生效的效果。

分析汇编代码

接下来我们需要寻找程序里将新的弹药量写入该地址的指令以方便修改该逻辑。右键刚刚搜索到的地址并且选择 Find out what writes to this address。

Cheat Engine 会需要在游戏进程上挂一个调试器，选择允许。这里比较有意思的是，x64dbg 附加到游戏进程上之后，游戏会不停的报 access violation，IDA Pro 附加到进程上之后游戏可以正常运行，但是一下断点就同样报 access violation。Cheat Engine 不但可以正常 attach，还可以正常下断点，看来是有对抗反调试的措施。

然后我们再返回到游戏里，消耗掉一些子弹，让游戏向地址里写几次数据。这里原来的子弹量是 30 发，我开了 14 枪，剩下了 16 发子弹。

这时候返回调试器可以看到第二行的汇编代码向该地址写了 14 次数据，正好对应了我们打出的 14 发子弹，应该就是这行代码负责将计算后的子弹数写入内存。接下来选中该行，并且打开反汇编界面。

反汇编窗口会将程序的机器码转为汇编代码以供阅读，这部分会需要写汇编基础才能看懂。我们可以在该窗口内看到 mov [rsi+340],r12d 的命令，意思为将 r12d 寄存器内的数据移动到 RSI 指向的地址正向偏移 340 bytes 的位置。可以看出 r12d 便是计算完毕的子弹数量，而 rsi+340 这个地址便是存放子弹数量的地址。

再向上找，我们可以找到这条减法操作，子弹数量的减少就是由该条命令计算的。现在我们可以制作一个简单注入，让该减法变成加法，子弹就会越打越多。

制作注入脚本

首先，选中要修改的行，然后从工具菜单里打开 Auto Assemble 界面。

我们要制作的是一个 full injection，所以可以直接使用 Cheat Engine 提供的 full injection 模板。至于 full injection 和 AOB injection 具体都是些什么以及有什么区别，Google 讲的肯定比我好。

程序会让您选择需要注入的地址，并且会自动填入刚刚在反汇编界面选中的地址，这里直接点击确定即可。

自动导入的 full injection 模板如下。本教程将不会详细讲述各个部分的具体含义，有需要的话可以自行查询 Cheat Engine 的官方文档。我们在 code 代码段可以找到程序中我们需要修改的 sub cx,di 命令，接下来修改该行即可。

我们将减法的 sub 改为加法的 add 以反转子弹数量的计算，然后就可以在菜单中用 Assign to current cheat table 将该脚本添加到主窗口的目录里。当然，除了反转子弹的计数，还可以将该行改成 NOP 锁死子弹数量等，您可以自由发挥。

添加完毕之后，在主窗口便可以找到名为 Auto Assemble script 的脚本。启用该脚本之后，原来的减法指令会变成跳转。这里的原理是，Cheat Engine 会 allocate 一块未使用的内存地址并且将改动后的代码写入到该地址中，然后将原程序中要修改的部分跳转到新的代码处，执行完毕之后再跳转回程序原来的位置。

至此，一个简单的无限子弹外挂就制作完毕了。激活脚本后再返回游戏中就可以发现子弹的确越打越多了。您可以将该脚本重命名并且保存为一个 cheat table，在下次启动游戏的时候加载 cheat table 并启动脚本便可开启该外挂。

进一步分析

您也可以在 IDA Pro 等软件里进一步分析游戏的代码，毕竟 Cheat Engine 的反汇编看起来的确没有 IDA Pro 的流程图容易，也没有反编译功能。

首先，在反汇编界面里复制命令的地址。

然后，在 IDA Pro 中选择 rebase program 来查看 IDA Pro 目前使用的 image base。

随后，将 Cheat Engine 里的 offset 和 IDA Pro 里的 image base 相加，便可得到该命令在 IDA Pro 中的地址。

最后跳转到该地址，便可以开始分析了。

- https://k4yt3x.com/%E7%94%A8-cheat-engine-%E7%BB%99%E8%B5%9B%E5%8D%9A%E6%9C%8B%E5%85%8B-2077-%E5%86%99%E4%B8%AA%E7%AE%80%E5%8D%95%E6%B3%A8%E5%85%A5%E5%A4%96%E6%8C%82/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/hack-the-box-unbalanced-write-up/ -

This post walk though how I pwned the machine “Unbalanced” on Hack The Box. This machine is fairly challenging for me as my first machine on Hack The Box, but it’s also quite interesting and rewarding. Bare with me now as I unveil how I completed this machine.

The rest of this article is AES-encrypted since the machine is still live. Please decrypt the rest of this article with the root flag. The rest of this article will be made public once the machine is offline.

1. Reconnaissance

With a simple Nmap scan we can see that ports 22, 873 and 3128 are open on the target machine. These ports indicate that the server might be running an OpenSSH server, an rsync daemon and a Squid proxy server.

A more detailed Nmap scan shows that there are multiple vulnerabilities on the server’s OpenSSH and Squid proxy service. The OpenSSH vulnerabilities are not useful for getting into the server, whereas the Remote Code Execution (RCE) vulnerabilities don’t seem to work on this server.

However, this scan does show that the port 873 is, indeed, running the rsync daemon service.

2. Getting User Access 2.1. EncFS Backup Files

A simple rsync command can list the modules on the server. This server seems to host an rsync module which contains EncFS-encrypted configuration file backups.

Since this rsync module is not password-protected, it can be pulled to the local machine easily. These files indeed look like EncFS files.

EncFS’s password has can be converted to a format which John can recognize using John’s built-in encfs2john.py script.

We can then use John the Ripper to attempt cracking the hash. I’m choosing a dictionary that seems appropriate from the SecLists repository. John manages to crack the password tobe bubblegum.

With this password, the EncFS file system can be decrypted and mounted. We can see that there are, indeed, a lot of configuration files in this encrypted file system.

grep can be used to quickly filter out any useful information. rg (ripgrep) is a faster implementation of grep. I prefer using it for its higher efficiency. This simple search finds out that Squid’s configuration backup contains the plain text password for Squid’s cache manager. This line of configuration also shows a list of pages the cache manager is allowed to view.

Since Squid is an exposed service, we can see if there’s anything else in the configuration file that can help us attacking this service. The permitted destination domains and IP addresses are also defined in the configuration file.

2.2. Web Exploitation

Since we know a domain name that can be accessed through the proxy server, we can set up a browser to use the Squid proxy to visit this site.

After configuring the HTTP proxy, the site intranet.unbalanced.htb can be visited in the browser. I have scanned this site with gobuster, and it doesn’t seem like this site has any other directories accessible. I have also tried scanned it with sqlmap and performing some manual injections, but this site does not appear to be vulnerable to SQL injection attacks either.

Since the 172.16.0.0/12 subnet is too large to enumerate, I decided to leave this page be for now and move on with the Squid credentials.

With Squid cache manager’s password, the Squid Client can be installed to interact with the Squid server’s management interface. We can try to view a page to verify that the password works.

After going through each of the pages, the fqdncache page shows something interesting. There seems to be more than one web server hosting the “intranet” web page. 172.17.0.1 seems to be a load balancer, where 172.31.179.2 and 172.31.179.3 seems to be two web servers. The host 172.31.179.1 seems to be missing from the 1-3 range.

It turns out that the server 172.31.179.1 is still accessible. A note on the web pages says that it’s been taken down for security maintenance.

Since the load-balanced website has a full URL of http://intranet.unbalanced.htb/intranet.php, I tried to see if the file intranet.php is still accessible on this server. This file happens to still be accessible.

sqlmap doesn’t seem to be able to find any working payloads for this page. --risk=3 --level=5 does not work either.

However, a simple manual injection test using the 'or'='or' master key shows that this website is actually vulnerable to SQL injection attacks. This simple injection shows us that there are four users in the database: rita, jim, bryan and sarah.

In order to perform further injections, I wrote down the possible SQL executed in the background for this page.

1 SELECT FROM users WHERE Username='$Username' AND Password='$Password'

When the clause 'or'='or' is injected into this command, the following command is executed in the background. The result will be false OR true OR false AND false OR true OR false, which is true when evaluated.

1 SELECT FROM users WHERE Username=''or'='or'' AND Password=''or'='or''

Then I attempted to extract the password. I came up with the two following statements. Injecting LIKE clauses does not seem to work, but injecting SUBSTRING clauses does seem to return some results. I was able to manually brute force the first character of user Bryan’s password.

1 2 SELECT FROM users WHERE Username='' AND Password='' OR Password LIKE 'a%' SELECT FROM users WHERE Username='' AND Password='' OR substring(Password,1,1)='a'

Since manual brute-forcing is too time-consuming, I decided to develop a simple Python script to do the job. Note that this script requires third-party libraries bs4 and requests to run.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 #!/usr/bin/python3 # -*- coding: utf-8 -*- """ Name: Unbalanced SQL Injection Script Dev: K4YT3X Date Created: October 3, 2020 Last Modified: October 3, 2020 """ # built-in imports import string # third-party imports from bs4 import BeautifulSoup import requests users = ["rita", "jim", "bryan", "sarah"] for user in users: print(f"{user}: ", end="", flush=True) for i in range(1, 31): for c in string.printable[:94]: print(c, end="", flush=True) r = requests.post("http://172.31.179.1/intranet.php", data={"Username": "nobody", "Password": f"' or substring(Password,{i},1)='{c}"}, proxies={"http": "http://10.10.10.200:3128"}) soup = BeautifulSoup(r.text, "html.parser") if d := soup.find("div", {"class": "m4"}): if [p for p in d.find_all("p", {"class": "w3-opacity"}) if p.text.strip() == user]: break print("\b", end="", flush=True) else: print(" ") break

When executed, this script gives us the following results. These passwords can be used to login to the web page, but the web page only displays the user’s name, email and role when a user is logged in. However, maybe these passwords can be used elsewhere.

Recall that this server also hosts a OpenSSH server. These credentials can then be tested against the OpenSSH service to see if any of the users exist on the server and uses the same password as his/her login credentials. User bryan can be logged in with password ireallyl0vebubblegum!!!. This gives us user access into the server.

3. Privilege Escalation 3.1. Collecting Information

The first thing I start looking for is SUID files. A poorly programmed custom SUID file can lead to privilege escalations. However, it doesn’t look like there are any custom SUID files in the system.

uname -a shows that the server’s Kernel version is 4.19.0. searchsploit command suggests that this kernel may have several vulnerabilities.

Metasploit Framework module post/multi/recon/local_exploit_suggester is a module that can automatically detect if an exploited host has privilege escalation vulnerability. However, this module doesn’t seem to find any working exploits for the target system. Finding a working kernel exploit manually is time-consuming, so we can try looking for other ways to escalate our privileges for now.

Other than the user.txt flag under user bryan’s home directory, there’s also another file named TODO. This file seems to be the TODO notes from the system administrator bryan. It has to main sections: 1) intranet website TODOs, 2) Pi-hole installation TODOs. This is a hint that the Pi-hole service is worth looking into.

Since this system runs Debian 10, it uses systemd as its service manager. Running services can be listed with the command systemctl list-units --state=running. We can see that the Docker service is running. The Pi-hole service may be running in a Docker container.

Since the Docker service can be used for privilege escalation, I decide to test if user bryan is assigned access to use the docker command. Unfortunately, this user is not allowed to use the docker command. This also means we cannot find out information about the running containers.

In order to find out if there are any running Docker containers, the ip a command is issued to list the network interfaces and the system’s IP addresses. The system is found to have a Docker network bridge that has the address 172.31.0.1/16. If any of the Docker containers on that bridge is communicating with the host, its IP address will show up in the ARP cache. Indeed, we can see the IP address 172.31.11.3 in the ARP cache.

Visiting this IP address with the browser takes us to Pi-hole’s landing page. This seems to be the Pi-hole service we are looking for.

3.2. Exploiting Pi-hole

Pi-hole’s default administrator passwords are randomized upon installation. However, recall that the TODO notes says that a temporary password has been set for the admin. I then tried some common passwords like password, 12345 and admin. admin happens to work and takes us directly into Pi-hole’s management interface.

On the bottom of the management page, we can see that the Pi-hole’s version is 4.3.2.

A quick search in Google lead me to this article: CVE-2020-11108: How I Stumbled into a Pi-hole RCE+LPE. It seems like this version of Pi-hole is has a RCE vulnerability, which can also be used for gaining root access.

First, we need to prepare two PHP payloads before executing the attack. I’m using MSFvenom to generate two PHP reverse shell payloads.

Then, we can follow the guide and add a blocklist entry as shown in the screenshot. At the same time, we’ll start an Ncat listening on port 80 on the workstation to listen for incoming connections.

Upon clicking the Save and Update button, Ncat receives an incoming connection. We can proivde a 200 response with some random data as instructed in the blogpost.

Clicking the Update button will instruct Pi-hole to run another update. Ncat will receive a second request on port 80. We can paste the first PHP payload in.

Visiting the fun.php payload we just uploaded returns a shell with www-data privileges to our machine.

Following the tutorial, we can proceed uploading the second payload to teleport.php.

The second payload can then be triggered by executing sudo pihole -a -t in the first www-data shell. This returns a shell with root privileges.

After poking around, we can see this Pi-hole configuration script with a hard-coded plain text password bUbBl3gUm$43v3Ry0n3!.

3.3. Getting root

This password can be used to login to user root in the host machine as well. We now have root access on the host machine.

4. Conclusions

The box Unbalanced is my first machine on Hack The Box. I think getting user is much more difficult than getting root. The player must go through multiple layers (rsync => EncFS => Squid => Squid Client => SQL Injection) before finally getting credentials for the user bryan. This path carefully designed to give the player guidances along the way, and it’s also fairly close to a real-life scenario.

Unlike gaining user access, gaining root access is pretty straight-forward. It only requires following a single guide which you can easily find on Google to get user root’s password.

Overall, I think I have enjoyed this box much. Finding leads in this box is a painful process, but it also makes you feel rewarded once you finally find one.

- https://k4yt3x.com/hack-the-box-unbalanced-write-up/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/allow-isc-bind-to-perform-recursive-reverse-lookups-of-lan-ip-addresses/ -

ISC BIND sends immediate and authoritative NXDOMAIN responses to recursive lookups of LAN addresses by default. This prevents recursive lookup servers from sending meaningless requests to other DNS servers on the Internet. This tutorial will cover how recursive reverse lookups of LAN addresses can be enabled in BIND for lab environments and other special cases.

BIND Automatic Empty Zones

BIND automatically creates empty zones defined in RFC 6303 to avoid meaningless lookups of LAN address. Below are some of the zones include in the list. For a more detailed explanation on how automatic empty zone works, please visit ISC’s documentation for BIND.

• 10.IN-ADDR.ARPA
• 16.172.IN-ADDR.ARPA
• 17.172.IN-ADDR.ARPA
• 18.172.IN-ADDR.ARPA
• 19.172.IN-ADDR.ARPA
• 20.172.IN-ADDR.ARPA
• 21.172.IN-ADDR.ARPA
• 22.172.IN-ADDR.ARPA
• 23.172.IN-ADDR.ARPA
• 24.172.IN-ADDR.ARPA
• 25.172.IN-ADDR.ARPA
• 26.172.IN-ADDR.ARPA
• 27.172.IN-ADDR.ARPA
• 28.172.IN-ADDR.ARPA
• 29.172.IN-ADDR.ARPA
• 30.172.IN-ADDR.ARPA
• 31.172.IN-ADDR.ARPA
• 168.192.IN-ADDR.ARPA
• 100.51.198.IN-ADDR.ARPA
• 113.0.203.IN-ADDR.ARPA
• 8.B.D.0.1.0.0.2.IP6.ARPA
• More zones omitted

When BIND is started, these following messages can be found in syslog.

syslog logging the creation of automatic creations of empty zones

Disabling BIND’s Automatic Empty Zones

To allow recursive lookup servers to perform lookups for LAN addresses, the respective automatic empty zones must be disabled in BIND’s config. You may either disable specific automatic zones or disable the creation of all automatic empty zones altogether.

1 2 3 4 5 6 7 options{ # disable a specific automatic empty zone disable-empty-zone "168.192.IN-ADDR.ARPA"; # disable all automatic empty zones empty-zones-enable no; }

The screenshot below shows an example of disabling the automatic empty zone 168.192.IN-ADDR.ARPA.

Modified BIND configuration file

Restart the BIND server after that, and recursive reverse lookups of LAN addresses should start working.

Successful recursive reverse lookup of LAN IP 192.168.14.80 using dig

References

• Automatic empty zones (including RFC 1918 prefixes): https://kb.isc.org/docs/aa-00800
• RFC 1918 Address Allocation for Private Internets: https://tools.ietf.org/html/rfc1918
• RFC 6303 Locally Served DNS Zones: https://tools.ietf.org/html/rfc6303

- https://k4yt3x.com/allow-isc-bind-to-perform-recursive-reverse-lookups-of-lan-ip-addresses/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/vmware-workstation-%E9%80%9A%E8%BF%87-dhcp-%E5%88%86%E9%85%8D%E9%9D%99%E6%80%81-ip/ -

当您在 VMware 中安装了多台虚拟机，虚拟机的 IP 地址配置将会成为一个问题：进入每台虚拟机手动配置地址将会过于繁琐，而 VMware 自带的 DHCP 服务器的行为又无法在 GUI 中控制。

很多人可能不知道其实 VMware 自带的 DHCP 服务器就是随处可见的 ISC DHCP 服务器（dhcpd）。每个 VMware 接口都有一份 dhcpd 配置，并且用户可以像配置普通 dhcpd 一样编写这些配置来自定义 dhcpd 的行为。在此篇教程中我将记述如何通过更改该 VMware 的 DHCP 配置文件来手动分配访客网卡的 IP 地址。

VMware DHCP 配置文件

VMware 的配置文件可在系统的以下位置找到：

• Linux: /etc/vmware/{接口名称}/dhcpd/dhcpd.conf
• Windows: C:\ProgramData\VMware\vmnetdhcp.conf

例如，在我的 Linux 系统上，NAT 接口（vmnet8) 的 DHCP 文件就在 /etc/vmware/vmnet8/dhcpd/dhcpd.conf。该文件出厂大致内容如下：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 # 略：一些注释 ###### VMNET DHCP Configuration. Start of "DO NOT MODIFY SECTION" ##### # 略：一些注释 # Written at: 10/17/2020 02:13:22 allow unknown-clients; default-lease-time 1800; # default is 30 minutes max-lease-time 7200; # default is 2 hours subnet 172.31.0.0 netmask 255.255.0.0 { range 172.31.128.0 172.31.255.254; option broadcast-address 172.31.255.255; option domain-name-servers 172.31.0.2; option domain-name localdomain; default-lease-time 1800; # default is 30 minutes max-lease-time 7200; # default is 2 hours option netbios-name-servers 172.31.0.2; option routers 172.31.0.2; } host vmnet8 { hardware ethernet 00:50:56:C0:00:08; fixed-address 172.31.0.1; option domain-name-servers 0.0.0.0; option domain-name ""; option routers 0.0.0.0; } ####### VMNET DHCP Configuration. End of "DO NOT MODIFY SECTION" #######

现在如果我们想将一台 CentOS MAC 地址为（00:0C:29:BA:D4:48）的网卡绑定到 IP 地址 172.31.1.3，则只需要在该配置文件最后一行备注以下添加以下内容即可：

1 2 3 4 5 6 ####### VMNET DHCP Configuration. End of "DO NOT MODIFY SECTION" ####### host centos { hardware ethernet 00:0C:29:BA:D4:48; fixed-address 172.31.1.3; }

重启 vmware 服务（e.g., systemctl restart vmware）或者重启宿主之后该配置便会生效。当我们再次启动 CentOS 并用 DHCP 获取地址，就会发现 IP 地址已经和 DHCP 配置里写入的地址一致了。

CentOS 中自动获取的 IP 地址已遵照新配置文件中的规则

请注意在升级 VMware Workstation 之前备份 dhcpd.conf 文件，VMware Workstation 升级时可能会删除旧的 dhcpd.conf。

参考资料

• https://docs.vmware.com/en/VMware-Workstation-Pro/15.0/com.vmware.ws.using.doc/GUID-04D783E1-3AB9-4D98-9891-2C58215905CC.html
• https://communities.vmware.com/message/1888335#1888335

- https://k4yt3x.com/vmware-workstation-%E9%80%9A%E8%BF%87-dhcp-%E5%88%86%E9%85%8D%E9%9D%99%E6%80%81-ip/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/2020-firefox-%E5%AE%89%E5%85%A8%E9%9A%90%E7%A7%81%E5%AE%9E%E7%94%A8%E6%89%A9%E5%B1%95%E6%8C%87%E5%8D%97/ -

新版本的 Firefox 加入了越来越多的隐私和安全相关功能，不过单凭 Firefox 自带功能还远远不能提供理想的安全上网体验。本篇文章将会介绍一些我目前使用的安全、隐私和实用相关的 Firefox 扩展，让网页浏览变得更加安全快捷。本文将着重介绍安全和隐私相关扩展，而对开发相关和实用性扩展一笔带过。扩展按字母顺序排序，可以通过右侧的目录来快速浏览。本文专业内容较多，如果有不正确或者可以改进的地方，请联系作者，我会立即更改。

安全隐私相关扩展 Behave!

• 防止 DNS rebind 攻击
• 防止浏览器访问私有 IP 地址
• 防止端口扫描

当浏览器企图用 JavaScript 进行 IP 地址端口扫描时，Behave! 会记录并警告用户

可以到项目 GitHub 了解技术细节：https://github.com/mindedsecurity/behave

Canvas Blocker

Canvas Blocker 扩展可以生成虚假的随机信息来欺骗各种追踪器。它可以伪装以下 API 的信息：

• canvas 2d
• webGL
• audio
• history
• window（默认禁用）
• DOMRect
• navigator（默认禁用）
• screen

Canvas Blocker 的设置较为复杂，需要了解上述的 API 才能较好地进行定制。

ClearURLs

不少网站会在用户分享的链接中植入 UTM 参数以跟踪访问来源等。例如在如下的 Reddit 分享链接中，?utm_medium=android_app&utm_source=share 就是 UTM 参数。这两个参数告诉网站，这次的用户访问是通过分享链接访问的，而分享这个链接的设备运行的是 Android 系统。

https://www.reddit.com/r/linux/comments/hfkdlg/craig_federighi_confirms_apple_silicon_macs_will/?utm_medium=android_app&utm_source=share

下面的例子来源于 Amazon，其中 ref=sr_1_2?dchild=1&keywords=cisco&qid=1392922149&sr=8-2 的部分记录了各种信息，例如用户是搜索 Cisco 关键词后找到的这个商品。

https://www.amazon.com/SYSTEMS-10-Port-Gigabit-Managed-SG35010K9NA/dp/B01HYA36SG/ref=sr_1_2?dchild=1&keywords=cisco&qid=1392922149&sr=8-2

作为一个对隐私比较偏执的用户，我并不希望网站知道类似于我是从谁获得的链接，分享链接给我的人使用了什么关键字找到的这个链接这些多余的信息。ClearURLs 会自动将链接中的此类追踪参数全数删除，让网站只知道您请求了该网页，而无从获知这些多余的信息。

例如上述的 Amazon 页面就会被清理成这样，既简洁又保护了隐私。

https://www.amazon.com/SYSTEMS-10-Port-Gigabit-Managed-SG35010K9NA/dp/B01HYA36SG

Decentraleyes

很多网站会从 jQuery CDN 或者 Google Hosted Libraries 这样的第三方 CDN 加载流行的 JavaScript 框架。这样可以有效减轻网站的服务成本，同时也可以使用 CDN 的资源来加快加载速度。

例如下面的代码就会从 Google Hosted Libraries 加载 3.5.1 版本的 jQuery，而无需开发者在网页上额外保存一份 jQuery 副本。

1 <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>

Decentraleyes 本地缓存了很多这样的文件。网站在向 CDN 请求文件的时候，Decentraleyes 就会拦截这些请求并且使用本地已经缓存好的文件。这么做既可以节省带宽，加快加载速度，也可以让用户摆脱对集中式网络的依赖以保护隐私。

Decentraleyes 工作原理

Don’t touch my tabs!

当您通过点击 URL 打开新的标签页时（target=_blank），新打开的窗口会拥有一个 window.opener 对象指向前一个网页的 window 对象。简而言之，新打开的标签页面可以控制前一个网页上的内容。

您可以通过 https://mathiasbynens.github.io/rel-noopener/ 这个网站更好的了解并体验这个机制。在禁止这个特性之前，可以通过点击图中的 URL 打开新的非同源页面。

rel=noopener 演示页面

如果该特性没有被禁止，网页会让您返回查看先前的页面。

打开的新标签页

此时可以发现先前的页面已经被新的页面篡改。这个问题的存在意味着恶意网站可以向打开它的页面中植入恶意代码。

被篡改的原网页

向网页中的 HTML 标签中加入 rel="noopener" 属性可以让新打开的页面中的 window.opener 等于 null，使新的页面无法访问先前的页面。然而此项功能是可选的，并且依赖您访问的网站来添加此标签。Don’t touch my tabs！ 扩展会自动在非同源链接后加上 rel="noopener" 来确保您的网页不会被此方法篡改。

扩展自动在 HTML 标签里加入了 rel=“noopener” 属性

Firefox Private Network

Firefox 联合 Cloudflare 出品的代理扩展，目前仅在美国地区进行公测。如果需要加入公测需要 IP 地址在美国，可以通过代理或者 VPN 做到。早期加入公测的用户可以无限时地使用 FPN，但是新用户每个月仅可使用 12 小时。我很幸运在早期就了解到了这款扩展，所以目前可以无限白嫖使用。

Firefox Private Network 处于运行状态

在使用了此扩展之后，所有浏览器的流量将从 Cloudflare 网络代理，网站仅能看到 Cloudflare 节点的地址。

IPInfo 显示浏览器 IP 地址为 Cloudflare 节点 IP

Forget Me Not

Forget Me Not（勿忘我）是一款可以清理浏览器 Cookie、浏览历史、网站缓存等数据的扩展。您可以自定义清理规则，例如清理时忽略某个网站，或者 Firefox 启动时清理清理 Cookie 和 历史。您也可以把这款扩展当作 Cookie 自动清理器来使用，在离开某个网站 N 分钟之后自动删除该网站的 Cookie、Local Storage、历史等。

下面的截图中，*.mozilla.org（所有 mozilla.org 网页）的清理作业被全部忽略，自动和手动清理时就相应的不会清理 Mozilla 网站的数据。

Forget Me Not 网站规则

下面的规则页面规定了何种数据应该在自动清理时被清除。

Forget Me Not 规则

HTTPS Everywhere

当用户访问某个网站并且没有指定使用不安全的 HTTP 协议还是使用安全的 HTTPS 协议时，EFF（电子前哨基金会）开发的 HTTPS Everywhere 扩展会自动判断目标网站是否支持 HTTPS，并且如果网页服务器支持 HTTPS 则自动跳转到 HTTPS 页面。

HTTPS Everywhere 原理

在此之上，HTTPS Everywhere 还能够强制仅加载支持安全连接的网页元素，所有不使用 HTTPS 加载的图片、脚本等元素全部都会被过滤。虽然这样做可以极大增强浏览的安全性，但是很有可能会让很多网站无法正常显示，所以此功能请谨慎使用。

HTTPS Everywhere 设置

LastPass

LastPass 是一款较为著名及常用的密码管理器。使用密码管理器可以为每个网站生成、储存并填充非常复杂难记的密码。这样做的好处是可以避免您在某个网站的密码泄漏后该密码被用来尝试登陆您在其他网站使用相同密码的帐号。同时，密码管理器还可以节省记很多密码的麻烦。当切换到不同的设备时，只需要在该设备上登陆密码管理器即可自动填充所有网站的密码。LastPass 同时还有两款手机应用分别可以做到在手机管理和填充密码以及管理六位数的两步验证一次性密码。

LastPass 填充 Google 登陆信息

与之相似的密码管理器还有 1Password 等，可以自行尝试各种不同的软件寻找最合适的密码管理器。

Privacy Badger

Privacy Badger 是一款可以自动学习并屏蔽跟踪器的扩展，同样为 EFF 所开发。与传统的跟踪器黑名单不同，Privacy Badger 通过观察域名的行为来自动学习哪些网页域名是跟踪器的域名并且自动屏蔽这些域名。

以下是 Privacy Badger 对 Microsoft Docs 某个页面显示的屏蔽设置，其中对 github.com 的规则是默认的自动屏蔽第三方 Cookie，而对已知为跟踪器的 www.google-analytics.com 域名则采取完全屏蔽。这些设置可以手动调整，也可以通过浏览让 Privacy Badger 自动学习。

Privacy Badger 设置

Terms of Service; Didn’t Read

相信很多人都在阅读部分网站的服务条款之前就盲目点击了 “我同意”，我也不例外。按道理说，这并不是一个好习惯，例如当您了解到 2019 年 Discord 在服务条款中加入了新的段落以防止您起诉 Discord 售卖您的数据时，您可能就像我一样不会那么想继续使用 Discord 了。原则上来说，用户既有阅读服务条款的义务，也应该阅读服务条款来判断是否应该使用某项服务。

然而，大多数网站和软件的服务条款都充斥着法律用语，极难阅读和理解。Terms of Service; Didn’t Read（TOSDR）这款扩展包含了许多网页简化版的服务条款，并给网站的条款打上一个评分，让您很容易就能了解该网站的服务条款是否对用户有利。

下图中展示的就是 TOSDR 显示的精简版的 GitHub 服务条款，详细地列出了条款中各个对用户有利和不利的款项，很容易就能看出该网站的条款中有哪些不足。同时，TOSDR 还给 GitHub 的服务条款打了一个 B 的评分，显示该网站的条款对用户较公平，但是仍有改进的空间。

Terms of Service; Didn’t Read 显示 GitHub 精简后的服务协议

uBlock Origin

uBlock Origin 是一款非常知名的广告屏蔽器，可以屏蔽网络上大部分的广告，让网站干净整洁。您可以自定义屏蔽列表，用自带的选取工具快速屏蔽某个网页元素，也可以用其自带的隐私保护功能保护浏览隐私。

（看下图背景猜我最近在玩哪款游戏）

uBlock Origin 状态页面

使用 uBlock Origin 时，我个人有两个推荐设置，可以到 Settings > Privacy 中勾选 Prevent WebRTC from leaking local IP address 以及 Block CSP report 来开启额外的 WebRTC 防 IP 泄漏保护以及禁用 CSP 报告。

uBlock Origin 隐私设置

选择广告屏蔽器时常有的另一个疑问是：uBlock Origin 和 AdBlock Plus 这两款扩展哪个更好？3D Insider 对此做过一个详细的对比，总结来说就是 uBlock Origin 会使用更少的资源，并且默认屏蔽所有广告。AdBlock 不仅会使用默认资源，而且默认不屏蔽所谓的 “可接受广告”，所以仍会显示一部分广告。

uMatrix

uMatrix 可能是此篇指南中最硬核的一款扩展了，它可以让您自定义过滤每个网站上每个域名每种元素的加载。例如，您可以允许 Microsoft Docs 从 GitHub 加载图片，但是禁止其从 GitHub 加载脚本。除此之外，uMatrix 还可以伪造 Referer 字段以及 noscript 标签。

Microsoft Docs 页面上的 uMatrix 设置

虽然此扩展极为强大，但是其使用也极其繁琐。您可能需要一段时间才能学会如何使用此扩展，并且每到一个新的网站甚至页面都要手动调整该页面应用的规则，否则页面就大概率无法正确加载，功能也无法正常使用。如果您像我一样愿意花额外的精力和时间来调试每个网页以保证隐私和安全，该扩展则是您不二的选择。

开发和实用性扩展 Cookie Quick Manager

一款 Cookie 编辑器，相较于 EditThisCookie2 的好处是可以全局搜索 Cookie。

Dark Reader

浏览器的夜间模式扩展，我一般使用日间模式加上以下设定。同时需要注意一下这款扩展主要用 Filter、Static 和 Dynamic 三种模式，其中 Filter 模式最快，并且效果可观，但是可能让某些网站显示出错；Static 模式我个人并不喜欢用，因为效果很奇怪；Dynamic 模式虽说更不容易让页面崩坏，但是会显著提高页面加载速度，并且在开了很多标签页后会令浏览器卡顿。

DownThemAll!

一款可以列出网页上可以下载的资源链接（图片，视频等）的扩展，和 Chrome 上被下架的 DownThemAll 扩展如出一辙。

EditThisCookie2

Cookie 编辑器，和 Chrome 上的 EditThisCookie 一模一样。

Export Tabs URLs

可以列出所有打开的标签页的 URL，批量复制标签页地址很方便。

FoxyTab

标签页增强扩展，可以右键标签页进行各种操作。

Get Website IP

显示当前网站的 IP 地址，省去了手动 DNS 查询，并且保证了在网站有多个 CDN 的情况下得到的 IP 地址和实际访问 IP 地址一致。

HTTP Header Live

实时监控所有 HTTP 请求的 Header 字段，并提供保存功能。

HackBar

提供了在渗透测试时会使用到的各种功能，例如添加自定义 Referer 字段/Cookie/User-Agent、计算 MD5/ROT13/URL/Base64 编码等。

Multithreaded Download Manager

多线程下载器，在下载大文件时使用多线程下载，极大提高通量（throughput，有时也被松散翻译为带宽）利用率。

Offline QR Code Generator

离线 QR 码生成器，可以快速生成当前 URL 的 QR 码或者任意内容的 QR 码，需要从桌面电脑分享网址给身边的朋友的时候非常好用。该扩展也有更高级的使用方式，例如根据 ISO/IEC 18004:2015 标准手动生成 Wi-Fi QR 码等。

Proxy SwitchyOmega

Chrome 上著名的代理管理软件的 Firefox 移植版本。

SingleFile

将整个网页保存为一个 HTML 文件并且完整保留网页的原貌。

Tamper Data for FF Quantum

网页请求篡改器，可以拦截并篡改任意 Firefox HTTP 请求。

Tampermonkey

人尽皆知的网页脚本框架，可以从 Greasyfork 等网站安装各类脚本来自定义网页。

Tweak New Twitter

Twitter 简化扩展，可以让 Twitter 通过时间顺序显示 Tweet、删除 “Trends” 版块、分开显示 Tweet 和 Retweet 等。目前该扩展还在早期开发阶段，不是非常稳定。

User-Agent Switcher and Manager

快速切换 User-Agent，在很多时候非常好用，例如用 Windows 的 UA 访问 Windows 下载页面，则页面会显示下载升级工具的链接；而将 UA 改为 Linux 之后，即可显示下载 Windows ISO 镜像的链接。

Wappalyzer

非常强大的网页框架识别扩展，可以识别网页后端使用的服务器操作系统、开发框架等。例如下图中 Wappalyzer 就例举出了 Twitter 使用的框架等信息。

Wappalyzer 显示 Twitter 框架和其它信息

Web Developer

十分强大的网页开发辅助工具，可以对页面进行各种调试，也可以在申请软件试用的时候通过 Populate Form Fields 功能自动填充表单。

Web Developer 主界面

- https://k4yt3x.com/2020-firefox-%E5%AE%89%E5%85%A8%E9%9A%90%E7%A7%81%E5%AE%9E%E7%94%A8%E6%89%A9%E5%B1%95%E6%8C%87%E5%8D%97/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/firefox-%E5%90%AF%E7%94%A8%E9%9A%90%E8%97%8F%E5%8A%9F%E8%83%BD-letterboxing-%E4%BB%A5%E9%81%BF%E5%85%8D%E8%BA%AB%E4%BB%BD%E8%BF%BD%E8%B8%AA/ -

当用户使用非标准窗口尺寸的浏览器进行网页浏览时，浏览器的独特尺寸可以让网站有效追踪用户身份，即使用户已经禁用了 JavaScript 和 Cookie 等传统身份追踪（Fingerprinting）手段的媒介。这篇文章将教您如何在 Firefox 中启用 Letterboxing 功能来预防此种身份追踪手段。

Letterboxing 简介

Firefox 在 2019 年发布的 67 版本中加入了从 Tor Browser 引进的 Letterboxing 功能，此功能直至出稿为止（2020 年 6 月 12 日）在 Firefox 中都还是一个隐藏功能。Letterboxing 可以在浏览器的内窗口周围创建一些空白 padding，使浏览器的内窗分辨率保持为 100px 的倍数（例如 1600x800），而不是更容易识别的精确数字（例如 1632x821）。

下图中的浏览器窗口就没有启用 Letterboxing，可以看到该窗口的尺寸（1583x791）很独特，很容易和其他浏览器区分开来。即使用户更换了 IP 地址并且删除了 Cookie，独特的浏览器尺寸仍然会暴露用户身份。

没有启用 Letterboxing 的浏览器窗口

下图中的浏览器窗口和上图中的窗口尺寸一致，但是启用了 Letterboxing。这项技术可以让窗口尺寸始终保持为 100px 的倍数，从而防止浏览器的尺寸暴露用户身份。

启用了 Letterboxing 的浏览器窗口

启用 Letterboxing

Letterboxing 在最新版本的 Firefox（出稿时为 77）中仍然是一个隐藏设定。在 about:config 中用户即使搜索 letterboxing 也无法看到相应的设定，必须要手动添加一个新的键值。

Firefox 中无法找到该设置

添加设置的方法也很简单，首先在地址栏输入 about:config 进入 Firefox 设置界面，此时 Firefox 会警告用户手动修改参数的风险，点击接受风险并继续来进入修改界面。注意胡乱修改此界面中的值可能会损坏 Firefox。

about:config 警告

然后在搜索栏输入 privacy.resistFingerprinting.letterboxing，选择 Boolean，并点击右侧的加号创建新的键值。

创建新的 Letterboxing 键值

此时一个新的键将会被创建，并且值为 true。这样设置就完成了。此时重启 Firefox 即可看到效果。

新创建的键值

测试 Letterboxing

当 Letterboxing 启用后，可以前往 How Big is My Browser 这样的网站测试自己的窗口尺寸。可以看到，网站识别出的尺寸是 letterboxing 过后的尺寸。

How Big is My Browser 测试

并且，在控制台调用 window API 输出的数字也是 letterboxing 之后的尺寸了。

控制台输出 window API 尺寸

一些尚未解决的问题

当前往 BrowserLeaks.com 这样的网站测试自己的浏览器时，可以看到虽然传统的窗口尺寸已经是 letterboxing 之后的尺寸（还被标记了开启了 letterboxing），但是 viewport 尺寸仍然未改变。即使是在隐私方面走在最前端的 Tor Browser 仍然可以被这种方法 fingerprint。如果网站采用了这种方式进行身份追踪，仍有可能成功。

所以，如果需要完全的匿名性，还是应该使用 Tor Browser 在 Windows 等常见系统下使用默认窗口尺寸进行浏览。

viewport 尺寸泄漏

还有一个问题就是，当启用了 letterboxing 后，Firefox 的窗口滚动条不再在窗口边缘，而在窗口内部。所以想要把鼠标放在滚动条上可能会更困难。可能这也就是 Firefox 在正式版中迟迟未在 privacy.resistFingerprinting 启用时也同时默认启用 letterboxing 的原因。是否要为了隐私而牺牲便利性，牺牲到什么程度，每个人都有不同的答案。

滚动条不再在窗口边缘

相关网站

• Panopticlick：EFF（电子前沿基金会）推出的浏览器 fingerprinting 测试网站，使用了真正的追踪程序提供商来测试浏览器，可以看到浏览器泄漏了哪些独特信息并给出一个评分
• BrowserLeaks.com：检测各种浏览器泄漏的信息
• How Big Is My Browser?：一个直观的浏览器尺寸显示网站

- https://k4yt3x.com/firefox-%E5%90%AF%E7%94%A8%E9%9A%90%E8%97%8F%E5%8A%9F%E8%83%BD-letterboxing-%E4%BB%A5%E9%81%BF%E5%85%8D%E8%BA%AB%E4%BB%BD%E8%BF%BD%E8%B8%AA/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/ontario-%E7%8E%B0%E5%BD%B9%E8%AD%A6%E8%BD%A6%E5%A4%A7%E5%85%A8%E5%8F%8A%E5%8D%A7%E5%BA%95%E8%AD%A6%E8%BD%A6%E8%AF%86%E5%88%AB%E6%8C%87%E5%8D%97/ -

• 序言
• Ford Taurus Police Interceptor
  • 简介
  • 常规警车
  • 卧底警车
  • 警车识别
• Dodge Charger Pursuit
  • 简介
  • 常规警车
  • 卧底警车
  • 警车识别
• Ford Utility Interceptor
  • 简介
  • 常规警车
  • 卧底警车
  • 警车识别
• Chevrolet Tahoe PPV
  • 简介
  • 常规警车
  • 卧底警车
  • 警车识别
• 其他车辆
  • Chevrolet Suburban
  • Chevrolet Silverado 2500
  • Ford E250
• 卧底警车识别摘要
• 照片版权

序言

几乎所有的警车都由第三方公司从民用车型改装而来，在北美常见的基础款型为 Ford Taurus、Dodge Charger、Ford Explorer、Chevrolet Tahoe 等。这些例如 Dodge Law 的改装公司会在车辆的基础款型上进行很多改装，常见的改装有：

• 警用轮毂
• 两侧后视镜上方的探照灯
• 警用电台
• 枪械支架
• 车体（车门、车窗等）加固
• 警灯
• 后备箱里的工具箱

除此之外，部分的车还会配有更多的改装件以提供额外功能：

• 警用防撞杆
• 较长的电台高增益天线
• 车牌扫描器
• 后座的牢笼

Ford Taurus Police Interceptor 简介

Ford Taurus Police Interceptor（以下简称 Taurus Interceptor）是一款经典的北美警车。这款警车是基于第六代 (2013-2019) Ford Taurus 改装而成，加装了各种警用设备，并且有四种引擎配置可以选择。其中较小马力的 2.0 EcoBoost 直列四缸更适合非追捕的情况使用，而大马力的 V6 版本则更适合在高速追捕中使用。

引擎 传动 马力 扭矩 极速 3.5-liter Ti-VCT V6 FFV 4WD/FWD 288 hp N/A 133 mph 3.7-liter T-VCT V6 FFV AWD 305 hp 280 lb/ft 133 mph 2.0-liter EcoBoost I-4 AWD 240 hp N/A N/A 3.5-liter EcoBoost V6 AWD 365 hp N/A 150 mph

Taurus Interceptor 以及其基本车型 Taurus 都在 2019 年宣布停产，因为基于 Ford Explorer 的 Police Interceptor Utility 销量更佳。基于 Fusion 的 Police Responder Hybrid Sedan 将会取代 Taurus Interceptor 的地位。

数据来源

• https://www.performancefordclinton.com/What-Engine-is-in-the-Ford-Taurus-Police-Interceptor.html
• https://en.wikipedia.org/wiki/Ford_Taurus_(sixth_generation)

常规警车

基于 Ford Taurus 的 OPP 警车可能是最常见的警车了。这种警车在各处都可以看到，无论是市内的应急响应还是高速贴超速罚单。

OPP cruiser，拍摄者：Can Pac Swire
https://www.flickr.com/photos/18378305@N00/35940619971/

上图的 Taurus Interceptor 可以说是这款车最经典的变种了，大多数市内见到的警车都是类似的型号。

OPPcar1-ON407，拍摄者：formulanone
https://www.flickr.com/photos/formulanone/27021002152/

这辆在 407 高速上巡逻的 Taurus Interceptor 额外装配有更长的高增益无线电天线，以确保在高速巡航、追捕或离中继站较远时仍能有稳定的信号。

各市地方的警察也都在广泛使用 Taurus Interceptor，而且也都有自己的涂装。例如在 Toronto 市内，就有好几种变种 Taurus Interceptor：

Silver grey ad white，拍摄者：Can Pac Swire
https://www.flickr.com/photos/18378305@N00/34326885996/

还有一种是纯白色：

Toronto police’s new cruiser，拍摄者：Can Pac Swire
https://www.flickr.com/photos/18378305@N00/24285244161/

银灰和白色配色：

Toronto Police 6711，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49387676186/

对比之后发现，好像只有 OPP 的 Taurus Interceptor 会装防撞杆，而城市巡逻和卧底的版本并不会装。

卧底警车

Taurus 的卧底（unmarked）版本有很多变种，颜色也多种多样。最经典的卧底变种当属黑色和银灰色的警车。

Hamilton Police 794-1 Taurus Interceptor，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/36336845481/

警车识别

Ford Taurus 原厂前脸：

2017_ford_taurus_frontview，来源：U.S. News
https://cars.usnews.com/cars-trucks/ford/taurus/2017/photos-exterior/front-view

Ford Taurus 原厂车尾：

2017_ford_taurus_rearview，来源：U.S. News
https://cars.usnews.com/cars-trucks/ford/taurus/2017/photos-exterior/rear-view

Dodge Charger Pursuit 简介

现役的 Dodge Charger Pursuit 大多是基于 2015 以后款型的 Dodge Charger 改装而来。Charger 目前多被用于高速巡逻（highway patrol）上，在市内很少见到 Charger Pursuit 的身影。其 5.7 升 HEMI V-8 款型的强劲引擎最高可以输出 370 匹马力，足以轻易追赶大多数民用车辆，所以更适合高速巡逻。不过，我目前并没有找到证据证明大多数 Charger Pursuit 是 3.7 升版本还是 5.7 升版本。

有意思的是，绝大多数北美的 Charger Pursuit 警车都是加拿大公司 Dodge Law 制造的。下面这个视频对 Charger Pursuit 做出了较详细的评测，如果想要知道更多细节可以观看。

2020 款的 Dodge Charger Pursuit 有两套动力系统可以选择，具体指标分别如下：

引擎 传动 马力 扭矩 3.6-LITER PENTASTAR DOHC 24-VALVE V-6 RWD 292 hp 260 lb/ft 5.7-LITER HEMI® V-8 WITH FUEL SAVER TECHNOLOGY AWD 370 hp 395 lb/ft

如果想要更详细的数据，可以前往官网：https://www.fcausfleet.com/content/dam/fca-fleet/na/fleet/en_us/dodge/2020/charger-pursuit/buyers-guide/2020_DG_Charger_Pursuit_SPECS.pdf

Dodge Charger Pursuit 还有一个可选的警官保护功能（Officer Protection Package）。此功能可通过方向盘被激活，当激活之后，面向车位的传感器和摄像头会被激活。当检测到有人靠近车辆时，警灯和警笛会被激活，同时车窗也会被升起以震慑尝试偷袭的犯罪分子并且保护警官的安全。下面附有官网的 YouTube 演示视频。

参考资料

• https://www.fcausfleet.com/dodge/charger-pursuit.html

常规警车

OPP 6-316，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/38060525916/

有些警车还安装了牌照扫描器，例如下图的 Charger Pursuit 就在车顶驾驶员的位置安装了一台。

OPP 6-196，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/46545487005/

卧底警车

Dodge Charger Pursuit 的卧底警车在高速上非常常见，而由于其独特的尾灯，也非常好识别。细节请移步警车识别章节。

Dodge Charger Pursuit Unmarked，拍摄者：未知
http://picssr.com/photos/century288_photography/favorites/page61?nsid=74133959@N06

警车识别

Dodge Charger 原厂前脸：

2020_dodge_charger_frontview，来源：U.S. News
https://cars.usnews.com/cars-trucks/dodge/charger/2020/photos-exterior

Dodge Charger 原厂车尾：

2020_dodge_charger_rearview，来源：U.S. News
https://cars.usnews.com/cars-trucks/dodge/charger/2020/photos-exterior

Dodge Charger Pursuit 最标志的特征莫过于尾灯和大灯了，其中记住识别尾灯形状尤为重要。在高速巡航的时候，很容易就能认出前方 Dodge Charger 的尾灯，因为其形状是两根横跨整个车身的长条。多说无益，看下图示例即可。当在晚上看到这样的尾灯的时候，那就一定是 Dodge 的车。虽说 Durango 和 Dart 也有相似形状的尾灯，但是从这样的车边上高速驶过我个人认为不是什么明智的选择。

Dodge ChargerSmoked tail lights and Side markers，来源：[email protected]
https://www.hellcat.org/threads/smoked-tail-lights-and-side-markers.8091/

虽然 Dodge Charger 的大灯一样非常有特点，但是想要在后视镜中辨识出来还是有一定难度，尤其是夜间。况且，如果您已经可以在后视镜里看到这对大灯了，说明您已经基本没救了。Dodge Charger 的大灯形状如下图所示。

Dodge 前脸，来源：Dodge Law 官网
https://www.fcausfleet.com/dodge/charger-pursuit.html

Ford Utility Interceptor 简介

Ford Utility Interceptor 可以说是北美最流行的警车了。Utility Interceptor 的泛用性强，且在各方面的使用效果都不错。最新（2020）版本的 Utility Interceptor 还提供了 EcoBoost 和 HEV 混动的版本，其 EcoBoost 的版本最高马力甚至可以达到惊人的 400 匹。

引擎 传动 马力（混动） 马力（汽油） 扭矩（混动） 扭矩（汽油） 3.3L HEV AWD 318 hp 285 hp 322 lb/ft 260 lb/ft 3.3L Direct-Injection V6 FFV AWD N/A 285 hp N/A 260 lb/ft 3.0L EcoBoost AWD N/A 400 hp N/A 415 lb/ft

Donut Media 做过一期 Utility Interceptor 的详细 breakdown，有兴趣的话值得一看。

参考资料：

• https://www.ford.com/police-vehicles/hybrid-utility/

常规警车

Ford Utility Interceptor 的常规警车在加拿大的各州和美国的各州都非常常见。

OPP 6-621，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/32052636326/

Toronto 警察也理所当然拥有自己的版本。

Toronto Police 5105，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49387679101/

个人觉得 Utility Interceptor 在 local 道路上见到的很多，尤其是 Waterloo 地区。

Ford Utility Interceptor Clocking Traffic，来源：Waterloo Regional Police
https://twitter.com/WRPSToday/status/1266365407629152258/photo/1

卧底警车

Ford Utility Interceptor 的卧底警车相当常见，Waterloo 和 O.P.P 大多数都是黑色和银灰色的配色。

Waterloo Unmarked Ford Utility Interceptor，来源：Halton Regional Police Service
https://twitter.com/HRPSBurl/status/1266417636361076736/photo/1

Brantford 区域的 Utility Interceptor 则有更明显的标记。

Brantford Police Services 12，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/48010643798/

黑色的也很常见，可以注意一下车顶上显眼的天线。

Via Rail Police，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/47947528912/

警车识别

Ford Explorer 原厂前脸：

2018_ford_explorer_frontview，来源：U.S. News
https://cars.usnews.com/cars-trucks/ford/explorer/2018/photos-exterior

Ford Explorer 原厂车尾：

2018_ford_explorer_rearview，来源：U.S. News
https://cars.usnews.com/cars-trucks/ford/explorer/2018/photos-exterior

Ford Explorer 这辆车特征并不明显，而且民用的也很多，所以只能在看到的时候小心一些了。

Chevrolet Tahoe PPV 简介

和其他警车一样，Tahoe PPV 的版本也是由第三方公司制作的。北美大多数的 Tahoe PPV 都是由 General Motors Fleet 改装而成。

2019-gmfleet-chevrolet-tahoe-ppv-keyfeatures，来源：GMFleet 官网
https://www.gmfleet.com/police/chevy-tahoe-ppv

2020 版本的 Tahoe PPV 提供了两种传动选择：2WD 和 4WD。除了传动系统的不同以外，其他方面配置都大致相同。

引擎 传动 马力 扭矩 5.3L EcoTec3 V8 2WD 355 hp 383 lb/ft 5.3L EcoTec3 V8 4WD 355 hp 383 lb/ft

参考资料：

以下是官方的 spec sheet，所有的细节甚至连走线接线方法都能在这些文档中找到。

• https://www.gmfleet.com/content/dam/fleet/na/us/english/index/police/2020-chevy-tahoe-ppv/mov/02-pdfs/2020tahoeppv2wd-8.pdf
• https://www.gmfleet.com/content/dam/fleet/na/us/english/index/police/2020-chevy-tahoe-ppv/mov/02-pdfs/2020tahoeppv4wd-7.pdf

常规警车

普通的 Tahoe 其实相比上述其他型号的警车更少见，不过 O.P.P 官方的 Twitter 经常能见到有超速车辆被 Tahoe pull over。

OPP 6-584，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/23978280627/

卧底警车

这辆车同样也有 unmarked 版本，而且同样还是不止一种涂装。最经典的当然还是黑色。

OPP 6-765，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49489892118/

偏蓝/紫色的变种涂装：

OPP 6-663 Chevrolet Tahoe Interceptor，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/42139706481/

参考资料：

• https://www.gmfleet.com/police/chevy-tahoe-ppv

警车识别

2020_chevrolet_tahoe_frontview，来源：U.S. News
https://cars.usnews.com/cars-trucks/chevrolet/tahoe/2020/photos-exterior

2020_chevrolet_tahoe_rearview，来源：U.S. News
https://cars.usnews.com/cars-trucks/chevrolet/tahoe/2020/photos-exterior

其他车辆

这个章节囊括了一些平时并不那么常见的警车型号，大多数都是用于后勤和案发现场响应。

Chevrolet Suburban

OPP 35-552，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49798169612/

Chevrolet Silverado 2500

OPP 6-607 Chevrolet Silverado 2500，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49544849788/

OPP 6-522，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/31281594783/

Ford E250

One For The Records，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/46625377971/

卧底警车识别摘要

在看到有可能是警车款式的车时，就要警惕对方是不是警车了。识别卧底警车主要的重点就在于识别车辆上的警用配件，例如警用钢制轮毂，天线，防撞杆，探照灯等。其中最容易认出的就是轮毂，但是很多时候从后面并看不出轮毂，这时候就可以观察一些其它特征。

首先可以看车顶的天线和后视镜侧的探照灯，大多数警车都会在车顶或后备箱上有多个突起的天线。如果看到小天线，大约 95% 以上的概率就是警车了，因为大多数在民用市场上的退役警车会把这些装备全都拆干净。

Ottawa Police Service White Undercover Ford Taurus Police Interceptor Sedan，拍摄者：Michael Burns
https://www.flickr.com/photos/99880220@N02/17171363612

下图可以看到 Charger Pursuit 上天线的摆放位置。

O.P.P Pulling Dodge Challenger Over，来源：PRP Road Safety Services
https://twitter.com/PRPRoadSafety/status/1263930223810220040/photo/1

然后可以看看后视镜上面有没有探照灯，例如下图这台 Utility Interceptor 后视镜上就装有探照灯，同时车顶上还有天线。

Via Rail Police，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/47947528912/

还有些警车会配备车牌扫描仪

Waterloo Unmarked Ford Utility Interceptor，来源：Halton Regional Police Service
https://twitter.com/HRPSBurl/status/1266417636361076736/photo/1

如果这些都没有的话，大多数警车还是会装备 heavy-duty 的钢制轮毂。这种轮毂比普通 casted 轮毂更加耐用，在经过严峻地形的时候不容易开裂。常见的警用轮毂有三种。

第一种是最常见的，有五个孔。这种轮子在 Taurus Interceptor、Utility Interceptor 和 Charger Pursuit 上都能见到。

Silver grey ad white，拍摄者：Can Pac Swire
https://www.flickr.com/photos/18378305@N00/34326885996/

第二种轮子是这种多孔的，基本上只有 Charger Interceptor 才会装备。

OPP 6-196 Dodge Charger Interceptor，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/41016042271

第三种是这种七根辐条的，只有在 GMFleet 生产的 Tahoe PPV 上才能见到。

OPP 6-765，拍摄者：Joseph Bishop
https://www.flickr.com/photos/93850525@N02/49489892118/

照片版权

本文的照片来自于以下渠道：

• Joseph Bishop（获得授权）
• Can Pac Swire（Creative Commons 3.0）
• Michael Burns（Creative Commons 3.0）
• U.S. News（Fair Use）

本文并非盈利性质，使用照片遵循 fair use 原则。如有侵犯版权，请联系作者，我会立即删除。

- https://k4yt3x.com/ontario-%E7%8E%B0%E5%BD%B9%E8%AD%A6%E8%BD%A6%E5%A4%A7%E5%85%A8%E5%8F%8A%E5%8D%A7%E5%BA%95%E8%AD%A6%E8%BD%A6%E8%AF%86%E5%88%AB%E6%8C%87%E5%8D%97/ - 2019-2024 K4YT3X. All rights reserved.

K4YT3X https://k4yt3x.com/%E5%B0%86-vmware-%E8%99%9A%E6%8B%9F%E6%9C%BA%E7%B2%BE%E7%AE%80%E5%88%86%E9%85%8D%E7%9A%84%E7%A3%81%E7%9B%98%E7%A9%BA%E9%97%B4%E8%BF%94%E8%BF%98%E7%BB%99%E5%AE%BF%E4%B8%BB%E6%9C%BA/ -

在给虚拟机分配磁盘时，为了不让分配的磁盘立马占用大量宿主机空间，可以使用精简分配（thin provisioning）。虚拟机的磁盘文件大小会随着磁盘中内容的增多而增加，但是却不会随着文件的删除而减少。这是因为操作系统在删除文件时并不会将文件完全删除（用 0 复写删除的内容），而是将该磁盘空间标记为已删除。为了让这部分空间返还给宿主机，仅仅删除是不够的。这篇文章将介绍如何把虚拟机精简分配的磁盘空闲的空间返还给宿主机。

在进行操作之前，请切记有快照的磁盘是不能够被 vmware-vdiskmanager 和 vmkfstools 工具调整的。*

概念

要想返还未使用的空间，首先 VM 必须用 0 复写所有未使用的空间，然后宿主机将用 VMware 自带的工具（vmkfstools 或者 vmware-vdiskmanager）消减内容为 0 的磁盘空间。

Windows VM 复写未使用空间

在 Windows VM 中，可以使用 SysInternals 工具中的 SDelete 来用 0 复写磁盘中未使用的空间。

1 sdelete.exe -z [盘符]

例如，如果要复写 C 盘中的内容的话，则该执行：

1 sdelete.exe -z C: Linux 复写未使用空间

在 Linux 中，可以使用从 /dev/zero 中不断读取 0 并且写入到一个文件中直到把文件系统占满为止的方式来复写未使用的空间。最后会将该文件删除来标记空间为已删除。注意以下命令均应该以 root 权限执行，尤其是复写 root 分区的操作。

第一种方式为使用 cat 命令：

1 2 3 4 5 # 复写 root 分区 cat /dev/zero > /zero.fill;sync;sleep 1;sync;rm -f /zero.fill # 复写挂载点的分区 cat /dev/zero > /[挂载点]/zero.fill;sync;sleep 1;sync;rm -f /[挂载点]/zero.fill

第二种方式为使用 dd 命令：

1 2 3 4 5 # 复写 root 分区 dd if=/dev/zero of=/zeroes && rm -f /zeroes # 复写挂载点的分区 dd if=/dev/zero of=/[挂载点]/zeroes && rm -f /[挂载点]/zeroes 使用 VMware 工具重新调整磁盘大小

在将未使用的空间归零以后，宿主机必须使用 VMware 自带的硬盘工具重新自动调整精简分配磁盘的大小来缩小磁盘体积。

如果宿主是 VMware Workstation Pro，则可以使用以下命令：

1 vmware-vdiskmanager -k [虚拟机磁盘].vmdk

如果宿主是 ESXi，则可使用以下命令：

1 vmkfstools -K [虚拟机磁盘].vmdk 参考文章

• https://community.hitachivantara.com/s/article/reclaim-disk-space-from-thin-provisioned-vmdk-files-in-esxi-server
• https://communities.vmware.com/thread/546700

April 4, 2022 追加

新的 VMware Workstation 新增了一个 Compact Disk 功能，大概不需要用 vmkfstools 的命令行来精简磁盘了，可以直接在 GUI 里进行最后一步操作。

- https://k4yt3x.com/%E5%B0%86-vmware-%E8%99%9A%E6%8B%9F%E6%9C%BA%E7%B2%BE%E7%AE%80%E5%88%86%E9%85%8D%E7%9A%84%E7%A3%81%E7%9B%98%E7%A9%BA%E9%97%B4%E8%BF%94%E8%BF%98%E7%BB%99%E5%AE%BF%E4%B8%BB%E6%9C%BA/ - 2019-2024 K4YT3X. All rights reserved.