blog/atom.xml (view raw)
1<?xml version="1.0" encoding="UTF-8"?>
2<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
3 <title>Lonami's Site - My Blog</title>
4 <link href="https://lonami.dev/blog/atom.xml" rel="self" type="application/atom+xml"/>
5 <link href="https://lonami.dev/blog/"/>
6 <generator uri="https://www.getzola.org/">Zola</generator>
7 <updated>2021-02-22T00:00:00+00:00</updated>
8 <id>https://lonami.dev/blog/atom.xml</id>
9 <entry xml:lang="en">
10 <title>Writing our own Cheat Engine: Floating points</title>
11 <published>2021-02-22T00:00:00+00:00</published>
12 <updated>2021-02-22T00:00:00+00:00</updated>
13 <link href="https://lonami.dev/blog/woce-4/" type="text/html"/>
14 <id>https://lonami.dev/blog/woce-4/</id>
15 <content type="html"><p>This is part 4 on the <em>Writing our own Cheat Engine</em> series:</p>
16<ul>
17<li><a href="/blog/woce-1">Part 1: Introduction</a> (start here if you're new to the series!)</li>
18<li><a href="/blog/woce-2">Part 2: Exact Value scanning</a></li>
19<li><a href="/blog/woce-3">Part 3: Unknown initial value</a></li>
20<li>Part 4: Floating points</li>
21</ul>
22<p>In part 3 we did a fair amount of plumbing in order to support scan modes beyond the trivial &quot;exact value scan&quot;. As a result, we have abstracted away the <code>Scan</code>, <code>CandidateLocations</code> and <code>Value</code> types as a separate <code>enum</code> each. Scanning for changed memory regions in an opened process can now be achieved with three lines of code:</p>
23<pre><code class="language-rust" data-lang="rust">let regions = process.memory_regions();
24let first_scan = process.scan_regions(&amp;regions, Scan::InRange(0, 500));
25let second_scan = process.rescan_regions(&amp;first_scan, Scan::DecreasedBy(7));
26</code></pre>
27<p>How's that for programmability? No need to fire up Cheat Engine's GUI anymore!</p>
28<p>The <code>first_scan</code> in the example above remembers all the found <code>Value</code> within the range specified by <code>Scan</code>. Up until now, we have only worked with <code>i32</code>, so that's the type the scans expect and what they work with.</p>
29<p>Now it's time to introduce support for different types, like <code>f32</code>, <code>i64</code>, or even more atypical ones, like arbitrary sequences of bytes (think of strings) or even numbers in big-endian.</p>
30<p>Tighten your belt, because this post is quite the ride. Let's get right into it!</p>
31<h2 id="floating-points">Floating points</h2>
32<details open><summary>Cheat Engine Tutorial: Step 4</summary>
33<blockquote>
34<p>In the previous tutorial we used bytes to scan, but some games store information in so called 'floating point' notations.
35(probably to prevent simple memory scanners from finding it the easy way). A floating point is a value with some digits behind the point. (like 5.12 or 11321.1)</p>
36<p>Below you see your health and ammo. Both are stored as Floating point notations, but health is stored as a float and ammo is stored as a double.
37Click on hit me to lose some health, and on shoot to decrease your ammo with 0.5</p>
38<p>You have to set BOTH values to 5000 or higher to proceed.</p>
39<p>Exact value scan will work fine here, but you may want to experiment with other types too.</p>
40<p>Hint: It is recommended to disable &quot;Fast Scan&quot; for type double</p>
41</blockquote>
42</details>
43<h2 id="generic-values">Generic values</h2>
44<p>The <code>Value</code> enumeration holds scanned values, and is currently hardcoded to store <code>i32</code>. The <code>Scan</code> type also holds a value, the value we want to scan for. Changing it to support other types is trivial:</p>
45<pre><code class="language-rust" data-lang="rust">pub enum Scan&lt;T&gt; {
46 Exact(T),
47 Unknown,
48 Decreased,
49 // ...other variants...
50}
51
52pub enum Value&lt;T&gt; {
53 Exact(T),
54 AnyWithin(Vec&lt;u8&gt;),
55}
56</code></pre>
57<p><code>AnyWithin</code> is the raw memory, and <code>T</code> can be interpreted from any sequence of bytes thanks to our friend <a href="https://doc.rust-lang.org/stable/std/mem/fn.transmute.html"><code>mem::transmute</code></a>. This change alone is enough to store an arbitrary <code>T</code>! So we're done now? Not really, no.</p>
58<p>First of all, we need to update all the places where <code>Scan</code> or <code>Value</code> are used. Our first stop is the scanned <code>Region</code>, which holds the found <code>Value</code>:</p>
59<pre><code class="language-rust" data-lang="rust">pub struct Region&lt;T&gt; {
60 pub info: MEMORY_BASIC_INFORMATION,
61 pub locations: CandidateLocations,
62 pub value: Value&lt;T&gt;,
63}
64</code></pre>
65<p>Then, we need to update everywhere <code>Region</code> is used, and on and on… All in all this process is just repeating <code>cargo check</code>, letting the compiler vent on you, and taking good care of it by fixing the errors. It's quite reassuring to know you will not miss a single place. Thank you, compiler!</p>
66<p>But wait, how could scanning for a decreased value work for any <code>T</code>? The type is not <code>Ord</code>, we should add some trait bounds. And also, what happens if the type is not <code>Copy</code>? It could implement <code>Drop</code><sup class="footnote-reference"><a href="#1">1</a></sup>, and we will be transmuting from raw bytes, which would trigger the <code>Drop</code> implementation when we're done with the value! Not memory safe at all! And how could we possibly cast raw memory to the type without knowing its siz– oh nevermind, <a href="https://doc.rust-lang.org/stable/std/marker/trait.Sized.html"><code>T</code> is already <code>Sized</code> by default</a>. But anyway, we need the other bounds.</p>
67<p>In order to not repeat ourselves, we will implement a new <code>trait</code>, let's say <code>Scannable</code>, which requires all other bounds:</p>
68<pre><code class="language-rust" data-lang="rust">pub trait Scannable: Copy + PartialEq + PartialOrd {}
69
70impl&lt;T: Copy + PartialEq + PartialOrd&gt; Scannable for T {}
71</code></pre>
72<p>And fix our definitions:</p>
73<pre><code class="language-rust" data-lang="rust">pub enum Scan&lt;T: Scannable&gt; { ... }
74pub enum Value&lt;T: Scannable&gt; { ... }
75pub struct Region&lt;T: Scannable&gt; { ... }
76
77// ...and the many other places referring to T
78</code></pre>
79<p>Every type which is <code>Copy</code>, <code>PartialEq</code> and <code>PartialOrd</code> can be scanned over<sup class="footnote-reference"><a href="#2">2</a></sup>, because we <code>impl Scan for T</code> where the bounds are met. Unfortunately, we cannot require <code>Eq</code> or <code>Ord</code> because the floating point types do not implement it.</p>
80<h2 id="transmuting-memory">Transmuting memory</h2>
81<p>Also known as reinterpreting a bunch of bytes as something else, or perhaps it stands for &quot;summoning the demon&quot;:</p>
82<blockquote>
83<p><code>transmute</code> is <strong>incredibly</strong> unsafe. There are a vast number of ways to cause <a href="https://doc.rust-lang.org/stable/reference/behavior-considered-undefined.html">undefined behavior</a> with this function. <code>transmute</code> should be the absolute last resort.</p>
84</blockquote>
85<p>Types like <code>i32</code> define methods such as <a href="https://doc.rust-lang.org/stable/std/primitive.i32.html#method.from_ne_bytes"><code>from_ne_bytes</code></a> and <a href="https://doc.rust-lang.org/stable/std/primitive.i32.html#method.to_ne_bytes"><code>to_ne_bytes</code></a> which convert raw bytes from and into its native representation. This is all really nice, but unfortunately, there's no standard trait in the Rust's standard library to &quot;interpret a type <code>T</code> as the byte sequence of its native representation&quot;. <code>transmute</code>, however, does exist, and similar to any other <code>unsafe</code> function, it's safe to call <strong>as long as we respect its invariants</strong>. What are these invariants<sup class="footnote-reference"><a href="#3">3</a></sup>?</p>
86<blockquote>
87<p>Both types must have the same size</p>
88</blockquote>
89<p>Okay, we can just assert that the window length matches the type's length. What else?</p>
90<blockquote>
91<p>Neither the original, nor the result, may be an <a href="https://doc.rust-lang.org/nomicon/what-unsafe-does.html">invalid value</a>.</p>
92</blockquote>
93<p>What's an invalid value?</p>
94<blockquote>
95<ul>
96<li>a <code>bool</code> that isn't 0 or 1</li>
97<li>an <code>enum</code> with an invalid discriminant</li>
98<li>a null <code>fn</code> pointer</li>
99<li>a <code>char</code> outside the ranges [0x0, 0xD7FF] and [0xE000, 0x10FFFF]</li>
100<li>a <code>!</code> (all values are invalid for this type)</li>
101<li>an integer (<code>i*</code>/<code>u*</code>), floating point value (<code>f*</code>), or raw pointer read from uninitialized memory, or uninitialized memory in a <code>str</code>.</li>
102<li>a reference/<code>Box</code> that is dangling, unaligned, or points to an invalid value.</li>
103<li>a wide reference, <code>Box</code>, or raw pointer that has invalid metadata:
104<ul>
105<li><code>dyn Trait</code> metadata is invalid if it is not a pointer to a vtable for <code>Trait</code> that matches the actual dynamic trait the pointer or reference points to</li>
106<li>slice metadata is invalid if the length is not a valid <code>usize</code> (i.e., it must not be read from uninitialized memory)</li>
107</ul>
108</li>
109<li>a type with custom invalid values that is one of those values, such as a <code>NonNull</code> that is null. (Requesting custom invalid values is an unstable feature, but some stable libstd types, like <code>NonNull</code>, make use of it.)</li>
110</ul>
111</blockquote>
112<p>Okay, that's actually an awful lot. Types like <code>bool</code> implement all the trait bounds we defined, and it would be insta-UB to ever try to cast them from arbitrary bytes. The same goes for <code>char</code>, and all <code>enum</code> are out of our control, too. At least we're safe on the &quot;memory is initialized&quot; front.</p>
113<p>Dang it, I really wanted to use <code>transmute</code>! But if we were to use it for arbitrary types, it would trigger undefined behaviour sooner than later.</p>
114<p>We have several options here:</p>
115<ul>
116<li>Make it an <code>unsafe trait</code>. Implementors will be responsible for ensuring that the type they're implementing it for can be safely transmuted from and into.</li>
117<li><a href="https://rust-lang.github.io/api-guidelines/future-proofing.html">Seal the <code>trait</code></a> and implement it only for types we know are safe<sup class="footnote-reference"><a href="#4">4</a></sup>, like <code>i32</code>.</li>
118<li>Add methods to the <code>trait</code> definition that do the conversion of the type into its native representation.</li>
119</ul>
120<p>We will go with the first option<sup class="footnote-reference"><a href="#5">5</a></sup>, because I really want to use <code>transmute</code>, and I want users to be able to implement the trait on their own types.</p>
121<p>In any case, we need to change our <code>impl</code> to something more specific, in order to prevent it from automatically implementing the trait for types for which their memory representation has invalid values. So we get rid of this:</p>
122<pre><code class="language-rust" data-lang="rust">pub trait Scannable: Copy + PartialEq + PartialOrd {}
123
124impl&lt;T: Copy + PartialEq + PartialOrd&gt; Scannable for T {}
125</code></pre>
126<p>And replace it with this:</p>
127<pre><code class="language-rust" data-lang="rust">pub unsafe trait Scannable: Copy + PartialEq + PartialOrd {}
128
129macro_rules! impl_many {
130 ( unsafe impl $trait:tt for $( $ty:ty ),* ) =&gt; {
131 $( unsafe impl $trait for $ty {} )*
132 };
133}
134
135// SAFETY: all these types respect `Scannable` invariants.
136impl_many!(unsafe impl Scannable for i8, u8, i16, u16, i32, u32, i64, u64, f32, f64);
137</code></pre>
138<p>Making a small macro for things like these is super useful. You could of course write <code>unsafe impl Scannable for T</code> for all ten <code>T</code> as well, but that introduces even more <code>unsafe</code> to read. Last but not least, let's replace the hardcoded <code>i32::from_ne_bytes</code> and <code>i32::to_ne_bytes</code> with <code>mem::transmute</code>.</p>
139<p>All the <code>windows(4)</code> need to be replaced with <code>windows(mem::size_of::&lt;T&gt;())</code> because the size may no longer be <code>4</code>. All the <code>i32::from_ne_bytes(...)</code> need to be replaced with <code>mem::transmute::&lt;_, T&gt;(...)</code>. We explicitly write out <code>T</code> to make sure the compiler doesn't accidentally infer something we didn't intend.</p>
140<p>And… it doesn't work at all. We're working with byte slices of arbitrary length. We cannot transmute a <code>&amp;[]</code> type, which is 16 bytes (8 for the pointer and 8 for the length), to our <code>T</code>. My plan to use transmute can't possibly work here. Sigh.</p>
141<h2 id="not-quite-transmuting-memory">Not quite transmuting memory</h2>
142<p>Okay, we can't transmute, because we don't have a sized value, we only have a slice of bytes pointing somewhere else. What we <em>could</em> do is reinterpret the pointer to those bytes as a different type, and then dereference it! This is still a form of &quot;transmutation&quot;, just without using <code>transmute</code>.</p>
143<pre><code class="language-rust" data-lang="rust">let value = unsafe { *(window.as_ptr() as *const T) };
144</code></pre>
145<p>Woop! You can compile this and test it out on the step 2 and 3 of the tutorial, using <code>i32</code>, and it will still work! Something troubles me, though. Can you see what it is?</p>
146<p>When we talked about invalid values, it had a note about unaligned references:</p>
147<blockquote>
148<p>a reference/<code>Box</code> that is dangling, unaligned, or points to an invalid value.</p>
149</blockquote>
150<p>Our <code>window</code> is essentially a reference to <code>T</code>. The only difference is we're working at the pointer level, but they're pretty much references. Let's see what the documentation for <a href="https://doc.rust-lang.org/std/primitive.pointer.html"><code>pointer</code></a> has to say as well, since we're dereferencing pointers:</p>
151<blockquote>
152<p>when a raw pointer is dereferenced (using the <code>*</code> operator), it must be non-null and aligned.</p>
153</blockquote>
154<p>It must be aligned. The only reason why our data is aligned is because we are also performing a &quot;fast scan&quot;, so we only look at aligned locations. This is a time bomb waiting to blow up. Is there any other way to <a href="https://doc.rust-lang.org/std/ptr/fn.read.html"><code>read</code></a> from a pointer which is safer?</p>
155<blockquote>
156<p><code>src</code> must be properly aligned. Use <a href="https://doc.rust-lang.org/std/ptr/fn.read_unaligned.html"><code>read_unaligned</code></a> if this is not the case.</p>
157</blockquote>
158<p>Bingo! Both <code>read</code> and <code>read_unaligned</code>, unlike dereferencing the pointer, will perform a copy, but if it can make the code less prone to blowing up, I'll take it<sup class="footnote-reference"><a href="#6">6</a></sup>. Let's change the code one more time:</p>
159<pre><code class="language-rust" data-lang="rust">let current = unsafe { window.as_ptr().cast::&lt;T&gt;().read_unaligned() };
160</code></pre>
161<p>I prefer to avoid type annotations in variables where possible, which is why I use the <a href="https://www.reddit.com/r/rust/comments/3fimgp/why_double_colon_rather_that_dot/ctozkd0/">turbofish</a> so often. You can get rid of the cast and use a type annotation instead, but make sure the type is known, otherwise it will think it's <code>u8</code> because <code>window</code> is a <code>&amp;[u8]</code>.</p>
162<p>Now, this is all cool and good. You can replace <code>i32</code> with <code>f32</code> for <code>T</code> and you'll be able to get halfway done with the step 4 of Cheat Engine's tutorial. Unfortunately, as it is, this code is not enough to complete step 4 with exact scans<sup class="footnote-reference"><a href="#7">7</a></sup>. You see, comparing floating point values is not as simple as checking for bitwise equality. We were actually really lucky that the <code>f32</code> part works! But the values in the <code>f64</code> part are not as precise as our inputs, so our exact scan fails.</p>
163<p>Using a fixed type parameter is pretty limiting as well. On the one hand, it is nice that, if you scan for <code>i32</code>, the compiler statically guarantees that subsequent scans will also happen on <code>i32</code> and thus be compatible. On the other, this requires us to know the type at compile time, which for an interactive program, is not possible. While we <em>could</em> create different methods for each supported type and, at runtime, decide to which we should jump, I am not satisfied with that solution. It also means we can't switch from scanning an <code>u32</code> to an <code>i32</code>, for whatever reason.</p>
164<p>So we need to work around this once more.</p>
165<h2 id="rethinking-the-scans">Rethinking the scans</h2>
166<p>What does our scanning function need, really? It needs a way to compare two chunks of memory as being equal or not (as we have seen, this isn't trivial with types such as floating point numbers) and, for other types of scans, it needs to be able to produce an ordering, or calculate a difference.</p>
167<p>Instead of having a our trait require the bounds <code>PartialEq</code> and <code>PartialOrd</code>, we can define our own methods to compare <code>Self</code> with <code>&amp;[u8]</code>. It still should be <code>Clone</code>, so we can pass it around without worrying about lifetimes:</p>
168<pre><code class="language-rust" data-lang="rust">// Callers must `assert_eq!(memory.len(), mem::size_of::&lt;Self&gt;())`.
169unsafe fn eq(&amp;self, memory: &amp;[u8]) -&gt; bool;
170unsafe fn cmp(&amp;self, memory: &amp;[u8]) -&gt; Ordering;
171</code></pre>
172<p>This can be trivially implemented for all integer types:</p>
173<pre><code class="language-rust" data-lang="rust">macro_rules! impl_scannable_for_int {
174 ( $( $ty:ty ),* ) =&gt; {
175 $(
176 // SAFETY: caller is responsible to `assert_eq!(memory.len(), mem::size_of::&lt;T&gt;())`
177 impl Scannable for $ty {
178 unsafe fn eq(&amp;self, memory: &amp;[u8]) -&gt; bool {
179 let other = unsafe { memory.as_ptr().cast::&lt;$ty&gt;().read_unaligned() };
180 *self == other
181 }
182
183 unsafe fn cmp(&amp;self, memory: &amp;[u8]) -&gt; Ordering {
184 let other = unsafe { memory.as_ptr().cast::&lt;$ty&gt;().read_unaligned() };
185 &lt;$ty as Ord&gt;::cmp(self, &amp;other)
186 }
187 }
188 )*
189 };
190}
191
192impl_scannable_for_int!(i8, u8, i16, u16, i32, u32, i64, u64);
193</code></pre>
194<p>The funny <code>&lt;$ty as Ord&gt;</code> is because I decided to call the method <code>Scannable::cmp</code>, so I have to disambiguate between it and <code>Ord::cmp</code>. We can go ahead and update the code using <code>Scannable</code> to use these new functions instead.</p>
195<p>Now, you may have noticed I only implemented it for the integer types. That's because floats need some extra care. Unfortunately, floating point types do not have any form of &quot;precision&quot; embedded in them, so we can't accurately say &quot;compare these floats to the precision level the user specified&quot;. What we can do, however, is drop a few bits from the mantissa, so &quot;relatively close&quot; quantities are considered equal. It's definitely not as good as comparing floats to the user's precision, but it will get the job done.</p>
196<p>I'm going to arbitrarily say that we are okay comparing with &quot;half&quot; the precision. We can achieve that by masking half of the bits from the mantissa to zero:</p>
197<pre><code class="language-rust" data-lang="rust">
198macro_rules! impl_scannable_for_float {
199 ( $( $ty:ty : $int_ty:ty ),* ) =&gt; {
200 $(
201 #[allow(unused_unsafe)] // mind you, it is necessary
202 impl Scannable for $ty {
203 unsafe fn eq(&amp;self, memory: &amp;[u8]) -&gt; bool {
204 const MASK: $int_ty = !((1 &lt;&lt; (&lt;$ty&gt;::MANTISSA_DIGITS / 2)) - 1);
205
206 // SAFETY: caller is responsible to `assert_eq!(memory.len(), mem::size_of::&lt;T&gt;())`
207 let other = unsafe { memory.as_ptr().cast::&lt;$ty&gt;().read_unaligned() };
208 let left = &lt;$ty&gt;::from_bits(self.to_bits() &amp; MASK);
209 let right = &lt;$ty&gt;::from_bits(other.to_bits() &amp; MASK);
210 left == right
211 }
212
213 ...
214 }
215 )*
216 };
217}
218
219impl_scannable_for_float!(f32: u32, f64: u64);
220</code></pre>
221<p>You may be wondering what's up with that weird <code>MASK</code>. Let's visualize it with a <a href="https://en.wikipedia.org/wiki/Bfloat16_floating-point_format"><code>f16</code></a>. This type has 16 bits, 1 for sign, 5 for exponent, and 10 for the mantissa:</p>
222<pre><code>S EEEEE MMMMMMMMMM
223</code></pre>
224<p>If we substitute the constant with the numeric value and operate:</p>
225<pre><code class="language-rust" data-lang="rust">!((1 &lt;&lt; (10 / 2)) - 1)
226!((1 &lt;&lt; 5) - 1)
227!(0b00000000_00100000 - 1)
228!(0b00000000_00011111)
2290b11111111_11100000
230</code></pre>
231<p>So effectively, half of the mantisssa bit will be masked to 0. For the <code>f16</code> example, this makes us lose 5 bits of precision. Comparing two floating point values with their last five bits truncated is equivalent to checking if they are &quot;roughly equal&quot;!</p>
232<p>When Cheat Engine scans for floating point values, several additional settings show, and one such option is &quot;truncated&quot;. I do not know if it behaves like this, but it might.</p>
233<p>Let's try this out:</p>
234<pre><code class="language-rust" data-lang="rust">#[test]
235fn f32_roughly_eq() {
236 let left = 0.25f32;
237 let right = 0.25000123f32;
238 let memory = unsafe { mem::transmute::&lt;_, [u8; 4]&gt;(right) };
239 assert_ne!(left, right);
240 assert!(unsafe { Scannable::eq(&amp;left, &amp;memory) });
241}
242</code></pre>
243<pre><code>&gt;cargo test f32_roughly_eq
244
245running 1 test
246test scan::candidate_location_tests::f32_roughly_eq ... ok
247</code></pre>
248<p>Huzzah! The <code>assert_ne!</code> makes sure that a normal comparision would fail, and then we <code>assert!</code> that our custom one passes the test. When the user performs an exact scan, the code will be more tolerant to the user's less precise inputs, which overall should result in a nicer experience.</p>
249<h2 id="dynamically-sized-scans">Dynamically sized scans</h2>
250<p>The second problem we need to solve is the possibility of the size not being known at compile time<sup class="footnote-reference"><a href="#8">8</a></sup>. While we can go as far as scanning over strings of a known length, this is rather limiting, because we need to know the length at compile time<sup class="footnote-reference"><a href="#9">9</a></sup>. Heap allocated objects are another problem, because we don't want to compare the memory representation of the stack object, but likely the memory where they point to (such as <code>String</code>).</p>
251<p>Instead of using <code>mem::size_of</code>, we can add a new method to our <code>Scannable</code>, <code>size</code>, which will tell us the size required of the memory view we're comparing against:</p>
252<pre><code class="language-rust" data-lang="rust">unsafe impl Scannable {
253 ...
254
255 fn size(&amp;self) -&gt; usize;
256}
257</code></pre>
258<p>It is <code>unsafe</code> to implement, because we are relying on the returned value to be truthful and unchanging. It should be safe to call, because it cannot have any invariants. Unfortunately, signaling &quot;unsafe to implement&quot; is done by marking the entire trait as <code>unsafe</code>, since &quot;unsafe to call&quot; is reserved for <code>unsafe fn</code>, and even though the rest of methods are not necessarily unsafe to implement, they're treated as such.</p>
259<p>At the moment, <code>Scannable</code> cannot be made into a trait object because it is <a href="https://doc.rust-lang.org/stable/error-index.html#E0038">not object safe</a>. This is caused by the <code>Clone</code> requirement on all <code>Scannable</code> object, which in turn needs the types to be <code>Sized</code> because <code>clone</code> returns <code>Self</code>. Because of this, the size must be known.</p>
260<p>However, we <em>can</em> move the <code>Clone</code> requirement to the methods that need it! This way, <code>Scannable</code> can remain object safe, enabling us to do the following:</p>
261<pre><code class="language-rust" data-lang="rust">unsafe impl&lt;T: AsRef&lt;dyn Scannable&gt; + AsMut&lt;dyn Scannable&gt;&gt; Scannable for T {
262 unsafe fn eq(&amp;self, memory: &amp;[u8]) -&gt; bool {
263 self.as_ref().eq(memory)
264 }
265
266 unsafe fn cmp(&amp;self, memory: &amp;[u8]) -&gt; Ordering {
267 self.as_ref().cmp(memory)
268 }
269
270 fn mem_view(&amp;self) -&gt; &amp;[u8] {
271 self.as_ref().mem_view()
272 }
273
274 fn size(&amp;self) -&gt; usize {
275 self.as_ref().size()
276 }
277}
278</code></pre>
279<p>Any type which can be interpreted as a reference to <code>Scannable</code> is also a scannable! This enables us to perform scans over <code>Box&lt;dyn i32&gt;</code>, where the type is known at runtime! Or rather, it would, if <code>Box&lt;dyn T&gt;</code> implemented <code>Clone</code>, which it can't<sup class="footnote-reference"><a href="#10">10</a></sup> because that's what prompted this entire issue. Dang it! I can't catch a breath today!</p>
280<p>Okay, let's step back. Why did we need our scannables to be clone in the first place? When we perform exact scans, we store the original value in the region, which we don't own, so we clone it. But what if we <em>did</em> own the value? Instead of taking the <code>Scan</code> by reference, which holds <code>T: Scannable</code>, we could take it by value. If we get rid of all the <code>Clone</code> bounds and update <code>Scan::run</code> to take <code>self</code>, along with updating all the things that take a <code>Region</code> to take them by value as well, it should all work out.</p>
281<p>But it does not. If we take <code>Scan</code> by value, with it not being <code>Clone</code>, we simply can't use it to scan over multiple regions. After the first region, we have lost the <code>Scan</code>.</p>
282<p>Let's take a second step back. We are scanning memory, and we want to compare memory, but we want to treat the memory with different semantics (for example, if we treat it as <code>f32</code>, we want to check for rough equality). Instead of storing the <em>value</em> itself, we could store its <em>memory representation</em>, and when we compare memory representations, we can do so under certain semantics.</p>
283<p>First off, let's revert getting rid of all <code>Clone</code>. Wherever we stored a <code>T</code>, we will now store a <code>Vec&lt;u8&gt;</code>. We will still use a type parameter to represent the &quot;implementations of <code>Scannable</code>&quot;. For this to work, our definitions need to use <code>T</code> somewhere, or else the compiler refuses to compile the code with error <a href="https://doc.rust-lang.org/stable/error-index.html#E0392">E0392</a>. For this, I will stick a <a href="https://doc.rust-lang.org/stable/std/marker/struct.PhantomData.html"><code>PhantomData</code></a> in the <code>Exact</code> variant. It's a bit pointless to include it in all variants, and <code>Exact</code> seems the most appropriated:</p>
284<pre><code class="language-rust" data-lang="rust">pub enum Scan&lt;T: Scannable&gt; {
285 Exact(Vec&lt;u8&gt;, PhantomData&lt;T&gt;),
286 Unknown,
287 ...
288}
289</code></pre>
290<p>This keeps in line with <code>Value</code>:</p>
291<pre><code class="language-rust" data-lang="rust">pub enum Value&lt;T: Scannable&gt; {
292 Exact(Vec&lt;u8&gt;, PhantomData&lt;T&gt;),
293 ...
294}
295</code></pre>
296<p>Our <code>Scannable</code> will no longer work on <code>T</code> and <code>&amp;[u8]</code>. Instead, it will work on two <code>&amp;[u8]</code>. We will also need a way to interpret a <code>T</code> as <code>&amp;[u8]</code>, which we can achieve with a new method, <code>mem_view</code>. This method interprets the raw memory representation of <code>self</code> as its raw bytes. It also lets us get rid of <code>size</code>, because we can simply do <code>mem_view().len()</code>. It's still <code>unsafe</code> to implement, because it should return the same length every time:</p>
297<pre><code class="language-rust" data-lang="rust">pub unsafe trait Scannable {
298 // Callers must `assert_eq!(left.len(), right.len(), self.mem_view().len())`.
299 unsafe fn eq(left: &amp;[u8], right: &amp;[u8]) -&gt; bool;
300 unsafe fn cmp(left: &amp;[u8], right: &amp;[u8]) -&gt; Ordering;
301 fn mem_view(&amp;self) -&gt; &amp;[u8];
302}
303</code></pre>
304<p>But now we can't use it in trait object, so the following no longer works:</p>
305<pre><code class="language-rust" data-lang="rust">unsafe impl&lt;T: AsRef&lt;dyn Scannable&gt; + AsMut&lt;dyn Scannable&gt;&gt; Scannable for T {
306 ...
307}
308</code></pre>
309<p>Ugh! Well, to be fair, we no longer have a &quot;scannable&quot; at this point. It's more like a scan mode that tells us how memory should be compared according to a certain type. Let's split the trait into two: one for the scan mode, and other for &quot;things which are scannable&quot;:</p>
310<pre><code class="language-rust" data-lang="rust">pub trait ScanMode {
311 unsafe fn eq(left: &amp;[u8], right: &amp;[u8]) -&gt; bool;
312 unsafe fn cmp(left: &amp;[u8], right: &amp;[u8]) -&gt; Ordering;
313}
314
315pub unsafe trait Scannable {
316 type Mode: ScanMode;
317
318 fn mem_view(&amp;self) -&gt; &amp;[u8];
319}
320</code></pre>
321<p>Note that we have an associated <code>type Mode</code> which contains the corresponding <code>ScanMode</code>. If we used a trait bound such as <code>Scannable: ScanMode</code>, we'd be back to square one: it would inherit the method definitions that don't use <code>&amp;self</code> and thus cannot be used as trait objects.</p>
322<p>With these changes, it is possible to implement <code>Scannable</code> for any <code>dyn Scannable</code>:</p>
323<pre><code class="language-rust" data-lang="rust">unsafe impl&lt;T: ScanMode + AsRef&lt;dyn Scannable&lt;Mode = Self&gt;&gt;&gt; Scannable for T {
324 type Mode = Self;
325
326 fn mem_view(&amp;self) -&gt; &amp;[u8] {
327 self.as_ref().mem_view()
328 }
329}
330</code></pre>
331<p>We do have to adjust a few places of the code to account for both <code>Scannable</code> and <code>ScanMode</code>, but all in all, it's pretty straightforward. Things like <code>Value</code> don't need to store the <code>Scannable</code> anymore, just a <code>Vec&lt;u8&gt;</code>. It also doesn't need the <code>ScanMode</code>, because it's not going to be scanning anything on its own. This applies transitively to <code>Region</code> which was holding a <code>Value</code>.</p>
332<p><code>Value</code> <em>does</em> need to be updated to store the size of the region we are scanning for, however, because we need that information when running a subsequent scan. For all <code>Scan</code> that don't have a explicit thing to scan for (like <code>Decreased</code>), the <code>size</code> also needs to be stored in them.</p>
333<p>Despite all our efforts, we're still unable to return an <code>Scannable</code> chosen at runtime.</p>
334<pre><code class="language-rust" data-lang="rust">fn prompt_user_for_scan() -&gt; Scan&lt;Box&lt;dyn Scannable&lt;Mode = ???&gt;&gt;&gt; {
335 todo!()
336}
337</code></pre>
338<p>As far as I can tell, there's simply no way to specify that type. We want to return a type which is scannable, which has itself (which is also a <code>ScanMode</code>) as the corresponding mode. Even if we just tried to return the mode, we simply can't, because it's not object-safe. Is this the end of the road?</p>
339<h2 id="specifying-the-scan-mode">Specifying the scan mode</h2>
340<p>We need a way to pass an arbitrary scan mode to our <code>Scan</code>. This scan mode should go in tandem with <code>Scannable</code> types, because it would be unsafe otherwise. We've seen that using a type just doesn't cut it. What else can we do?</p>
341<p>Using an enumeration is a no-go, because I want users to be able to extend it further. I also would like to avoid having to update the <code>enum</code> and all the matches every time I come up with a different type combination. And it could get pretty complicated if I ever built something dynamically, such as letting the user combine different scans in one pass.</p>
342<p>So what if we make <code>Scannable</code> return a value that implements the functions we need?</p>
343<pre><code class="language-rust" data-lang="rust">pub struct ScanMode {
344 eq: unsafe fn(left: &amp;[u8], right: &amp;[u8]) -&gt; bool,
345 cmp: unsafe fn(left: &amp;[u8], right: &amp;[u8]) -&gt; Ordering,
346}
347</code></pre>
348<p>It's definitely… non-conventional. But hey, now we're left with the <code>Scannable</code> trait, which is object-safe, and does not have any type parameters!</p>
349<pre><code class="language-rust" data-lang="rust">pub unsafe trait Scannable {
350 fn mem_view(&amp;self) -&gt; &amp;[u8];
351 fn scan_mode(&amp;self) -&gt; ScanMode;
352}
353</code></pre>
354<p>It is a bit weird, but defining local functions and using those in the returned value is a nice way to keep things properly scoped:</p>
355<pre><code class="language-rust" data-lang="rust">macro_rules! impl_scannable_for_int {
356 ( $( $ty:ty ),* ) =&gt; {
357 $(
358 unsafe impl Scannable for $ty {
359 fn mem_view(&amp;self) -&gt; &amp;[u8] {
360 unsafe { std::slice::from_raw_parts(self as *const _ as *const u8, mem::size_of::&lt;$ty&gt;()) }
361 }
362
363 fn scan_mode(&amp;self) -&gt; ScanMode {
364 unsafe fn eq(left: &amp;[u8], right: &amp;[u8]) -&gt; bool {
365 ...
366 }
367
368 unsafe fn cmp(left: &amp;[u8], right: &amp;[u8]) -&gt; Ordering {
369 ...
370 }
371
372 ScanMode { eq, cmp }
373 }
374 }
375 )*
376 };
377}
378</code></pre>
379<p>Our <code>Scan</code> needs to store the <code>Scannable</code> type, and not just the memory, once again. For variants that don't need any value, they can store the <code>ScanMode</code> and size instead.</p>
380<p>Does this solution work? Yes! It's possible to return a <code>Box&lt;dyn Scannable&gt;</code> from a function, and underneath, it may be using any type which is <code>Scannable</code>. Is this the best solution? Well, that's hard to say. This is <em>one</em> of the possible solutions.</p>
381<p>We have been going around in circles for quite some time now, so I'll leave it there. It's a solution, which may not be pretty, but it works. With these changes, the code is capable of completing all of the steps in the Cheat Engine tutorial up until point!</p>
382<h2 id="finale">Finale</h2>
383<p>If there's one lesson to learn from this post, it's that there is often no single correct solution to a problem. We could have approached the scan types in many, many ways (and we tried quite a few!), but in the end, choosing one option or the other comes down to your (sometimes self-imposed) requirements.</p>
384<p>You may <a href="https://github.com/lonami/memo">obtain the code for this post</a> over at my GitHub. You can run <code>git checkout step4</code> after cloning the repository to get the right version of the code. The code has gone through a lot of iterations, and I'd still like to polish it a bit more, so it might slightly differ from the code presented in this entry.</p>
385<p>If you feel adventurous, Cheat Engine has different options for scanning floating point types: &quot;rounded (default)&quot;, &quot;rounded (extreme)&quot;, and truncated. Optionally, it can scan for &quot;simple values only&quot;. You could go ahead and toy around with these!</p>
386<p>We didn't touch on types with different lengths, such as strings. You could support UTF-8, UTF-16, or arbitrary byte sequences. This post also didn't cover scanning for multiple things at once, known as &quot;groupscan commands&quot;, although from what I can tell, these are just a nice way to scan for arbitrary byte sequences.</p>
387<p>We also didn't look into supporting different the same scan with different alignments. All these things may be worth exploring depending on your requirements. You could even get rid of such genericity and go with something way simpler. Supporting <code>i32</code>, <code>f32</code> and <code>f64</code> is enough to complete the Cheat Engine tutorial. But I wanted something more powerful, although my solution currently can't scan for a sequence such as &quot;exact type, unknown, exact matching the unknown&quot;. So yeah.</p>
388<p>In the next post, we'll tackle the fifth step of the tutorial: Code finder. Cheat Engine attaches its debugger to the process for this one, and then replaces the instruction that performs the write with a different no-op so that nothing is written anymore. This will be quite the challenge!</p>
389<h3 id="footnotes">Footnotes</h3>
390<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
391<p><a href="https://doc.rust-lang.org/stable/std/ops/trait.Drop.html#copy-and-drop-are-exclusive"><code>Copy</code> and <code>Drop</code> are exclusive</a>. See also <a href="https://doc.rust-lang.org/stable/error-index.html#E0184">E0184</a>.</p>
392</div>
393<div class="footnote-definition" id="2"><sup class="footnote-definition-label">2</sup>
394<p>If you added more scan types that require additional bounds, make sure to add them too. For example, the &quot;decreased by&quot; scan requires the type to <code>impl Sub</code>.</p>
395</div>
396<div class="footnote-definition" id="3"><sup class="footnote-definition-label">3</sup>
397<p>This is a good time to remind you to read the documentation. It is of special importance when dealing with <code>unsafe</code> methods; I recommend reading it a couple times.</p>
398</div>
399<div class="footnote-definition" id="4"><sup class="footnote-definition-label">4</sup>
400<p>Even with this option, it would not be a bad idea to make the trait <code>unsafe</code>.</p>
401</div>
402<div class="footnote-definition" id="5"><sup class="footnote-definition-label">5</sup>
403<p>Not for long. As we will find out later, this approach has its limitations.</p>
404</div>
405<div class="footnote-definition" id="6"><sup class="footnote-definition-label">6</sup>
406<p>We can still perform the pointer dereference when we know it's aligned. This would likely be an optimization, although it would definitely complicate the code more.</p>
407</div>
408<div class="footnote-definition" id="7"><sup class="footnote-definition-label">7</sup>
409<p>It <em>would</em> work if you scanned for unknown values and then checked for decreased values repeatedly. But we can't just leave exact scan broken!</p>
410</div>
411<div class="footnote-definition" id="8"><sup class="footnote-definition-label">8</sup>
412<p>Unfortunately, this makes some optimizations harder or even impossible to perform. Providing specialized functions for types where the size is known at compile time could be worth doing. Programming is all tradeoffs.</p>
413</div>
414<div class="footnote-definition" id="9"><sup class="footnote-definition-label">9</sup>
415<p><a href="https://blog.rust-lang.org/2021/02/26/const-generics-mvp-beta.html">Rust 1.51</a>, which was not out at the time of writing, would make it a lot easier to allow scanning for fixed-length sequences of bytes, thanks to const generics.</p>
416</div>
417<div class="footnote-definition" id="10"><sup class="footnote-definition-label">10</sup>
418<p>Workarounds do exist, such as <a href="https://crates.io/crates/dyn-clone">dtolnay's <code>dyn-clone</code></a>. But I would rather not go that route.</p>
419</div>
420</content>
421 </entry>
422 <entry xml:lang="en">
423 <title>Writing our own Cheat Engine: Unknown initial value</title>
424 <published>2021-02-19T00:00:00+00:00</published>
425 <updated>2021-02-19T00:00:00+00:00</updated>
426 <link href="https://lonami.dev/blog/woce-3/" type="text/html"/>
427 <id>https://lonami.dev/blog/woce-3/</id>
428 <content type="html"><p>This is part 3 on the <em>Writing our own Cheat Engine</em> series:</p>
429<ul>
430<li><a href="/blog/woce-1">Part 1: Introduction</a> (start here if you're new to the series!)</li>
431<li><a href="/blog/woce-2">Part 2: Exact Value scanning</a></li>
432<li>Part 3: Unknown initial value</li>
433<li><a href="/blog/woce-4">Part 4: Floating points</a></li>
434</ul>
435<p>In part 2 we left off with a bit of a cliff-hanger. Our little program is now able to scan for an exact value, remember the couple hundred addresses pointing to said value, and perform subsequent scans to narrow the list of addresses down until we're left with a handful of them.</p>
436<p>However, it is not always the case that you have an exact value to work with. The best you can do in these cases is guess what the software might be storing. For example, it could be a floating point for your current movement speed in a game, or an integer for your current health.</p>
437<p>The problem with this is that there are far too many possible locations storing our desired value. If you count misaligned locations, this means there is a different location to address every single byte in memory. A program with one megabyte of memory already has a <em>million</em> of addresses. Clearly, we need to do better than performing one million memory reads<sup class="footnote-reference"><a href="#1">1</a></sup>.</p>
438<p>This post will shift focus a bit from using <code>winapi</code> to possible techniques to perform the various scans.</p>
439<h2 id="unknown-initial-value">Unknown initial value</h2>
440<details open><summary>Cheat Engine Tutorial: Step 3</summary>
441<blockquote>
442<p>Ok, seeing that you've figured out how to find a value using exact value let's move on to the next step.</p>
443<p>First things first though. Since you are doing a new scan, you have to click on New Scan first, to start a new scan. (You may think this is straighforward, but you'd be surprised how many people get stuck on that step) I won't be explaining this step again, so keep this in mind
444Now that you've started a new scan, let's continue</p>
445<p>In the previous test we knew the initial value so we could do a exact value, but now we have a status bar where we don't know the starting value.
446We only know that the value is between 0 and 500. And each time you click 'hit me' you lose some health. The amount you lose each time is shown above the status bar.</p>
447<p>Again there are several different ways to find the value. (like doing a decreased value by... scan), but I'll only explain the easiest. &quot;Unknown initial value&quot;, and decreased value.
448Because you don't know the value it is right now, a exact value wont do any good, so choose as scantype 'Unknown initial value', again, the value type is 4-bytes. (most windows apps use 4-bytes)click first scan and wait till it's done.</p>
449<p>When it is done click 'hit me'. You'll lose some of your health. (the amount you lost shows for a few seconds and then disappears, but you don't need that)
450Now go to Cheat Engine, and choose 'Decreased Value' and click 'Next Scan'
451When that scan is done, click hit me again, and repeat the above till you only find a few.</p>
452<p>We know the value is between 0 and 500, so pick the one that is most likely the address we need, and add it to the list.
453Now change the health to 5000, to proceed to the next step.</p>
454</blockquote>
455</details>
456<h2 id="dense-memory-locations">Dense memory locations</h2>
457<p>The key thing to notice here is that, when we read memory from another process, we do so over <em>entire regions</em>. A memory region is represented by a starting offset, a size, and a bunch of other things like protection level.</p>
458<p>When running the first scan for an unknown value, all we need to remember is the starting offset and size for every single region. All the candidate locations that could point to our value fall within this range, so it is enough for us to store the range definition, and not every location within it.</p>
459<p>To gain a better understanding of what this means, let's come up with a more specific scenario. With our current approach of doing things, we store an address (<code>usize</code>) for every location pointing to our desired value. In the case of unknown values, all locations are equally valid, since we don't know what value they should point to yet, and any value they point to is good. With this representation, we would end up with a very large vector:</p>
460<pre><code class="language-rust" data-lang="rust">let locations = vec![0x2000, 0x2001, ..., 0x20ff, 0x2100];
461</code></pre>
462<p>This representation is dense. Every single number in the range <code>0x2000..=0x2100</code> is present. So why bother storing the values individually when the range is enough?:</p>
463<pre><code class="language-rust" data-lang="rust">let locations = EntireRegion { range: 0x2000..=0x2100 };
464</code></pre>
465<p>Much better! With two <code>usize</code>, one for the starting location and another for the end, we can indicate that we care about all the locations falling in that range.</p>
466<p>In fact, some accessible memory regions immediately follow eachother, so we could even compact this further and merge regions which are together. But due to their potential differences with regards to protection levels, we will not attempt to merge regions.</p>
467<p>We don't want to get rid of the old way of storing locations, because once we start narrowing them down, we will want to go back to storing just a few candidates. To keep things tidy, let's introduce a new <code>enum</code> representing either possibility:</p>
468<pre><code class="language-rust" data-lang="rust">use std::ops::Range;
469
470pub enum CandidateLocations {
471 Discrete {
472 locations: Vec&lt;usize&gt;,
473 },
474 Dense {
475 range: Range&lt;usize&gt;,
476 }
477}
478</code></pre>
479<p>Let's also introduce another <code>enum</code> to perform the different scan types. For the time being, we will only worry about looking for <code>i32</code> in memory:</p>
480<pre><code class="language-rust" data-lang="rust">pub enum Scan {
481 Exact(i32),
482 Unknown,
483}
484</code></pre>
485<h2 id="storing-scanned-values">Storing scanned values</h2>
486<p>When scanning for exact values, it's not necessary to store the value found. We already know they're all the same, for example, value <code>42</code>. However, if the value is unknown, we do need to store it so that we can compare it in a subsequent scan to see if the value is the same or it changed. This means the value can be &quot;any within&quot; the read memory chunk:</p>
487<pre><code class="language-rust" data-lang="rust">pub enum Value {
488 Exact(i32),
489 AnyWithin(Vec&lt;u8&gt;),
490}
491</code></pre>
492<p>For every region in memory, there will be some candidate locations and a value (or value range) we need to compare against in subsequent scans:</p>
493<pre><code class="language-rust" data-lang="rust">pub struct Region {
494 pub info: winapi::um::winnt::MEMORY_BASIC_INFORMATION,
495 pub locations: CandidateLocations,
496 pub value: Value,
497}
498</code></pre>
499<p>With all the data structures needed setup, we can finally refactor our old scanning code into a new method capable of dealing with all these cases. For brevity, I will omit the exact scan, as it remains mostly unchanged:</p>
500<pre><code class="language-rust" data-lang="rust">use winapi::um::winnt::MEMORY_BASIC_INFORMATION;
501
502...
503
504// inside `impl Process`
505pub fn scan_regions(&amp;self, regions: &amp;[MEMORY_BASIC_INFORMATION], scan: Scan) -&gt; Vec&lt;Region&gt; {
506 regions
507 .iter()
508 .flat_map(|region| match scan {
509 Scan::Exact(n) =&gt; todo!(&quot;old scan implementation&quot;),
510 Scan::Unknown =&gt; {
511 let base = region.BaseAddress as usize;
512 match self.read_memory(region.BaseAddress as _, region.RegionSize) {
513 Ok(memory) =&gt; Some(Region {
514 info: region.clone(),
515 locations: CandidateLocations::Dense {
516 range: base..base + region.RegionSize,
517 },
518 value: Value::AnyWithin(memory),
519 }),
520 Err(_) =&gt; None,
521 }
522 }
523 })
524 .collect()
525}
526</code></pre>
527<p>Time to try it out!</p>
528<pre><code class="language-rust" data-lang="rust">impl CandidateLocations {
529 pub fn len(&amp;self) -&gt; usize {
530 match self {
531 CandidateLocations::Discrete { locations } =&gt; locations.len(),
532 CandidateLocations::Dense { range } =&gt; range.len(),
533 }
534 }
535}
536
537...
538
539fn main() {
540 // -snip-
541
542 println!(&quot;Scanning {} memory regions&quot;, regions.len());
543 let last_scan = process.scan_regions(&amp;regions, Scan::Unknown);
544 println!(
545 &quot;Found {} locations&quot;,
546 last_scan.iter().map(|r| r.locations.len()).sum::&lt;usize&gt;()
547 );
548}
549</code></pre>
550<pre><code>Scanning 88 memory regions
551Found 3014656 locations
552</code></pre>
553<p>If we consider misaligned locations, there is a lot of potential addresses where we could look for. Running the same scan on Cheat Engine yields <code>2,449,408</code> addresses, which is pretty close. It's probably skipping some additional regions that we are considering. Emulating Cheat Engine to perfection is not a concern for us at the moment, so I'm not going to investigate what regions it actually uses.</p>
554<h2 id="comparing-scanned-values">Comparing scanned values</h2>
555<p>Now that we have performed the initial scan and have stored all the <code>CandidateLocations</code> and <code>Value</code>, we can re-implement the &quot;next scan&quot; step to handle any variant of our <code>Scan</code> enum. This enables us to mix-and-match any <code>Scan</code> mode in any order. For example, one could perform an exact scan, then one for decreased values, or start with unknown scan and scan for unchanged values.</p>
556<p>The tutorial suggests using &quot;decreased value&quot; scan, so let's start with that:</p>
557<pre><code class="language-rust" data-lang="rust">pub enum Scan {
558 Exact(i32),
559 Unknown,
560 Decreased, // new!
561}
562</code></pre>
563<p>Other scanning modes, such as decreased by a known amount rather than any decrease, increased, unchanged, changed and so on, are not very different from the &quot;decreased&quot; scan, so I won't bore you with the details.</p>
564<p>I will use a different method to perform a &quot;rescan&quot;, since the first one is a bit more special in that it doesn't start with any previous values:</p>
565<pre><code class="language-rust" data-lang="rust">pub fn rescan_regions(&amp;self, regions: &amp;[Region], scan: Scan) -&gt; Vec&lt;Region&gt; {
566 regions
567 .iter()
568 .flat_map(|region| match scan {
569 Scan::Decreased =&gt; {
570 let mut locations = Vec::new();
571 match region.locations {
572 CandidateLocations::Dense { range } =&gt; {
573 match self.read_memory(range.start, range.end - range.start) {
574 Ok(memory) =&gt; match region.value {
575 Value::AnyWithin(previous) =&gt; {
576 memory
577 .windows(4)
578 .zip(previous.windows(4))
579 .enumerate()
580 .step_by(4)
581 .for_each(|(offset, (new, old))| {
582 let new = i32::from_ne_bytes([
583 new[0], new[1], new[2], new[3],
584 ]);
585 let old = i32::from_ne_bytes([
586 old[0], old[1], old[2], old[3],
587 ]);
588 if new &lt; old {
589 locations.push(range.start + offset);
590 }
591 });
592
593 Some(Region {
594 info: region.info.clone(),
595 locations: CandidateLocations::Discrete { locations },
596 value: Value::AnyWithin(memory),
597 })
598 }
599 _ =&gt; todo!(),
600 },
601 _ =&gt; todo!(),
602 }
603 }
604 _ =&gt; todo!(),
605 }
606 }
607 _ =&gt; todo!(),
608 })
609 .collect()
610}
611</code></pre>
612<p>If you've skimmed over that, I do not blame you. Here's the summary: for every existing region, when executing the scan mode &quot;decreased&quot;, if the previous locations were dense, read the entire memory region. On success, if the previous values were a chunk of memory, iterate over the current and old memory at the same time, and for every aligned <code>i32</code>, if the new value is less, store it.</p>
613<p>It's also making me ill. Before I leave a mess on the floor, does it work?</p>
614<pre><code class="language-rust" data-lang="rust">std::thread::sleep(std::time::Duration::from_secs(10));
615let last_scan = process.rescan_regions(&amp;last_scan, Scan::Decreased);
616println!(
617 &quot;Found {} locations&quot;,
618 last_scan.iter().map(|r| r.locations.len()).sum::&lt;usize&gt;()
619);
620</code></pre>
621<pre><code class="language-rust" data-lang="rust">Found 3014656 locations
622Found 177 locations
623</code></pre>
624<p>Okay, great, let's clean up this mess…</p>
625<h2 id="refactoring">Refactoring</h2>
626<p>Does it also make you uncomfortable to be writing something that you know will end up <em>huge</em> unless you begin refactoring other parts right now? I definitely feel that way. But I think it's good discipline to push through with something that works first, even if it's nasty, before going on a tangent. Now that we have the basic implementation working, let's take on this monster before it eats us alive.</p>
627<p>First things first, that method is inside an <code>impl</code> block. The deepest nesting level is 13. I almost have to turn around my chair to read the entire thing out!</p>
628<p>Second, we're nesting four matches. Three of them we care about: scan, candidate location, and value. If each of these <code>enum</code> has <code>S</code>, <code>C</code> and <code>V</code> variants respectively, writing each of these by hand will require <code>S * C * V</code> different implementations! Cheat Engine offers 10 different scans, I can think of at least 3 different ways to store candidate locations, and another 3 ways to store the values found. That's <code>10 * 3 * 3 = 90</code> different combinations. I am not willing to write out all these<sup class="footnote-reference"><a href="#2">2</a></sup>, so we need to start introducing some abstractions. Just imagine what a monster function you would end with! The horror!</p>
629<p>Third, why is the scan being executed in the process? This is something that should be done in the <code>impl Scan</code> instead!</p>
630<p>Let's begin the cleanup:</p>
631<pre><code class="language-rust" data-lang="rust">pub fn rescan_regions(&amp;self, regions: &amp;[Region], scan: Scan) -&gt; Vec&lt;Region&gt; {
632 todo!()
633}
634</code></pre>
635<p>I already feel ten times better.</p>
636<p>Now, this method will unconditionally read the entire memory region, even if the scan or the previous candidate locations don't need it<sup class="footnote-reference"><a href="#3">3</a></sup>. In the worst case with a single discrete candidate location, we will be reading a very large chunk of memory when we could have read just the 4 bytes needed for the <code>i32</code>. On the bright side, if there <em>are</em> more locations in this memory region, we will get read of them at the same time<sup class="footnote-reference"><a href="#4">4</a></sup>. So even if we're moving more memory around all the time, it isn't <em>too</em> bad.</p>
637<pre><code class="language-rust" data-lang="rust">regions
638 .iter()
639 .flat_map(
640 |region| match self.read_memory(region.info.BaseAddress as _, region.info.RegionSize) {
641 Ok(memory) =&gt; todo!(),
642 Err(err) =&gt; {
643 eprintln!(
644 &quot;Failed to read {} bytes at {:?}: {}&quot;,
645 region.info.RegionSize, region.info.BaseAddress, err,
646 );
647 None
648 }
649 },
650 )
651 .collect()
652</code></pre>
653<p>Great! If reading memory succeeds, we want to rerun the scan:</p>
654<pre><code class="language-rust" data-lang="rust">Ok(memory) =&gt; Some(scan.rerun(region, memory)),
655</code></pre>
656<p>The rerun will live inside <code>impl Scan</code>:</p>
657<pre><code class="language-rust" data-lang="rust">pub fn rerun(&amp;self, region: &amp;Region, memory: Vec&lt;u8&gt;) -&gt; Region {
658 match self {
659 Scan::Exact(_) =&gt; self.run(region.info.clone(), memory),
660 Scan::Unknown =&gt; region.clone(),
661 Scan::Decreased =&gt; todo!(),
662 }
663}
664</code></pre>
665<p>An exact scan doesn't care about any previous values, so it behaves like a first scan. The first scan is done by the <code>run</code> function (it contains the implementation factored out of the <code>Process::scan_regions</code> method), which only needs the region information and the current memory chunk we just read.</p>
666<p>The unknown scan leaves the region unchanged: any value stored is still valid, because it is unknown what we're looking for.</p>
667<p>The decreased scan will have to iterate over all the candidate locations, and compare them with the current memory chunk. But this time, we'll abstract this iteration too:</p>
668<pre><code class="language-rust" data-lang="rust">impl Region {
669 fn iter_locations&lt;'a&gt;(
670 &amp;'a self,
671 new_memory: &amp;'a [u8],
672 ) -&gt; impl Iterator&lt;Item = (usize, i32, i32)&gt; + 'a {
673 match &amp;self.locations {
674 CandidateLocations::Dense { range } =&gt; range.clone().step_by(4).map(move |addr| {
675 let old = self.value_at(addr);
676 let new = i32::from_ne_bytes([
677 new_memory[0],
678 new_memory[1],
679 new_memory[2],
680 new_memory[3],
681 ]);
682 (addr, old, new)
683 }),
684 _ =&gt; todo!(),
685 }
686 }
687}
688</code></pre>
689<p>For a dense candidate location, we iterate over all the 4-aligned addresses (fast scan for <code>i32</code> values), and yield <code>(current address, old value, new value)</code>. This way, the <code>Scan</code> can do anything it wants with the old and new values, and if it finds a match, it can use the address.</p>
690<p>The <code>value_at</code> method will deal with all the <code>Value</code> variants:</p>
691<pre><code class="language-rust" data-lang="rust">fn value_at(&amp;self, addr: usize) -&gt; i32 {
692 match &amp;self.value {
693 Value::AnyWithin(chunk) =&gt; {
694 let base = addr - self.info.BaseAddress as usize;
695 let bytes = &amp;chunk[base..base + 4];
696 i32::from_ne_bytes([bytes[0], bytes[1], bytes[2], bytes[3]])
697 }
698 _ =&gt; todo!(),
699 }
700}
701</code></pre>
702<p>This way, <code>iter_locations</code> can easily use any value type. With this, we have all <code>enum</code> covered: <code>Scan</code> in <code>rerun</code>, <code>CandidateLocation</code> in <code>iter_locations</code>, and <code>Value</code> in <code>value_at</code>. Now we can add as many variants as we want, and we will only need to update a single <code>match</code> arm for each of them. Let's implement <code>Scan::Decreased</code> and try it out:</p>
703<pre><code class="language-rust" data-lang="rust">pub fn rerun(&amp;self, region: &amp;Region, memory: Vec&lt;u8&gt;) -&gt; Region {
704 match self {
705 Scan::Decreased =&gt; Region {
706 info: region.info.clone(),
707 locations: CandidateLocations::Discrete {
708 locations: region
709 .iter_locations(&amp;memory)
710 .flat_map(|(addr, old, new)| if new &lt; old { Some(addr) } else { None })
711 .collect(),
712 },
713 value: Value::AnyWithin(memory),
714 },,
715 }
716}
717</code></pre>
718<pre><code>Found 3014656 locations
719Found 223791 locations
720</code></pre>
721<p>Hmm… before we went down from <code>3014656</code> to <code>177</code> locations, and now we went down to <code>223791</code>. Where did we go wrong?</p>
722<p>After spending several hours on this, I can tell you where we went wrong. <code>iter_locations</code> is always accessing the memory range <code>0..4</code>, and not the right address. Here's the fix:</p>
723<pre><code class="language-rust" data-lang="rust">CandidateLocations::Dense { range } =&gt; range.clone().step_by(4).map(move |addr| {
724 let old = self.value_at(addr);
725 let base = addr - self.info.BaseAddress as usize;
726 let bytes = &amp;new_memory[base..base + 4];
727 let new = i32::from_ne_bytes([bytes[0], bytes[1], bytes[2], bytes[3]]);
728 (addr, old, new)
729}),
730</code></pre>
731<h2 id="going-beyond">Going beyond</h2>
732<p>Let's take a look at other possible <code>Scan</code> types. Cheat Engine supports the following initial scan types:</p>
733<ul>
734<li>Exact Value</li>
735<li>Bigger than…</li>
736<li>Smaller than…</li>
737<li>Value between…</li>
738<li>Unknown initial value</li>
739</ul>
740<p>&quot;Bigger than&quot; and &quot;Smaller than&quot; can both be represented by &quot;Value between&quot;, so it's pretty much just three.</p>
741<p>For subsequent scans, in addition to the scan types described above, we find:</p>
742<ul>
743<li>Increased value</li>
744<li>Increased value by…</li>
745<li>Decreased value</li>
746<li>Decreased value by…</li>
747<li>Changed value</li>
748<li>Unchanged value</li>
749</ul>
750<p>Not only does Cheat Engine provide all of these scans, but all of them can also be negated. For example, &quot;find values that were not increased by 7&quot;. One could imagine to also support things like &quot;increased value by range&quot;. For the increased and decreased scans, Cheat Engine also supports &quot;at least xx%&quot;, so that if the value changed within the specified percentage interval, it will be considered.</p>
751<p>What about <code>CandidateLocations</code>? I can't tell you how Cheat Engine stores these, but I can tell you that <code>CandidateLocations::Discrete</code> can still be quite inefficient. Imagine you've started with a scan for unknown values and then ran a scan for unchanged valueus. Most values in memory will have been unchanged, but with our current implementation, we are now storing an entire <code>usize</code> address for each of these. One option would be to introduce <code>CandidateLocations::Sparse</code>, which would be a middle ground. You could implement it like <code>Dense</code> and include a vector of booleans telling you which values to consider, or go smaller and use a bitstring or bit vector. You could use a sparse vector data structure.</p>
752<p><code>Value</code> is very much like <code>CandidateLocations</code>, except that it stores a value to compare against and not an address. Here we can either have an exact value, or an older copy of the memory. Again, keeping a copy of the entire memory chunk when all we need is a handful of values is inefficient. You could keep a mapping from addresses to values if you don't have too many. Or you could shrink and fragment the copied memory in a more optimal way. There's a lot of room for improvement!</p>
753<p>What if, despite all of the efforts above, we still don't have enough RAM to store all this information? The Cheat Engine Tutorial doesn't use a lot of memory, but as soon as you try scanning bigger programs, like games, you may find yourself needing several gigabytes worth of memory to remember all the found values in order to compare them in subsequent scans. You may even need to consider dumping all the regions to a file and read from it to run the comparisons. For example, running a scan for &quot;unknown value&quot; in Cheat Engine brings its memory up by the same amount of memory used by the process scanned (which makes sense), but as soon as I ran a scan for &quot;unchanged value&quot; over the misaligned values, Cheat Engine's disk usage skyrocketed to 1GB/s (!) for several seconds on my SSD. After it finished, memory usage went down to normal. It was very likely writing out all candidate locations to disk.</p>
754<h2 id="finale">Finale</h2>
755<p>There is a lot of things to learn from Cheat Engine just by observing its behaviour, and we're only scratching its surface.</p>
756<p>In the <a href="/blog/woce-4">next post</a>, we'll tackle the fourth step of the tutorial: Floating points. So far, we have only been working with <code>i32</code> for simplicity. We will need to update our code to be able to account for different data types, which will make it easy to support other types like <code>i16</code>, <code>i64</code>, or even strings, represented as an arbitrary sequence of bytes.</p>
757<p>As usual, you can <a href="https://github.com/lonami/memo">obtain the code for this post</a> over at my GitHub. You can run <code>git checkout step3</code> after cloning the repository to get the right version of the code. This version is a bit cleaner than the one presented in the blog, and contains some of the things described in the <a href="https://lonami.dev/blog/woce-3/#going-beyond">Going beyond</a> section. Until next time!</p>
758<h3 id="footnotes">Footnotes</h3>
759<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
760<p>Well, technically, we will perform a million memory reads<sup class="footnote-reference"><a href="#5">5</a></sup>. The issue here is the million calls to <code>ReadProcessMemory</code>, not reading memory per se.</p>
761</div>
762<div class="footnote-definition" id="2"><sup class="footnote-definition-label">2</sup>
763<p>Not currently. After a basic implementation works, writing each implementation by hand and fine-tuning them by treating each of them as a special case could yield significant speed improvements. So although it would be a lot of work, this option shouldn't be ruled out completely.</p>
764</div>
765<div class="footnote-definition" id="3"><sup class="footnote-definition-label">3</sup>
766<p>You could ask the candidate locations where one should read, which would still keep the code reasonably simple.</p>
767</div>
768<div class="footnote-definition" id="4"><sup class="footnote-definition-label">4</sup>
769<p>You could also optimize for this case by determining both the smallest and largest address, and reading enough to cover them both. Or apply additional heuristics to only do so if the ratio of the size you're reading compared to the size you need isn't too large and abort the joint read otherwise. There is a lot of room for optimization here.</p>
770</div>
771<div class="footnote-definition" id="5"><sup class="footnote-definition-label">5</sup>
772<p>(A footnote in a footnote?) The machine registers, memory cache and compiler will all help lower this cost, so the generated executable might not actually need that many reads from RAM. But that's getting way too deep into the details now.</p>
773</div>
774</content>
775 </entry>
776 <entry xml:lang="en">
777 <title>Writing our own Cheat Engine: Exact Value scanning</title>
778 <published>2021-02-12T00:00:00+00:00</published>
779 <updated>2021-02-19T00:00:00+00:00</updated>
780 <link href="https://lonami.dev/blog/woce-2/" type="text/html"/>
781 <id>https://lonami.dev/blog/woce-2/</id>
782 <content type="html"><p>This is part 2 on the <em>Writing our own Cheat Engine</em> series:</p>
783<ul>
784<li><a href="/blog/woce-1">Part 1: Introduction</a> (start here if you're new to the series!)</li>
785<li>Part 2: Exact Value scanning</li>
786<li><a href="/blog/woce-3">Part 3: Unknown initial value</a></li>
787<li><a href="/blog/woce-4">Part 4: Floating points</a></li>
788</ul>
789<p>In the introduction, we spent a good deal of time enumerating all running processes just so we could find out the pid we cared about. With the pid now in our hands, we can do pretty much anything to its corresponding process.</p>
790<p>It's now time to read the process' memory and write to it. If our process was a single-player game, this would enable us to do things like setting a very high value on the player's current health pool, making us invincible. This technique will often not work for multi-player games, because the server likely knows your true current health (the most you could probably do is make the client render an incorrect value). However, if the server is crappy and it trusts the client, then you're still free to mess around with your current health.</p>
791<p>Even if we don't want to write to the process' memory, reading is still very useful. Maybe you could enhance your experience by making a custom overlay that displays useful information, or something that makes noise if it detects the life is too low, or even simulating a keyboard event to automatically recover some mana when you're running low.</p>
792<p>Be warned about anti-cheat systems. Anything beyond a basic game is likely to have some protection measures in place, making the analysis more difficult (perhaps the values are scrambled in memory), or even pinging the server if it detects something fishy.</p>
793<p><strong>I am not responsible for any bans!</strong> Use your brain before messing with online games, and don't ruin the fun for everyone else. If you get caught for cheating, I don't want to know about it.</p>
794<p>Now that all <a href="https://www.urbandictionary.com/define.php?term=script%20kiddie">script kiddies</a> have left the room, let's proceed with the post.</p>
795<h2 id="exact-value-scanning">Exact Value scanning</h2>
796<details open><summary>Cheat Engine Tutorial: Step 2</summary>
797<blockquote>
798<p>Now that you have opened the tutorial with Cheat Engine let's get on with the next step.</p>
799<p>You can see at the bottom of this window is the text Health: xxx. Each time you click 'Hit me' your health gets decreased.</p>
800<p>To get to the next step you have to find this value and change it to 1000</p>
801<p>To find the value there are different ways, but I'll tell you about the easiest, 'Exact Value': First make sure value type is set to at least 2-bytes or 4-bytes. 1-byte will also work, but you'll run into an easy to fix problem when you've found the address and want to change it. The 8-byte may perhaps works if the bytes after the address are 0, but I wouldn't take the bet. Single, double, and the other scans just don't work, because they store the value in a different way.</p>
802<p>When the value type is set correctly, make sure the scantype is set to 'Exact Value'. Then fill in the number your health is in the value box. And click 'First Scan'. After a while (if you have a extremely slow pc) the scan is done and the results are shown in the list on the left</p>
803<p>If you find more than 1 address and you don't know for sure which address it is, click 'Hit me', fill in the new health value into the value box, and click 'Next Scan'. Repeat this until you're sure you've found it. (that includes that there's only 1 address in the list.....)</p>
804<p>Now double click the address in the list on the left. This makes the address pop-up in the list at the bottom, showing you the current value. Double click the value, (or select it and press enter), and change the value to 1000.</p>
805<p>If everything went ok the next button should become enabled, and you're ready for the next step.</p>
806<p>Note: If you did anything wrong while scanning, click &quot;New Scan&quot; and repeat the scanning again. Also, try playing around with the value and click 'hit me'</p>
807</blockquote>
808</details>
809<h2 id="our-first-scan">Our First Scan</h2>
810<p>The Cheat Engine tutorial talks about &quot;value types&quot; and &quot;scan types&quot; like &quot;exact value&quot;.</p>
811<p>The <strong>value types</strong> will help us narrow down <em>what</em> we're looking for. For example, the integer type <code>i32</code> is represented in memory as 32 bits, or 4 bytes. However, <code>f32</code> is <em>also</em> represented by 4 bytes, and so is <code>u32</code>. Or perhaps the 4 bytes represent RGBA values of a color! So any 4 bytes in memory can be interpreted in many ways, and it's up to us to decide which way we interpret the bytes in.</p>
812<p>When programming, numbers which are 32-bit wide are common, as they're a good (and fast) size to work with. Scanning for this type is often a good bet. For positive numbers, <code>i32</code> is represented the same as <code>u32</code> in memory, so even if the value turns out to not be signed, the scan is likely to work. Focusing on <code>i32</code> will save us from scanning for <code>f32</code> or even other types, like interpreting 8 bytes for <code>i64</code>, <code>f64</code>, or less bytes like <code>i16</code>.</p>
813<p>The <strong>scan types</strong> will help us narrow down <em>how</em> we're looking for a value. Scanning for an exact value means what you think it does: interpret all 4 bytes in the process' memory as our value type, and check if they exactly match our value. This will often yield a lot of candidates, but it will be enough to get us started. Variations of the exact scan include checking for all values below a threshold, above, in between, or even just… unknown.</p>
814<p>What's the point of scanning for unknown values if <em>everything</em> in memory is unknown? Sometimes you don't have a concrete value. Maybe your health pool is a bar and it nevers tell you how much health you actually have, just a visual indicator of your percentage left, even if the health is not stored as a percentage. As we will find later on, scanning for unknown values is more useful than it might appear at first.</p>
815<p>We can access the memory of our own program by guessing random pointers and trying to read from them. But Windows isolates the memory of each program, so no pointer we could ever guess will let us read from the memory of another process. Luckily for us, searching for &quot;read process memory winapi&quot; leads us to the <a href="https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory"><code>ReadProcessMemory</code></a> function. Spot on.</p>
816<pre><code class="language-rust" data-lang="rust">pub fn read_memory(&amp;self, addr: usize, n: usize) -&gt; io::Result&lt;Vec&lt;u8&gt;&gt; {
817 todo!()
818}
819</code></pre>
820<p>Much like trying to dereference a pointer pointing to released memory or even null, reading from an arbitrary address can fail for the same reasons (and more). We will want to signal this with <code>io::Result</code>. It's funny to note that, even though we're doing something that seems wildly unsafe (reading arbitrary memory, even if the other process is mutating it at the same time), the function is perfectly safe. If we cannot read something, it will return <code>Err</code>, but if it succeeds, it has taken a snapshot of the memory of the process, and the returned value will be correctly initialized.</p>
821<p>The function will be defined inside our <code>impl Process</code>, since it conveniently holds an open handle to the process in question. It takes <code>&amp;self</code>, because we do not need to mutate anything in the <code>Process</code> instance. After adding the <code>memoryapi</code> feature to <code>Cargo.toml</code>, we can perform the call:</p>
822<pre><code class="language-rust" data-lang="rust">let mut buffer = Vec::&lt;u8&gt;::with_capacity(n);
823let mut read = 0;
824
825// SAFETY: the buffer points to valid memory, and the buffer size is correctly set.
826if unsafe {
827 winapi::um::memoryapi::ReadProcessMemory(
828 self.handle.as_ptr(),
829 addr as *const _,
830 buffer.as_mut_ptr().cast(),
831 buffer.capacity(),
832 &amp;mut read,
833 )
834} == FALSE
835{
836 Err(io::Error::last_os_error())
837} else {
838 // SAFETY: the call succeeded and `read` contains the amount of bytes written.
839 unsafe { buffer.set_len(read as usize) };
840 Ok(buffer)
841}
842</code></pre>
843<p>Great! But the address space is somewhat large. 64 bits large. Eighteen quintillion, four hundred and forty-six quadrillion, seven hundred and forty-four trillion, seventy-three billion, seven hundred and nine million, five hundred and fifty-one thousand, six hundred and sixteen<sup class="footnote-reference"><a href="#1">1</a></sup> large. You gave up reading that, didn't you? Anyway, 18'446'744'073'709'551'616 is a <em>big</em> number.</p>
844<p>I am not willing to wait for the program to scan over so many values. I don't even have 16 <a href="https://en.wikipedia.org/wiki/Orders_of_magnitude_(data)">exbibytes</a> of RAM installed on my laptop yet<sup class="footnote-reference"><a href="#2">2</a></sup>! What's up with that?</p>
845<h2 id="memory-regions">Memory regions</h2>
846<p>The program does not actually have all that memory allocated (surprise!). Random-guessing an address is extremely likely to point out to invalid memory. Reading from the start of the address space all the way to the end would not be any better. And we <strong>need</strong> to do better.</p>
847<p>We need to query for the memory regions allocated to the program. For this purpose we can use <a href="https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualqueryex"><code>VirtualQueryEx</code></a>.</p>
848<blockquote>
849<p>Retrieves information about a range of pages within the virtual address space of a specified process.</p>
850</blockquote>
851<p>We have enumerated things before, and this function is not all that different.</p>
852<pre><code class="language-rust" data-lang="rust">fn memory_regions(&amp;self) -&gt; io::Result&lt;winapi::um::winnt::MEMORY_BASIC_INFORMATION&gt; {
853 let mut info = MaybeUninit::uninit();
854
855 // SAFETY: the info structure points to valid memory.
856 let written = unsafe {
857 winapi::um::memoryapi::VirtualQueryEx(
858 self.handle.as_ptr(),
859 std::ptr::null(),
860 info.as_mut_ptr(),
861 mem::size_of::&lt;winapi::um::winnt::MEMORY_BASIC_INFORMATION&gt;(),
862 )
863 };
864 if written == 0 {
865 Err(io::Error::last_os_error())
866 } else {
867 // SAFETY: a non-zero amount was written to the structure
868 Ok(unsafe { info.assume_init() })
869 }
870}
871</code></pre>
872<p>We start with a base address of zero<sup class="footnote-reference"><a href="#3">3</a></sup> (<code>std::ptr::null()</code>), and ask the function to tell us what's in there. Let's try it out, with the <code>impl-debug</code> crate feature in <code>Cargo.toml</code>:</p>
873<pre><code class="language-rust" data-lang="rust">dbg!(process.memory_regions());
874</code></pre>
875<pre><code>&gt;cargo run
876Compiling memo v0.1.0
877
878error[E0277]: `winapi::um::winnt::MEMORY_BASIC_INFORMATION` doesn't implement `std::fmt::Debug`
879 --&gt; src\main.rs:185:5
880 |
881185 | dbg!(process.memory_regions());
882 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ `winapi::um::winnt::MEMORY_BASIC_INFORMATION` cannot be formatted using `{:?}` because it doesn't implement `std::fmt::Debug`
883</code></pre>
884<p>That's annoying. It seems not everything has an <code>impl std::fmt::Debug</code>, and <a href="https://github.com/retep998/winapi-rs/issues/548#issuecomment-355278090">you're supposed to send a PR</a> if you want it to have debug, even if the <code>impl-debug</code> feature is set. I'm surprised they don't auto-generate all of this and have to rely on manually adding <code>Debug</code> as needed? Oh well, let's get rid of the feature and print it out ourselves:</p>
885<pre><code>eprintln!(
886 &quot;Region:
887 BaseAddress: {:?}
888 AllocationBase: {:?}
889 AllocationProtect: {:?}
890 RegionSize: {:?}
891 State: {:?}
892 Protect: {:?}
893 Type: {:?}&quot;,
894 region.BaseAddress,
895 region.AllocationBase,
896 region.AllocationProtect,
897 region.RegionSize,
898 region.State,
899 region.Protect,
900 region.Type,
901);
902</code></pre>
903<p>Hopefully we don't need to do this often:</p>
904<pre><code>&gt;cargo run
905 Compiling memo v0.1.0
906 Finished dev [unoptimized + debuginfo] target(s) in 0.60s
907 Running `target\debug\memo.exe`
908
909Region:
910 BaseAddress: 0x0
911 AllocationBase: 0x0
912 AllocationProtect: 0
913 RegionSize: 65536
914 State: 65536
915 Protect: 1
916 Type: 0
917</code></pre>
918<p>Awesome! There is a region at <code>null</code>, and the <code>AllocationProtect</code> of zero indicates that &quot;the caller does not have access&quot; when the region was created. However, <code>Protect</code> is <code>1</code>, and that is the <em>current</em> protection level. A value of one indicates <a href="https://docs.microsoft.com/en-us/windows/win32/memory/memory-protection-constants"><code>PAGE_NOACCESS</code></a>:</p>
919<blockquote>
920<p>Disables all access to the committed region of pages. An attempt to read from, write to, or execute the committed region results in an access violation.</p>
921</blockquote>
922<p>Now that we know that the first region starts at 0 and has a size of 64 KiB, we can simply query for the page at <code>(current base + current size)</code> to fetch the next region. Essentially, we want to loop until it fails, after which we'll know there are no more pages<sup class="footnote-reference"><a href="#4">4</a></sup>:</p>
923<pre><code class="language-rust" data-lang="rust">pub fn memory_regions(&amp;self) -&gt; Vec&lt;winapi::um::winnt::MEMORY_BASIC_INFORMATION&gt; {
924 let mut base = 0;
925 let mut regions = Vec::new();
926 let mut info = MaybeUninit::uninit();
927
928 loop {
929 // SAFETY: the info structure points to valid memory.
930 let written = unsafe {
931 winapi::um::memoryapi::VirtualQueryEx(
932 self.handle.as_ptr(),
933 base as *const _,
934 info.as_mut_ptr(),
935 mem::size_of::&lt;winapi::um::winnt::MEMORY_BASIC_INFORMATION&gt;(),
936 )
937 };
938 if written == 0 {
939 break regions;
940 }
941 // SAFETY: a non-zero amount was written to the structure
942 let info = unsafe { info.assume_init() };
943 base = info.BaseAddress as usize + info.RegionSize;
944 regions.push(info);
945 }
946}
947</code></pre>
948<p><code>RegionSize</code> is:</p>
949<blockquote>
950<p>The size of the region beginning at the base address in which all pages have identical attributes, in bytes.</p>
951</blockquote>
952<p>…which also hints that the value we want is &quot;base address&quot;, not the &quot;allocation base&quot;. With these two values, we can essentially iterate over all the page ranges:</p>
953<pre><code class="language-rust" data-lang="rust">dbg!(process.memory_regions().len());
954</code></pre>
955<pre><code>&gt;cargo run
956 Compiling memo v0.1.0
957 Finished dev [unoptimized + debuginfo] target(s) in 0.63s
958 Running `target\debug\memo.exe`
959
960[src\main.rs:189] process.memory_regions().len() = 367
961</code></pre>
962<p>That's a lot of pages!</p>
963<h2 id="protection-levels">Protection levels</h2>
964<p>Let's try to narrow the amount of pages down. How many pages aren't <code>PAGE_NOACCESS</code>?</p>
965<pre><code class="language-rust" data-lang="rust">dbg!(process
966 .memory_regions()
967 .into_iter()
968 .filter(|p| p.Protect != winapi::um::winnt::PAGE_NOACCESS)
969 .count());
970</code></pre>
971<pre><code>295
972</code></pre>
973<p>Still a fair bit! Most likely, there are just a few interleaved <code>NOACCESS</code> pages, and the rest are allocated each with different protection levels. How much memory do we need to scan through?</p>
974<pre><code class="language-rust" data-lang="rust">dbg!(process
975 .memory_regions()
976 .into_iter()
977 .filter(|p| p.Protect != winapi::um::winnt::PAGE_NOACCESS)
978 .map(|p| p.RegionSize)
979 .sum::&lt;usize&gt;());
980</code></pre>
981<pre><code>4480434176
982</code></pre>
983<p>Wait, what? What do you mean over 4 GiB? The Task Manager claims that the Cheat Engine Tutorial is only using 2.1 MB worth of RAM! Perhaps we can narrow down the <a href="https://docs.microsoft.com/en-us/windows/win32/memory/memory-protection-constants">protection levels</a> a bit more. If you look at the scan options in Cheat Engine, you will notice the &quot;Memory Scan Options&quot; groupbox. By default, it only scans for memory that is writable, and doesn't care if it's executable or not:</p>
984<pre><code class="language-rust" data-lang="rust">let mask = winnt::PAGE_EXECUTE_READWRITE
985 | winnt::PAGE_EXECUTE_WRITECOPY
986 | winnt::PAGE_READWRITE
987 | winnt::PAGE_WRITECOPY;
988
989dbg!(process
990 .memory_regions()
991 .into_iter()
992 .filter(|p| (p.Protect &amp; mask) != 0)
993 .map(|p| p.RegionSize)
994 .sum::&lt;usize&gt;());
995</code></pre>
996<p>Each memory protection level has its own bit, so we can OR them all together to have a single mask. When ANDing this mask with the protection level, if any bit is set, it will be non-zero, meaning we want to keep this region.</p>
997<p>Don't ask me why there isn't a specific bit for &quot;write&quot;, &quot;read&quot;, &quot;execute&quot;, and there are only bits for combinations. I guess this way Windows forbids certain combinations.</p>
998<pre><code>2580480
999</code></pre>
1000<p>Hey, that's close to the value shown by the Task Manager! A handfull of megabytes is a lot more manageable than 4 entire gigabytes.</p>
1001<h2 id="actually-running-our-first-scan">Actually running our First Scan</h2>
1002<p>Okay, we have all the memory regions from which the program can read, write, or execute. Now we also can read the memory in these regions:</p>
1003<pre><code class="language-rust" data-lang="rust">let regions = process
1004 .memory_regions()
1005 .into_iter()
1006 .filter(|p| (p.Protect &amp; mask) != 0)
1007 .collect::&lt;Vec&lt;_&gt;&gt;();
1008
1009println!(&quot;Scanning {} memory regions&quot;, regions.len());
1010
1011regions.into_iter().for_each(|region| {
1012 match process.read_memory(region.BaseAddress as _, region.RegionSize) {
1013 Ok(memory) =&gt; todo!(),
1014 Err(err) =&gt; eprintln!(
1015 &quot;Failed to read {} bytes at {:?}: {}&quot;,
1016 region.RegionSize, region.BaseAddress, err,
1017 ),
1018 }
1019})
1020</code></pre>
1021<p>All that's left is for us to scan for a target value. To do this, we want to iterate over all the <a href="https://doc.rust-lang.org/stable/std/primitive.slice.html#method.windows"><code>slice::windows</code></a> of size equal to the size of our scan type.</p>
1022<pre><code class="language-rust" data-lang="rust">let target: i32 = ...;
1023let target = target.to_ne_bytes();
1024
1025// -snip-
1026
1027// inside the Ok match, replacing the todo!() -- this is where the first scan happens
1028Ok(memory) =&gt; memory
1029 .windows(target.len())
1030 .enumerate()
1031 .for_each(|(offset, window)| {
1032 if window == target {
1033 println!(
1034 &quot;Found exact value at [{:?}+{:x}]&quot;,
1035 region.BaseAddress, offset
1036 );
1037 }
1038 })
1039</code></pre>
1040<p>We convert the 32-bit exact target value to its memory representation as a byte array in <a href="https://doc.rust-lang.org/stable/std/primitive.i32.html#method.to_ne_bytes">native byte order</a>. This way we can compare the target bytes with the window bytes. Another option is to interpret the window bytes as an <code>i32</code> with <code>from_be_bytes</code>, but <code>slice::windows</code> gives us slices of type <code>&amp;[u8]</code>, and <code>from_be_bytes</code> wants an <code>[u8; 4]</code> array, so it's a bit more annoying to convert.</p>
1041<p>This is enough to find the value in the process' memory!</p>
1042<pre><code>Found exact value at [0x10000+aec]
1043Failed to read 12288 bytes at 0x13f8000: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (os error 299)
1044Found exact value at [0x14f0000+3188]
1045Found exact value at [0x14f0000+ac74]
1046...
1047Found exact value at [0x10030e000+1816]
1048Found exact value at [0x7ff8f7b93000+441a]
1049...
1050Found exact value at [0x7ff8fb381000+4023]
1051</code></pre>
1052<p>The tutorial starts out with health &quot;100&quot;, which is what I scanned. Apparently, there are nearly a hundred of <code>100</code>-valued integers stored in the memory of the tutorial.</p>
1053<p>Attentive readers will notice that some values are located at an offset modulo 4. In Cheat Engine, this is known as &quot;Fast Scan&quot;, which is enabled by default with an alignment of 4. Most of the time, values are aligned in memory, and this alignment often corresponds with the size of the type itself. For 4-byte integers, it's common that they're 4-byte aligned.</p>
1054<p>We can perform a fast scan ourselves with <a href="https://doc.rust-lang.org/stable/std/iter/trait.Iterator.html#method.step_by"><code>step_by</code></a><sup class="footnote-reference"><a href="#5">5</a></sup>:</p>
1055<pre><code class="language-rust" data-lang="rust">memory
1056 .windows(target.len())
1057 .enumerate()
1058 .step_by(4)
1059 .for_each(...)
1060</code></pre>
1061<p>As a bonus, over half the addresses are gone, so we have less results to worry about<sup class="footnote-reference"><a href="#6">6</a></sup>.</p>
1062<h2 id="next-scan">Next Scan</h2>
1063<p>The first scan gave us way too many results. We have no way to tell which is the correct one, as they all have the same value. What we need to do is a <em>second</em> scan at the <em>locations we just found</em>. This way, we can get a second reading, and compare it against a new value. If it's the same, we're on good track, and if not, we can discard a location. Repeating this process lets us cut the hundreds of potential addresses to just a handful of them.</p>
1064<p>For example, let's say we're scanning our current health of <code>100</code> in a game. This gives us over a hundred addresses that point to the value of <code>100</code>. If we go in-game and get hit<sup class="footnote-reference"><a href="#7">7</a></sup> by some enemy and get our health down to, say, <code>99</code> (we have a lot of defense), we can then read the memory at the hundred memory locations we found before. If this second reading is not <code>99</code>, we know the address does not actually point to our health pool and it just happened to also contain a <code>100</code> on the first scan. This address can be removed from the list of potential addresses pointing to our health.</p>
1065<p>Let's do that:</p>
1066<pre><code class="language-rust" data-lang="rust">// new vector to hold the locations, before getting into `memory.windows`' for-each
1067let mut locations = Vec::with_capacity(regions.len());
1068
1069// -snip-
1070
1071// updating the `println!(&quot;Found exact value...&quot;)` to store the location instead.
1072if window == target {
1073 locations.push(region.BaseAddress as usize + offset);
1074}
1075
1076// -snip-
1077
1078// performing a second scan on the locations the first scan found.
1079let target: i32 = ...;
1080let target = target.to_ne_bytes();
1081locations.retain(|addr| match process.read_memory(*addr, target.len()) {
1082 Ok(memory) =&gt; memory == target,
1083 Err(_) =&gt; false,
1084});
1085
1086println!(&quot;Now have {} locations&quot;, locations.len());
1087</code></pre>
1088<p>We create a vector to store all the locations the first scan finds, and then retain those that match a second target value. You may have noticed that we perform a memory read, and thus a call to the Windows API, for every single address. With a hundred locations to read from, this is not a big deal, but oftentimes you will have tens of thousands of addresses. For the time being, we will not worry about this inefficiency, but we will get back to it once it matters:</p>
1089<pre><code>Scanning 98 memory regions
1090Which exact value to scan for?: 100
1091Failed to read 12288 bytes at 0x13f8000: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (os error 299)
1092...
1093Found 49 locations
1094Which exact value to scan for next?: 99
1095Now have 1 locations
1096</code></pre>
1097<p>Sweet! In a real-world scenario, you will likely need to perform these additional scans a couple of times, and even then, there may be more than one value left no matter what.</p>
1098<p>For good measure, we'll wrap our <code>retain</code> in a <code>while</code> loop<sup class="footnote-reference"><a href="#8">8</a></sup>:</p>
1099<pre><code class="language-rust" data-lang="rust">while locations.len() != 1 {
1100 let target: i32 = ...;
1101 let target = target.to_ne_bytes();
1102 locations.retain(...);
1103}
1104</code></pre>
1105<h2 id="modifying-memory">Modifying memory</h2>
1106<p>Now that we have very likely locations pointing to our current health in memory, all that's left is writing our new desired value to gain infinite health<sup class="footnote-reference"><a href="#9">9</a></sup>. Much like how we're able to read memory with <code>ReadProcessMemory</code>, we can write to it with <a href="https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory"><code>WriteProcessMemory</code></a>. Its usage is straightforward:</p>
1107<pre><code class="language-rust" data-lang="rust">pub fn write_memory(&amp;self, addr: usize, value: &amp;[u8]) -&gt; io::Result&lt;usize&gt; {
1108 let mut written = 0;
1109
1110 // SAFETY: the input value buffer points to valid memory.
1111 if unsafe {
1112 winapi::um::memoryapi::WriteProcessMemory(
1113 self.handle.as_ptr(),
1114 addr as *mut _,
1115 value.as_ptr().cast(),
1116 value.len(),
1117 &amp;mut written,
1118 )
1119 } == FALSE
1120 {
1121 Err(io::Error::last_os_error())
1122 } else {
1123 Ok(written)
1124 }
1125}
1126</code></pre>
1127<p>Similar to how writing to a file can return short, writing to a memory location could also return short. Here we mimic the API for writing files and return the number of bytes written. The documentation indicates that we could actually ignore the amount written by passing <code>ptr::null_mut()</code> as the last parameter, but it does no harm to retrieve the written count as well.</p>
1128<pre><code class="language-rust" data-lang="rust">let new_value: i32 = ...;
1129locations
1130 .into_iter()
1131 .for_each(|addr| match process.write_memory(addr, &amp;new_value) {
1132 Ok(n) =&gt; eprintln!(&quot;Written {} bytes to [{:x}]&quot;, n, addr),
1133 Err(e) =&gt; eprintln!(&quot;Failed to write to [{:x}]: {}&quot;, addr, e),
1134 });
1135</code></pre>
1136<p>And just like that:</p>
1137<pre><code>Now have 1 location(s)
1138Enter new memory value: 1000
1139Failed to write to [15d8b90]: Access is denied. (os error 5)
1140</code></pre>
1141<p>…oh noes. Oh yeah. The documentation, which I totally didn't forget to read, mentions:</p>
1142<blockquote>
1143<p>The handle must have <code>PROCESS_VM_WRITE</code> and <code>PROCESS_VM_OPERATION</code> access to the process.</p>
1144</blockquote>
1145<p>We currently open our process with <code>PROCESS_QUERY_INFORMATION</code> and <code>PROCESS_VM_READ</code>, which is enough for reading, but not for writing. Let's adjust <code>OpenProcess</code> to accomodate for our new requirements:</p>
1146<pre><code class="language-rust" data-lang="rust">winapi::um::processthreadsapi::OpenProcess(
1147 winnt::PROCESS_QUERY_INFORMATION
1148 | winnt::PROCESS_VM_READ
1149 | winnt::PROCESS_VM_WRITE
1150 | winnt::PROCESS_VM_OPERATION,
1151 FALSE,
1152 pid,
1153)
1154</code></pre>
1155<p>Behold:</p>
1156<pre><code>Now have 1 location(s)
1157Enter new memory value: 1000
1158Written 4 bytes to [15d8b90]
1159</code></pre>
1160<p><img src="https://user-images.githubusercontent.com/6297805/107829541-3f4f2d00-6d8a-11eb-87c4-e2f2d505afbc.png" alt="Tutorial complete with memo" /></p>
1161<p>Isn't that active <em>Next</em> button just beautiful?</p>
1162<h2 id="finale">Finale</h2>
1163<p>This post somehow ended up being longer than part one, but look at what we've achieved! We completed a step of the Cheat Engine Tutorial <em>without using Cheat Engine</em>. Just pure Rust. Figuring out how a program works and reimplementing it yourself is a great way to learn what it's doing behind the scenes. And now that this code is yours, you can extend it as much as you like, without being constrained by Cheat Engine's UI. You can automate it as much as you want.</p>
1164<p>And we're not even done. The current tutorial has nine steps, and three additional graphical levels.</p>
1165<p>In the <a href="/blog/woce-3">next post</a>, we'll tackle the third step of the tutorial: Unknown initial value. This will pose a challenge, because with just 2 MiB of memory, storing all the 4-byte aligned locations would require 524288 addresses (<code>usize</code>, 8 bytes). This adds up to twice as much memory as the original program (4 MiB), but that's not our main concern, having to perform over five hundred thousand API calls is!</p>
1166<p>Remember that you can <a href="https://github.com/lonami/memo">obtain the code for this post</a> over at my GitHub. You can run <code>git checkout step2</code> after cloning the repository to get the right version of the code.</p>
1167<h3 id="footnotes">Footnotes</h3>
1168<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
1169<p>I did in fact use an online tool to spell it out for me.</p>
1170</div>
1171<div class="footnote-definition" id="2"><sup class="footnote-definition-label">2</sup>
1172<p>16 GiB is good enough for my needs. I don't think I'll ever upgrade to 16 EiB.</p>
1173</div>
1174<div class="footnote-definition" id="3"><sup class="footnote-definition-label">3</sup>
1175<p>Every address we query should have a corresponding region, even if it's not allocated or we do not have access. This is why we can query for the memory address zero to get its corresponding region.</p>
1176</div>
1177<div class="footnote-definition" id="4"><sup class="footnote-definition-label">4</sup>
1178<p>Another option is to <a href="https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsysteminfo"><code>GetSystemInfo</code></a> to determine the <code>lpMinimumApplicationAddress</code> and <code>lpMaximumApplicationAddress</code> and only work within bounds.</p>
1179</div>
1180<div class="footnote-definition" id="5"><sup class="footnote-definition-label">5</sup>
1181<p>Memory regions are page-aligned, which is a large power of two. Our alignment of 4 is much lower than this, so we're guaranteed to start off at an aligned address.</p>
1182</div>
1183<div class="footnote-definition" id="6"><sup class="footnote-definition-label">6</sup>
1184<p>If it turns out that the value was actually misaligned, we will miss it. You will notice this if, after going through the whole process, there are no results. It could mean that either the value type is wrong, or the value type is misaligned. In the worst case, the value is not stored directly but is rather computed with something like <code>maximum - stored</code>, or XORed with some magic value, or a myriad other things.</p>
1185</div>
1186<div class="footnote-definition" id="7"><sup class="footnote-definition-label">7</sup>
1187<p>You could do this without getting hit, and just keep on repeating the scan for the same value over and over again. This does work, but the results are suboptimal, because there are also many other values that didn't change. Scanning for a changed value is a better option.</p>
1188</div>
1189<div class="footnote-definition" id="8"><sup class="footnote-definition-label">8</sup>
1190<p>You could actually just go ahead and try to modify the memory at the hundred addresses you just found, although don't be surprised if the program starts to misbehave!</p>
1191</div>
1192<div class="footnote-definition" id="9"><sup class="footnote-definition-label">9</sup>
1193<p>Okay, we cannot fit infinity in an <code>i32</code>. However, we can fit sufficiently large numbers. Like <code>1000</code>, which is enough to complete the tutorial.</p>
1194</div>
1195</content>
1196 </entry>
1197 <entry xml:lang="en">
1198 <title>Writing our own Cheat Engine: Introduction</title>
1199 <published>2021-02-07T00:00:00+00:00</published>
1200 <updated>2021-02-19T00:00:00+00:00</updated>
1201 <link href="https://lonami.dev/blog/woce-1/" type="text/html"/>
1202 <id>https://lonami.dev/blog/woce-1/</id>
1203 <content type="html"><p>This is part 1 on the <em>Writing our own Cheat Engine</em> series:</p>
1204<ul>
1205<li>Part 1: Introduction</li>
1206<li><a href="/blog/woce-2">Part 2: Exact Value scanning</a></li>
1207<li><a href="/blog/woce-3">Part 3: Unknown initial value</a></li>
1208<li><a href="/blog/woce-4">Part 4: Floating points</a></li>
1209</ul>
1210<p><a href="https://cheatengine.org/">Cheat Engine</a> is a tool designed to modify single player games and contains other useful tools within itself that enable its users to debug games or other applications. It comes with a memory scanner, (dis)assembler, inspection tools and a handful other things. In this series, we will be writing our own tiny Cheat Engine capable of solving all steps of the tutorial, and diving into how it all works underneath.</p>
1211<p>Needless to say, we're doing this for private and educational purposes only. One has to make sure to not violate the EULA or ToS of the specific application we're attaching to. This series, much like cheatengine.org, does not condone the illegal use of the code shared.</p>
1212<p>Cheat Engine is a tool for Windows, so we will be developing for Windows as well. However, you can also <a href="https://stackoverflow.com/q/12977179/4759433">read memory from Linux-like systems</a>. <a href="https://github.com/scanmem/scanmem">GameConqueror</a> is a popular alternative to Cheat Engine on Linux systems, so if you feel adventurous, you could definitely follow along too! The techniques shown in this series apply regardless of how we read memory from a process. You will learn a fair bit about doing FFI in Rust too.</p>
1213<p>We will be developing the application in Rust, because it enables us to interface with the Windows API easily, is memory safe (as long as we're careful with <code>unsafe</code>!), and is speedy (we will need this for later steps in the Cheat Engine tutorial). You could use any language of your choice though. For example, <a href="https://lonami.dev/blog/ctypes-and-windows/">Python also makes it relatively easy to use the Windows API</a>. You don't need to be a Rust expert to follow along, but this series assumes some familiarity with C-family languages. Slightly advanced concepts like the use of <code>unsafe</code> or the <code>MaybeUninit</code> type will be briefly explained. What a <code>fn</code> is or what <code>let</code> does will not be explained.</p>
1214<p><a href="https://github.com/cheat-engine/cheat-engine/">Cheat Engine's source code</a> is mostly written in Pascal and C. And it's <em>a lot</em> of code, with a very flat project structure, and files ranging in the thousand lines of code each. It's daunting<sup class="footnote-reference"><a href="#1">1</a></sup>. It's a mature project, with a lot of knowledge encoded in the code base, and a lot of features like distributed scanning or an entire disassembler. Unfortunately, there's not a lot of comments. For these reasons, I'll do some guesswork when possible as to how it's working underneath, rather than actually digging into what Cheat Engine is actually doing.</p>
1215<p>With that out of the way, let's get started!</p>
1216<h2 id="welcome-to-the-cheat-engine-tutorial">Welcome to the Cheat Engine Tutorial</h2>
1217<details open><summary>Cheat Engine Tutorial: Step 1</summary>
1218<blockquote>
1219<p>This tutorial will teach you the basics of cheating in video games. It will also show you foundational aspects of using Cheat Engine (or CE for short). Follow the steps below to get started.</p>
1220<ol>
1221<li>Open Cheat Engine if it currently isn't running.</li>
1222<li>Click on the &quot;Open Process&quot; icon (it's the top-left icon with the computer on it, below &quot;File&quot;.).</li>
1223<li>With the Process List window now open, look for this tutorial's process in the list. It will look something like &gt; &quot;00001F98-Tutorial-x86_64.exe&quot; or &quot;0000047C-Tutorial-i386.exe&quot;. (The first 8 numbers/letters will probably be different.)</li>
1224<li>Once you've found the process, click on it to select it, then click the &quot;Open&quot; button. (Don't worry about all the &gt; other buttons right now. You can learn about them later if you're interested.)</li>
1225</ol>
1226<p>Congratulations! If you did everything correctly, the process window should be gone with Cheat Engine now attached to the &gt; tutorial (you will see the process name towards the top-center of CE).</p>
1227<p>Click the &quot;Next&quot; button below to continue, or fill in the password and click the &quot;OK&quot; button to proceed to that step.)</p>
1228<p>If you're having problems, simply head over to forum.cheatengine.org, then click on &quot;Tutorials&quot; to view beginner-friendly &gt; guides!</p>
1229</blockquote>
1230</details>
1231<h2 id="enumerating-processes">Enumerating processes</h2>
1232<p>Our first step is attaching to the process we want to work with. But we need a way to find that process in the first place! Having to open the task manager, look for the process we care about, noting down the process ID (PID), and slapping it in the source code is not satisfying at all. Instead, let's enumerate all the processes from within the program, and let the user select one by typing its name.</p>
1233<p>From a quick <a href="https://ddg.gg/winapi%20enumerate%20all%20processes">DuckDuckGo search</a>, we find an official tutorial for <a href="https://docs.microsoft.com/en-us/windows/win32/psapi/enumerating-all-processes">Enumerating All Processes</a>, which leads to the <a href="https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-enumprocesses"><code>EnumProcesses</code></a> call. Cool! Let's slap in the <a href="https://crates.io/crates/winapi"><code>winapi</code></a> crate on <code>Cargo.toml</code>, because I don't want to write all the definitions by myself:</p>
1234<pre><code class="language-toml" data-lang="toml">[dependencies]
1235winapi = { version = &quot;0.3.9&quot;, features = [&quot;psapi&quot;] }
1236</code></pre>
1237<p>Because <a href="https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-enumprocesses"><code>EnumProcesses</code></a> is in <code>Psapi.h</code> (you can see this in the online page of its documentation), we know we'll need the <code>psapi</code> crate feature. Another option is to search for it in the <a href="https://docs.rs/winapi/"><code>winapi</code> documentation</a> and noting down the parent module where its stored.</p>
1238<p>The documentation for the method has the following remark:</p>
1239<blockquote>
1240<p>It is a good idea to use a large array, because it is hard to predict how many processes there will be at the time you call <strong>EnumProcesses</strong>.</p>
1241</blockquote>
1242<p><em>Sidenote: reading the documentation for the methods we'll use from the Windows API is extremely important. There's a lot of gotchas involved, so we need to make sure we're extra careful.</em></p>
1243<p>1024 is a pretty big number, so let's go with that:</p>
1244<pre><code class="language-rust" data-lang="rust">use std::io;
1245use std::mem;
1246use winapi::shared::minwindef::{DWORD, FALSE};
1247
1248pub fn enum_proc() -&gt; io::Result&lt;Vec&lt;u32&gt;&gt; {
1249 let mut pids = Vec::&lt;DWORD&gt;::with_capacity(1024);
1250 let mut size = 0;
1251 // SAFETY: the pointer is valid and the size matches the capacity.
1252 if unsafe {
1253 winapi::um::psapi::EnumProcesses(
1254 pids.as_mut_ptr(),
1255 (pids.capacity() * mem::size_of::&lt;DWORD&gt;()) as u32,
1256 &amp;mut size,
1257 )
1258 } == FALSE
1259 {
1260 return Err(io::Error::last_os_error());
1261 }
1262
1263 todo!()
1264}
1265</code></pre>
1266<p>We allocate enough space<sup class="footnote-reference"><a href="#2">2</a></sup> for 1024 <code>pids</code> in a vector<sup class="footnote-reference"><a href="#3">3</a></sup>, and pass a mutable pointer to the contents to <code>EnumProcesses</code>. Note that the size of the array is in <em>bytes</em>, not items, so we need to multiply the capacity by the size of <code>DWORD</code>. The API likes to use <code>u32</code> for sizes, unlike Rust which uses <code>usize</code>, so we need a cast.</p>
1267<p>Last, we need another mutable variable where the amount of bytes written is stored, <code>size</code>.</p>
1268<blockquote>
1269<p>If the function fails, the return value is zero. To get extended error information, call <a href="https://docs.microsoft.com/en-us/windows/win32/api/errhandlingapi/nf-errhandlingapi-getlasterror"><code>GetLastError</code></a>.</p>
1270</blockquote>
1271<p>That's precisely what we do. If it returns false (zero), we return the last OS error. Rust provides us with <a href="https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.last_os_error"><code>std::io::Error::last_os_error</code></a>, which essentially makes that same call but returns a proper <code>io::Error</code> instance. Cool!</p>
1272<blockquote>
1273<p>To determine how many processes were enumerated, divide the <em>lpcbNeeded</em> value by <code>sizeof(DWORD)</code>.</p>
1274</blockquote>
1275<p>Easy enough:</p>
1276<pre><code class="language-rust" data-lang="rust">let count = size as usize / mem::size_of::&lt;DWORD&gt;();
1277// SAFETY: the call succeeded and count equals the right amount of items.
1278unsafe { pids.set_len(count) };
1279Ok(pids)
1280</code></pre>
1281<p>Rust doesn't know that the memory for <code>count</code> items were initialized by the call, but we do, so we make use of the <a href="https://doc.rust-lang.org/stable/std/vec/struct.Vec.html#method.set_len"><code>Vec::set_len</code></a> call to indicate this. The Rust documentation even includes a FFI similar to our code!</p>
1282<p>Let's give it a ride:</p>
1283<pre><code class="language-rust" data-lang="rust">fn main() {
1284 dbg!(enum_proc().unwrap().len());
1285}
1286</code></pre>
1287<pre><code>&gt;cargo run
1288 Compiling memo v0.1.0
1289 Finished dev [unoptimized + debuginfo] target(s) in 0.20s
1290 Running `target\debug\memo.exe`
1291[src\main.rs:27] enum_proc().unwrap().len() = 178
1292</code></pre>
1293<p>It works! But currently we only have a bunch of process identifiers, with no way of knowing which process they refer to.</p>
1294<blockquote>
1295<p>To obtain process handles for the processes whose identifiers you have just obtained, call the <a href="https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess"><code>OpenProcess</code></a> function.</p>
1296</blockquote>
1297<p>Oh!</p>
1298<h2 id="opening-a-process">Opening a process</h2>
1299<p>The documentation for <code>OpenProcess</code> also contains the following:</p>
1300<blockquote>
1301<p>When you are finished with the handle, be sure to close it using the <a href="https://lonami.dev/blog/woce-1/closehandle"><code>CloseHandle</code></a> function.</p>
1302</blockquote>
1303<p>This sounds to me like the perfect time to introduce a custom <code>struct Process</code> with an <code>impl Drop</code>! We're using <code>Drop</code> to cleanup resources, not behaviour, so it's fine. <a href="https://internals.rust-lang.org/t/pre-rfc-leave-auto-trait-for-reliable-destruction/13825">Using <code>Drop</code> to cleanup behaviour is a bad idea</a>. But anyway, let's get back to the code:</p>
1304<pre><code class="language-rust" data-lang="rust">use std::ptr::NonNull;
1305use winapi::ctypes::c_void;
1306
1307pub struct Process {
1308 pid: u32,
1309 handle: NonNull&lt;c_void&gt;,
1310}
1311
1312impl Process {
1313 pub fn open(pid: u32) -&gt; io::Result&lt;Self&gt; {
1314 todo!()
1315 }
1316}
1317
1318impl Drop for Process {
1319 fn drop(&amp;mut self) {
1320 todo!()
1321 }
1322}
1323</code></pre>
1324<p>For <code>open</code>, we'll want to use <code>OpenProcess</code> (and we also need to add the <code>processthreadsapi</code> feature to the <code>winapi</code> dependency in <code>Cargo.toml</code>). It returns a <code>HANDLE</code>, which is a nullable mutable pointer to <code>c_void</code>. If it's null, the call failed, and if it's non-null, it succeeded and we have a valid handle. This is why we use Rust's <a href="https://doc.rust-lang.org/stable/std/ptr/struct.NonNull.html"><code>NonNull</code></a>:</p>
1325<pre><code class="language-rust" data-lang="rust">// SAFETY: the call doesn't have dangerous side-effects.
1326NonNull::new(unsafe { winapi::um::processthreadsapi::OpenProcess(0, FALSE, pid) })
1327 .map(|handle| Self { pid, handle })
1328 .ok_or_else(io::Error::last_os_error)
1329</code></pre>
1330<p><code>NonNull</code> will return <code>Some</code> if the pointer is non-null. We map the non-null pointer to a <code>Process</code> instance with <code>Self { .. }</code>. <code>ok_or_else</code> converts the <code>Option</code> to a <code>Result</code> with the error builder function we provide if it was <code>None</code>.</p>
1331<p>The first parameter is a bitflag of permissions we want to have. For now, we can leave it as zero (all bits unset, no specific permissions granted). The second one is whether we want to inherit the handle, which we don't, and the third one is the process identifier. Let's close the resource handle on <code>Drop</code> (after adding <code>handleapi</code> to the crate features):</p>
1332<pre><code class="language-rust" data-lang="rust">// SAFETY: the handle is valid and non-null.
1333unsafe { winapi::um::handleapi::CloseHandle(self.handle.as_mut()) };
1334</code></pre>
1335<p><code>CloseHandle</code> can actually fail (for example, on double-close), but given our invariants, it won't. You could add an <code>assert!</code> to panic if this is not the case.</p>
1336<p>We can now open processes, and they will be automatically closed on <code>Drop</code>. Does any of this work though?</p>
1337<pre><code class="language-rust" data-lang="rust">fn main() {
1338 let mut success = 0;
1339 let mut failed = 0;
1340 enum_proc().unwrap().into_iter().for_each(|pid| match Process::open(pid) {
1341 Ok(_) =&gt; success += 1,
1342 Err(_) =&gt; failed += 1,
1343 });
1344
1345 eprintln!(&quot;Successfully opened {}/{} processes&quot;, success, success + failed);
1346}
1347</code></pre>
1348<pre><code>&gt;cargo run
1349 Compiling memo v0.1.0
1350 Finished dev [unoptimized + debuginfo] target(s) in 0.36s
1351 Running `target\debug\memo.exe`
1352Successfully opened 0/191 processes
1353</code></pre>
1354<p>…nope. Maybe the documentation for <code>OpenProcess</code> says something?</p>
1355<blockquote>
1356<p><code>dwDesiredAccess</code></p>
1357<p>The access to the process object. This access right is checked against the security descriptor for the process. This parameter can be <strong>one or more</strong> of the process access rights.</p>
1358</blockquote>
1359<p>One or more, but we're setting zero permissions. I told you, reading the documentation is important<sup class="footnote-reference"><a href="#4">4</a></sup>! The <a href="https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights">Process Security and Access Rights</a> page lists all possible values we could use. <code>PROCESS_QUERY_INFORMATION</code> seems to be appropriated:</p>
1360<blockquote>
1361<p>Required to retrieve certain information about a process, such as its token, exit code, and priority class</p>
1362</blockquote>
1363<pre><code class="language-rust" data-lang="rust">OpenProcess(winapi::um::winnt::PROCESS_QUERY_INFORMATION, ...)
1364</code></pre>
1365<p>Does this fix it?</p>
1366<pre><code class="language-rust" data-lang="rust">&gt;cargo run
1367 Compiling memo v0.1.0
1368 Finished dev [unoptimized + debuginfo] target(s) in 0.36s
1369 Running `target\debug\memo.exe`
1370Successfully opened 69/188 processes
1371</code></pre>
1372<p><em>Nice</em>. It does solve it. But why did we only open 69 processes out of 188? Does it help if we run our code as administrator? Let's search for <code>cmd</code> in the Windows menu and right click to Run as administrator, then <code>cd</code> into our project and try again:</p>
1373<pre><code>&gt;cargo run
1374 Finished dev [unoptimized + debuginfo] target(s) in 0.01s
1375 Running `target\debug\memo.exe`
1376Successfully opened 77/190 processes
1377</code></pre>
1378<p>We're able to open a few more, so it does help. In general, we'll want to run as administrator, so normal programs can't sniff on what we're doing, and so that we have permission to do more things.</p>
1379<h2 id="getting-the-name-of-a-process">Getting the name of a process</h2>
1380<p>We're not done enumerating things just yet. To get the &quot;name&quot; of a process, we need to enumerate the modules that it has loaded, and only then can we get the module base name. The first module is the program itself, so we don't need to enumerate <em>all</em> modules, just the one is enough.</p>
1381<p>For this we want <a href="https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-enumprocessmodules"><code>EnumProcessModules</code></a> and <a href="https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getmodulebasenamea"><code>GetModuleBaseNameA</code></a>. I'm using the ASCII variant of <code>GetModuleBaseName</code> because I'm too lazy to deal with UTF-16 of the <code>W</code> (wide, unicode) variants.</p>
1382<pre><code class="language-rust" data-lang="rust">use std::mem::MaybeUninit;
1383use winapi::shared::minwindef::HMODULE;
1384
1385pub fn name(&amp;self) -&gt; io::Result&lt;String&gt; {
1386 let mut module = MaybeUninit::&lt;HMODULE&gt;::uninit();
1387 let mut size = 0;
1388 // SAFETY: the pointer is valid and the size is correct.
1389 if unsafe {
1390 winapi::um::psapi::EnumProcessModules(
1391 self.handle.as_ptr(),
1392 module.as_mut_ptr(),
1393 mem::size_of::&lt;HMODULE&gt;() as u32,
1394 &amp;mut size,
1395 )
1396 } == FALSE
1397 {
1398 return Err(io::Error::last_os_error());
1399 }
1400
1401 // SAFETY: the call succeeded, so module is initialized.
1402 let module = unsafe { module.assume_init() };
1403 todo!()
1404}
1405</code></pre>
1406<p><code>EnumProcessModules</code> takes a pointer to an array of <code>HMODULE</code>. We could use a <code>Vec</code> of capacity one to hold the single module, but in memory, a pointer a single item can be seen as a pointer to an array of items. <code>MaybeUninit</code> helps us reserve enough memory for the one item we need.</p>
1407<p>With the module handle, we can retrieve its base name:</p>
1408<pre><code class="language-rust" data-lang="rust">let mut buffer = Vec::&lt;u8&gt;::with_capacity(64);
1409// SAFETY: the handle, module and buffer are all valid.
1410let length = unsafe {
1411 winapi::um::psapi::GetModuleBaseNameA(
1412 self.handle.as_ptr(),
1413 module,
1414 buffer.as_mut_ptr().cast(),
1415 buffer.capacity() as u32,
1416 )
1417};
1418if length == 0 {
1419 return Err(io::Error::last_os_error());
1420}
1421
1422// SAFETY: the call succeeded and length represents bytes.
1423unsafe { buffer.set_len(length as usize) };
1424Ok(String::from_utf8(buffer).unwrap())
1425</code></pre>
1426<p>Similar to how we did with <code>EnumProcesses</code>, we create a buffer that will hold the ASCII string of the module's base name<sup class="footnote-reference"><a href="#5">5</a></sup>. The call wants us to pass a pointer to a mutable buffer of <code>i8</code>, but Rust's <code>String::from_utf8</code> wants a <code>Vec&lt;u8&gt;</code>, so instead we declare a buffer of <code>u8</code> and <code>.cast()</code> the pointer in the call. You could also do this with <code>as _</code>, and Rust would infer the right type, but <code>cast</code> is neat.</p>
1427<p>We <code>unwrap</code> the creation of the UTF-8 string because the buffer should contain only ASCII characters (which are also valid UTF-8). We could use the <code>unsafe</code> variant to create the string, but what if somehow it contains non-ASCII characters? The less <code>unsafe</code>, the better.</p>
1428<p>Let's see it in action:</p>
1429<pre><code class="language-rust" data-lang="rust">fn main() {
1430 enum_proc()
1431 .unwrap()
1432 .into_iter()
1433 .for_each(|pid| match Process::open(pid) {
1434 Ok(proc) =&gt; match proc.name() {
1435 Ok(name) =&gt; println!(&quot;{}: {}&quot;, pid, name),
1436 Err(e) =&gt; println!(&quot;{}: (failed to get name: {})&quot;, pid, e),
1437 },
1438 Err(e) =&gt; eprintln!(&quot;failed to open {}: {}&quot;, pid, e),
1439 });
1440}
1441</code></pre>
1442<pre><code>&gt;cargo run
1443 Compiling memo v0.1.0
1444 Finished dev [unoptimized + debuginfo] target(s) in 0.32s
1445 Running `target\debug\memo.exe`
1446failed to open 0: The parameter is incorrect. (os error 87)
1447failed to open 4: Access is denied. (os error 5)
1448...
1449failed to open 5940: Access is denied. (os error 5)
14505608: (failed to get name: Access is denied. (os error 5))
1451...
14521704: (failed to get name: Access is denied. (os error 5))
1453failed to open 868: Access is denied. (os error 5)
1454...
1455</code></pre>
1456<p>That's not good. What's up with that? Maybe…</p>
1457<blockquote>
1458<p>The handle must have the <code>PROCESS_QUERY_INFORMATION</code> and <code>PROCESS_VM_READ</code> access rights.</p>
1459</blockquote>
1460<p>…I should've read the documentation. Okay, fine:</p>
1461<pre><code class="language-rust" data-lang="rust">use winapi::um::winnt;
1462OpenProcess(winnt::PROCESS_QUERY_INFORMATION | winnt::PROCESS_VM_READ, ...)
1463</code></pre>
1464<pre><code>&gt;cargo run
1465 Compiling memo v0.1.0 (C:\Users\L\Desktop\memo)
1466 Finished dev [unoptimized + debuginfo] target(s) in 0.35s
1467 Running `target\debug\memo.exe`
1468failed to open 0: The parameter is incorrect. (os error 87)
1469failed to open 4: Access is denied. (os error 5)
1470...
14719348: cheatengine-x86_64.exe
14723288: Tutorial-x86_64.exe
14738396: cmd.exe
14744620: firefox.exe
14757964: cargo.exe
147610052: cargo.exe
14775756: memo.exe
1478</code></pre>
1479<p>Hooray 🎉! There's some processes we can't open, but that's because they're system processes. Security works!</p>
1480<h2 id="finale">Finale</h2>
1481<p>That was a fairly long post when all we did was print a bunch of pids and their corresponding name. But in all fairness, we also laid out a good foundation for what's coming next.</p>
1482<p>You can <a href="https://github.com/lonami/memo">obtain the code for this post</a> over at my GitHub. At the end of every post, the last commit will be tagged, so you can <code>git checkout step1</code> to see the final code for any blog post.</p>
1483<p>In the <a href="/blog/woce-2">next post</a>, we'll tackle the second step of the tutorial: Exact Value scanning.</p>
1484<h3 id="footnotes">Footnotes</h3>
1485<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
1486<p>You could say I simply love reinventing the wheel, which I do, but in this case, the codebase contains <em>far</em> more features than we're interested in. The (apparent) lack of structure and documentation regarding the code, along with the unfortunate <a href="https://github.com/cheat-engine/cheat-engine/issues/60">lack of license</a> for the source code, make it a no-go. There's a license, but I think that's for the distributed program itself.</p>
1487</div>
1488<div class="footnote-definition" id="2"><sup class="footnote-definition-label">2</sup>
1489<p>If it turns out that there are more than 1024 processes, our code will be unaware of those extra processes. The documentation suggests to perform the call again with a larger buffer if <code>count == provided capacity</code>, but given I have under 200 processes on my system, it seems unlikely we'll reach this limit. If you're worried about hitting this limit, simply use a larger limit or retry with a larger vector.</p>
1490</div>
1491<div class="footnote-definition" id="3"><sup class="footnote-definition-label">3</sup>
1492<p>C code would likely use <a href="https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-globalalloc"><code>GlobalAlloc</code></a> here, but Rust's <code>Vec</code> handles the allocation for us, making the code both simpler and more idiomatic. In general, if you see calls to <code>GlobalAlloc</code> when porting some code to Rust, you can probably replace it with a <code>Vec</code>.</p>
1493</div>
1494<div class="footnote-definition" id="4"><sup class="footnote-definition-label">4</sup>
1495<p>This will be a recurring theme.</p>
1496</div>
1497<div class="footnote-definition" id="5"><sup class="footnote-definition-label">5</sup>
1498<p>…and similar to <code>EnumProcesses</code>, if the name doesn't fit in our buffer, the result will be truncated.</p>
1499</div>
1500</content>
1501 </entry>
1502 <entry xml:lang="en">
1503 <title>Data Mining, Warehousing and Information Retrieval</title>
1504 <published>2020-07-03T00:00:00+00:00</published>
1505 <updated>2020-07-03T00:00:00+00:00</updated>
1506 <link href="https://lonami.dev/blog/university/" type="text/html"/>
1507 <id>https://lonami.dev/blog/university/</id>
1508 <content type="html"><p>During university, there were a few subjects where I had to write blog posts for (either as evaluable tasks or just for fun). I thought it was really fun and I wanted to preserve that work here, with the hopes it's interesting to someone.</p>
1509<p>The posts series were auto-generated from the original HTML files and manually anonymized later.</p>
1510<ul>
1511<li><a href="/blog/mdad">Data Mining and Data Warehousing</a></li>
1512<li><a href="/blog/ribw">Information Retrieval and Web Search</a></li>
1513</ul>
1514</content>
1515 </entry>
1516 <entry xml:lang="en">
1517 <title>My new computer</title>
1518 <published>2020-06-19T00:00:00+00:00</published>
1519 <updated>2020-07-03T00:00:00+00:00</updated>
1520 <link href="https://lonami.dev/blog/new-computer/" type="text/html"/>
1521 <id>https://lonami.dev/blog/new-computer/</id>
1522 <content type="html"><p>This post will be mostly me ranting about setting up a new laptop, but I also just want to share my upgrade. If you're considering installing Arch Linux with dual-boot for Windows, maybe this post will help. Or perhaps you will learn something new to troubleshoot systems in the future. Let's begin!</p>
1523<p>Last Sunday, I ordered a Asus Rog Strix G531GT-BQ165 for 900€ (on a 20% discount) with the following specifications:</p>
1524<ul>
1525<li>Intel® Core i7-9750H (6 cores, 12MB cache, 2.6GHz up to 4.5GHz, 64-bit)</li>
1526<li>16GB RAM (8GB*2) DDR4 2666MHz</li>
1527<li>512GB SSD M.2 PCIe® NVMe</li>
1528<li>Display 15.6&quot; (1920x1080/16:9) 60Hz</li>
1529<li>Graphics NVIDIA® GeForce® GTX1650 4GB GDDR5 VRAM</li>
1530<li>LAN 10/100/1000</li>
1531<li>Wi-Fi 5 (802.11ac) 2x2 RangeBoost</li>
1532<li>Bluetooth 5.0</li>
1533<li>48Wh battery with 3 cells</li>
1534<li>3 x USB 3.1 (GEN1)</li>
1535</ul>
1536<p>I was mostly interested in a general upgrade (better processor, disk, more RAM), although the graphics card is a really nice addition which will allow me to take some time off on more games. After using it for a bit, I really love the feel of the keyboard, and I love the lack of numpad! (No sarcasm, I really don't like numpads.)</p>
1537<p>This is an upgrade from my previous laptop (Asus X554LA-XX822T), which I won in a competition before entering university in a programming challenge. It has served me really well for the past five years, and had the following specifications:</p>
1538<ul>
1539<li>Intel® Core™ i5-5200U</li>
1540<li>4GB RAM DDR3L 1600MHz (which I upgraded to have 8GB)</li>
1541<li>1TB HDD</li>
1542<li>Display 15.6&quot; (1366x768/16:9)</li>
1543<li>Intel® HD Graphics 4400</li>
1544<li>LAN 10/100/1000</li>
1545<li>Wifi 802.11 bgn</li>
1546<li>Bluetooth 4.0</li>
1547<li>Battery 2 cells</li>
1548<li>1 x USB 2.0</li>
1549<li>2 x USB 3.0</li>
1550</ul>
1551<p>Prior to this one, I had a Lenovo (also won in the same competition of the previous year), and prior to that (just for the sake of history), it was HP Pavilion, AMD A4-3300M processor, which unfortunately ended with heating problems. But that's very old now.</p>
1552<h2 id="laptop-arrival">Laptop arrival</h2>
1553<p>The laptop arrived 2 days ago at roughly 19:00, which I put charged for 3 hours as the book said. The day after, nightmares began!</p>
1554<p>Trying to boot it the first two times was fun, as it comes with a somewhat loud sound on boot. I don't know why they would do this, and I immediately turned it off in the BIOS.</p>
1555<h2 id="installation-journey">Installation journey</h2>
1556<p>I spent all of yesterday trying to setup Windows and Arch Linux (and didn't even finish, it took me this morning too and even now it's only half functional). I absolutely <em>hate</em> the amount of partitions the Windows installer creates on a clean disk. So instead, I first went with Arch Linux, and followed the <a href="https://wiki.archlinux.org/index.php/Installation_guide">installation guide on the Arch wiki</a>. Pre-installation, setting up the wireless network, creating the partitions and formatting them went all good. I decided to avoid GRUB at first and go with rEFInd, but alas I missed a big warning on the wiki and after reboot (I would later find out) it was not mounting root properly, so all I had was whatever was in the Initramfs. Reboot didn't work, so I had to hold the power button.</p>
1557<p>Anyway, once the partitions were created, I went to install Windows (there was a lot of back and forth burning different <code>.iso</code> images on the USB, which was a bit annoying because it wasn't the fastest thing in the world). This was pretty painless, and the process was standard: select advanced to let me choose the right partition, pick the one, say &quot;no&quot; to everything in the services setup, and done. But this was the first Windows <code>.iso</code> I tried. It was an old revision, and the drivers were causing issues when running (something weird about their <code>.dll</code>, manually installing the <code>.ini</code> driver files seemed to work?). The Nvidia drivers didn't want to be installed on such an old revision, after updating everything I could via Windows updates. So back I went to burning a newer Windows <code>.iso</code> and going through the same process again…</p>
1558<p>Once Windows was ready and I verified that I could boot to it correctly, it was time to have a second go at Arch Linux. And I went through the setup at least three times, getting it wrong every single time, formatting root every single time, redownloading the packages every single pain. If only had I known earlier what the issue was!</p>
1559<p>Why bother with Arch? I was pretty happy with Linux Mint, and I lowkey wanted to try NixOS, but I had used Arch before and it's a really nice distro overall (up-to-date, has AUR, quite minimal, imperative), except for trying to install rEFInd while chrooted…</p>
1560<p>In the end I managed to get something half-working, I still need to properly configure WiFi and pulseaudio in my system but hey it works.</p>
1561<p>I like to be able to dual-boot Windows and Linux because Linux is amazing for productivity, but unfortunately, some games only work fine on Windows. Might as well have both systems and use one for gaming, while the other is my daily driver.</p>
1562<h2 id="setting-up-arch-linux">Setting up Arch Linux</h2>
1563<p>This is the process I followed to install Arch Linux in the end, along with a brief explanation on what I think the things are doing and why we are doing them. I think the wiki could do a better job at this, but I also know it's hard to get it right for everyone. Something I do dislike is the link colour, after opening a link it becomes gray and it's a lot easier to miss the fact that it is a link in the first place, which was tough when re-reading it because some links actually matter a lot. Furthermore, important information may just be a single line, also easy to skim over. Anyway, on to the installation process…</p>
1564<p>The first thing we want to do is configure our keyboard layout or else the keys won't correspond to what we expect:</p>
1565<pre><code class="language-sh" data-lang="sh">loadkeys es
1566</code></pre>
1567<p>Because we're on a recent system, we want to verify that UEFI works correctly. If we see files listed, then it works fine:</p>
1568<pre><code class="language-sh" data-lang="sh">ls /sys/firmware/efi/efivars
1569</code></pre>
1570<p>The next thing we want to do is configure the WiFi, because I don't have any ethernet cable nearby. To do this, we check what network interfaces our laptop has (we're looking for the one prefixed with &quot;w&quot;, presumably for wireless, such as &quot;wlan0&quot; or &quot;wlo1&quot;), we set it up, scan for available wireless network, and finally connect. In my case, the network has WPA security so we rely on <code>wpa_supplicant</code> to connect, passing the SSID (network name) and password:</p>
1571<pre><code class="language-sh" data-lang="sh">ip link
1572ip link set &lt;IFACE&gt; up
1573iw dev &lt;IFACE&gt; scan | less
1574wpa_supplicant -B -i &lt;IFACE&gt; -c &lt;(wpa_passphrase &lt;SSID&gt; &lt;PASS&gt;)
1575</code></pre>
1576<p>After that's done, pinging an IP address like &quot;1.1.1.1&quot; should Just Work™, but to be able to resolve hostnames, we need to also setup a nameserver. I'm using Cloudflare's, but you could use any other:</p>
1577<pre><code class="language-sh" data-lang="sh">echo nameserver 1.1.1.1 &gt; /etc/resolv.conf
1578ping archlinux.org
1579^C
1580</code></pre>
1581<p>If the ping works, then network works! If you still have issues, you may need to <a href="https://wiki.archlinux.org/index.php/Network_configuration#Static_IP_address">manually configure a static IP address</a> and add a route with the address of your, well, router. This basically shows if we have any address, adds a static address (so people know who we are), shows what route we have, and adds a default one (so our packets know where to go):</p>
1582<pre><code class="language-sh" data-lang="sh">ip address show
1583ip address add &lt;YOUR ADDR&gt;/24 broadcast + dev &lt;IFACE&gt;
1584ip route show
1585ip route add default via &lt;ROUTER ADDR&gt; dev &lt;IFACE&gt;
1586</code></pre>
1587<p>Now that we have network available, we can enable NTP to synchronize our system time (this may be required for network operations where certificates have a validity period, not sure; in any case nobody wants a wrong system time):</p>
1588<pre><code class="language-sh" data-lang="sh">timedatectl set-ntp true
1589</code></pre>
1590<p>After that, we can manage our disk and partitions using <code>fdisk</code>. We want to define partitions to tell the system where it should live. To determine the disk name, we first list them, and then edit it. <code>fdisk</code> is really nice and reminds you at every step that help can be accessed with &quot;m&quot;, which you should constantly use to guide you through.</p>
1591<pre><code class="language-sh" data-lang="sh">fdisk -l
1592fdisk /dev/&lt;DISK&gt;
1593</code></pre>
1594<p>The partitions I made are the following:</p>
1595<ul>
1596<li>A 100MB one for the EFI system.</li>
1597<li>A 32GB one for Linux' root <code>/</code> partition.</li>
1598<li>A 200GB one for Linux' home <code>/home</code> partition.</li>
1599<li>The rest was unallocated for Windows because I did this first.</li>
1600</ul>
1601<p>I like to have <code>/home</code> and <code>/</code> separate because I can reinstall root without losing anything from home (projects, music, photos, screenshots, videos…).</p>
1602<p>After the partitions are made, we format them in FAT32 and EXT4 which are good defaults for EFI, root and home. They need to have a format, or else they won't be usable:</p>
1603<pre><code class="language-sh" data-lang="sh">mkfs.fat -F32 /dev/&lt;DISK&gt;&lt;PART1&gt;
1604mkfs.ext4 /dev/&lt;DISK&gt;&lt;PART2&gt;
1605mkfs.ext4 /dev/&lt;DISK&gt;&lt;PART3&gt;
1606</code></pre>
1607<p>Because the laptop was new, there was no risk to lose anything, but if you're doing a install on a previous system, be very careful with the partition names. Make sure they match with the ones in <code>fdisk -l</code>.</p>
1608<p>Now that we have usable partitions, we need to mount them or they won't be accessible. We can do this with <code>mount</code>:</p>
1609<pre><code class="language-sh" data-lang="sh">mount /dev/&lt;DISK&gt;&lt;PART2&gt; /mnt
1610mkdir /mnt/efi
1611mount /dev/&lt;DISK&gt;&lt;PART1&gt; /mnt/efi
1612mkdir /mnt/home
1613mount /dev/&lt;DISK&gt;&lt;PART3&gt; /mnt/home
1614</code></pre>
1615<p>Remember to use the correct partitions while mounting. We mount everything so that the system knows which partitions we care about, which we will let know about later on.</p>
1616<p>Next step is to setup the basic Arch Linux system on root, which can be done with <code>pacstrap</code>. What follows the directory is a list of packages, and you may choose any you wish (at least add <code>base</code>, <code>linux</code> and <code>linux-firmware</code>). These can be installed later, but I'd recommend having them from the beginning, just in case:</p>
1617<pre><code class="language-sh" data-lang="sh">pacstrap /mnt base linux linux-firmware sudo vim-minimal dhcpcd wpa_supplicant man-db man-pages intel-ucode grub efibootmgr os-prober ntfs-3g
1618</code></pre>
1619<p>Because my system has an intel CPU, I also installed <code>intel-ucode</code>.</p>
1620<p>Next up is generating the <code>fstab</code> file, which we tell to use UUIDs to be on the safe side through <code>-U</code>. This file is important, because without it the system won't know what partitions exist and will happily only boot with the initramfs, without anything of what we just installed at root. Not knowing this made me restart the entire installation process a few times.</p>
1621<pre><code class="language-sh" data-lang="sh">genfstab -U /mnt &gt;&gt; /mnt/etc/fstab
1622</code></pre>
1623<p>After that's done, we can change our root into our mount point and finish up configuration. We setup our timezone (so DST can be handled correctly if needed), synchronize the hardware clock (to persist the current time to the BIOS), uncomment our locales (exit <code>vim</code> by pressing ESC, then type <code>:wq</code> and press enter), generate locale files (which some applications need), configure language and keymap, update the hostname of our laptop and what indicate what <code>localhost</code> means…</p>
1624<pre><code class="language-sh" data-lang="sh">ln -sf /usr/share/zoneinfo/&lt;REGION&gt;/&lt;CITY&gt; /etc/localtime
1625hwclock --systohc
1626vim /etc/locale.gen
1627locale-gen
1628echo LANG=es_ES.UTF-8 &gt; /etc/locale.conf
1629echo KEYMAP=es &gt; /etc/vconsole.conf
1630echo &lt;HOST&gt; /etc/hostname
1631cat &lt;&lt;EOF &gt; /etc/hosts
1632127.0.0.1 localhost
1633::1 localhost
1634127.0.1.1 &lt;HOST&gt;.localdomain &lt;HOST&gt;
1635EOF
1636</code></pre>
1637<p>Really, we could've done all of this later, and the same goes for setting root's password with <code>passwd</code> or creating users (some of the groups you probably want are <code>power</code> and <code>wheel</code>).</p>
1638<p>The important part here is installing GRUB (which also needed the <code>efibootmgr</code> package):</p>
1639<pre><code class="language-sh" data-lang="sh">grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB
1640</code></pre>
1641<p>If we want GRUB to find our Windows install, we also need the <code>os-prober</code> and <code>ntfs-3g</code> packages that we installed earlier with <code>pacstrap</code>, and with those we need to mount the Windows partition somewhere. It doesn't matter where. With that done, we can generate the GRUB configuration file which lists all the boot options:</p>
1642<pre><code class="language-sh" data-lang="sh">mkdir /windows
1643mount /dev/&lt;DISK&gt;&lt;PART5&gt; /windows
1644grub-mkconfig -o /boot/grub/grub.cfg
1645</code></pre>
1646<p>(In my case, I installed Windows before completing the Arch install, which created an additional partition in between).</p>
1647<p>With GRUB ready, we can exit the chroot and reboot the system, and if all went well, you should be greeted with a choice of operating system to use:</p>
1648<pre><code class="language-sh" data-lang="sh">exit
1649reboot
1650</code></pre>
1651<p>If for some reason you need to find what mountpoints were active prior to rebooting (to <code>unmount</code> them for example), you can use <code>findmnt</code>.</p>
1652<p>Before GRUB I tried rEFInd, which as I explained had issues with for missing a warning. Then I tried systemd-boot, which did not pick up Arch at first. That's where the several reinstalls come from, I didn't want to work with a half-worked system so I mostly redid the entire process quite a few times.</p>
1653<h2 id="migrating-to-the-new-laptop">Migrating to the new laptop</h2>
1654<p>I had a external disk formatted with NTFS. Of course, after moving every file I cared about from my previous Linux install caused all the permissions to reset. All my <code>.git</code> repositories, dirty with file permission changes! This is going to take a while to fix, or maybe I should just <code>git config core.fileMode false</code>. Here is a <a href="https://stackoverflow.com/a/2083563">lovely command</a> to sort them out on a per-repository basis:</p>
1655<pre><code class="language-sh" data-lang="sh">git diff --summary | grep --color 'mode change 100644 =&gt; 100755' | cut -d' ' -f7- | xargs -d'\n' chmod -x
1656</code></pre>
1657<p>I never realized how much I had stored over the years, but it really was a lot. While moving things to the external disk, I tried to do some cleanup, such as removing some build artifacts which needlessly occupy space, or completely skipping all the binary application files. If I need those I will install them anyway. The process was mostly focused on finding all the projects and program data that I did care about, or even some game saves. Nothing too difficult, but definitely time consuming.</p>
1658<h2 id="tuning-arch">Tuning Arch</h2>
1659<p>Now that our system is ready, install <code>pacman-contrib</code> to grab a copy of the <code>rankmirrors</code> speed. It should help speed up the download of whatever packages you want to install, since it will help us <a href="https://wiki.archlinux.org/index.php/Mirrors#List_by_speed">rank the mirrors by download speed</a>. Making a copy of the file is important, otherwise whenever you try to install something it will fail saying it can't find anything.</p>
1660<pre><code class="language-sh" data-lang="sh">cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.backup
1661sed -i 's/^#Server/Server/' /etc/pacman.d/mirrorlist.backup
1662rankmirrors -n 6 /etc/pacman.d/mirrorlist.backup | tee /etc/pacman.d/mirrorlist
1663</code></pre>
1664<p>This will take a while, but it should be well worth it. We're using <code>tee</code> to see the progress as it goes.</p>
1665<p>Some other packages I installed after I had a working system in no particular order:</p>
1666<ul>
1667<li><code>xfce4</code> and <code>xorg-server</code>. I just love the simplicity of XFCE.</li>
1668<li><code>xfce4-whiskermenu-plugin</code>, a really nice start menu.</li>
1669<li><code>xfce4-pulseaudio-plugin</code> and <code>pavucontrol</code>, to quickly adjust the audio with my mouse.</li>
1670<li><code>xfce4-taskmanager</code>, a GUI alternative I generally prefer to <code>htop</code>.</li>
1671<li><code>pulseaudio</code> and <code>pulseaudio-alsa</code> to get nice integration with XFCE4 and audio mixing.</li>
1672<li><code>firefox</code>, which comes with fonts too. A really good web browser.</li>
1673<li><code>git</code>, to commit <del>crimes</del> code.</li>
1674<li><code>code</code>, a wonderful editor which I used to write this blog entry.</li>
1675<li><code>nano</code>, so much nicer to write a simple commit message.</li>
1676<li><code>python</code> and <code>python-pip</code>, my favourite language to toy around ideas or use as a calculator.</li>
1677<li><code>telegram-desktop</code>, for my needs on sharing memes.</li>
1678<li><code>cmus</code> and <code>mpv</code>, a simple terminal music player and media player.</li>
1679<li><code>openssh</code>, to connect into any VPS I have access to.</li>
1680<li><code>base-devel</code>, necessary to build most projects I'll find myself working with (or even compiling some projects Rust which I installed via <code>rustup</code>).</li>
1681<li><code>flac</code>, <code>libmad</code>, <code>opus</code>, and <code>libvorbis</code>, to be able to play more audio files.</li>
1682<li><code>inkscape</code>, to make random drawings.</li>
1683<li><code>ffmpeg</code>, to convert media or record screen.</li>
1684<li><code>xclip</code>, to automatically copy screenshots to my clipboard.</li>
1685<li><code>gvfs</code>, needed by Thunar to handle mounting and having a trash (perma-deletion by default can be nasty sometimes).</li>
1686<li><code>noto-fonts</code>, <code>noto-fonts-cjk</code>, <code>noto-fonts-extra</code> and <code>noto-fonts-emoji</code>, if you don't want missing gliphs everywhere.</li>
1687<li><code>xfce4-notifyd</code> and <code>libnotify</code>, for notifications.</li>
1688<li><code>cronie</code>, to be able to <code>crontab -e</code>. Make sure to <code>system enable cronie</code>.</li>
1689<li><code>xarchiver</code> (with <code>p7zip</code>, <code>zip</code>, <code>unzip</code> and <code>unrar</code>) to uncompress stuff.</li>
1690<li><code>xreader</code> to read <code>.pdf</code> files.</li>
1691<li><code>sqlitebrowser</code> is always nice to tinker around with SQLite databases.</li>
1692<li><code>jre8-openjdk</code> if you want to run Java applications.</li>
1693<li><code>smartmontools</code> is nice with a SSD to view your disk statistics.</li>
1694</ul>
1695<p>After that, I configured my Super L key to launch <code>xfce4-popup-whiskermenu</code> so that it opens the application menu, pretty much the same as it would on Windows, moved the panels around and configured them to my needs, and it feels like home once more.</p>
1696<p>I made some mistakes while <a href="https://wiki.archlinux.org/index.php/Systemd-networkd">configuring systemd-networkd</a> and accidentally added a service that was incorrect, which caused boot to wait for it to timeout before completing. My boot time was taking 90 seconds longer because of this! <a href="https://www.reddit.com/r/archlinux/comments/4nv9yi/my_arch_greets_me_now_with_a_start_job/">The solution was to remove said service</a>, so this is something to look out for.</p>
1697<p>In order to find what was taking long, I had to edit the <a href="https://wiki.archlinux.org/index.php/kernel_parameters">kernel parameters</a> to remove the <code>quiet</code> option. I prefer seeing the output on what my computer is doing anyway, because it gives me a sense of progress and most importantly is of great value when things go wrong. Another interesting option is <code>noauto,x-systemd.automount</code>, which makes a disk lazily-mounted. If you have a slow disk, this could help speed things up.</p>
1698<p>If you see a service taking long, you can also use <code>systemd-analyze blame</code> to see what takes the longest, and <code>systemctl list-dependencies</code> is also helpful to find what services are active.</p>
1699<p>My <code>locale charmap</code> was spitting out a bunch of warnings:</p>
1700<pre><code class="language-sh" data-lang="sh">$ locale charmap
1701locale: Cannot set LC_CTYPE to default locale: No such file or directory
1702locale: Cannot set LC_MESSAGES to default locale: No such file or directory
1703locale: Cannot set LC_ALL to default locale: No such file or directory
1704ANSI_X3.4-1968
1705</code></pre>
1706<p>…ANSI encoding? Immediately I added the following to <code>~/.bashrc</code> and <code>~/.profile</code>:</p>
1707<pre><code class="language-sh" data-lang="sh">export LC_ALL=en_US.UTF-8
1708export LANG=en_US.UTF-8
1709export LANGUAGE=en_US.UTF-8
1710</code></pre>
1711<p>For some reason, I also had to edit <code>xfce4-terminal</code>'s preferences in advanced to change the default character encoding to UTF-8. This also solved my issues with pasting things into the terminal, and also proper rendering! I guess pastes were not working because it had some characters that could not be encoded.</p>
1712<p>To have working notifications, I added the following to <code>~/.bash_profile</code> after <code>exec startx</code>:</p>
1713<pre><code class="language-sh" data-lang="sh">systemctl --user start xfce4-notifyd.service
1714</code></pre>
1715<p>I'm pretty sure there's a better way to do this, or maybe it's not even necessary, but this works for me.</p>
1716<p>Some of the other things I had left to do was setting up <code>sccache</code> to speed up Rust builds:</p>
1717<pre><code class="language-sh" data-lang="sh">cargo install sccache
1718echo export RUSTC_WRAPPER=sccache &gt;&gt; ~/.bashrc
1719</code></pre>
1720<p>Once I had <code>cargo</code> ready, installed <code>hacksaw</code> and <code>shotgun</code> with it to perform screenshots.</p>
1721<p>I also disabled the security delay when downloading files in Firefox because it's just annoying, in <code>about:config</code> setting <code>security.dialog_enable_delay</code> to <code>0</code>, and added the <a href="https://alisdair.mcdiarmid.org/kill-sticky-headers/">Kill sticky headers</a> to my bookmarks (you may prefer <a href="https://github.com/t-mart/kill-sticky">the updated version</a>).</p>
1722<p>The <code>utils-linux</code> comes with a <code>fstrim</code> utility to <a href="https://wiki.archlinux.org/index.php/Solid_state_drive#Periodic_TRIM">trim the SSD weekly</a>, which I want enabled via <code>systemctl enable fstrim.timer</code> (you may also want to <code>start</code> it if you don't reboot often). For more SSD tips, check <a href="https://easylinuxtipsproject.blogspot.com/p/ssd.html">How to optimize your Solid State Drive</a>.</p>
1723<p>If the sound is funky prior to reboot, try <code>pulseaudio --kill</code> and <code>pulseaudio --start</code>, or delete <code>~/.config/pulse</code>.</p>
1724<p>I haven't been able to get the brightness keys to work yet, but it's not a big deal, because scrolling on the power manager plugin of Xfce does work (and also <code>xbacklight</code> works, or writing directly to <code>/sys/class/backlight/*</code>).</p>
1725<h2 id="tuning-windows">Tuning Windows</h2>
1726<p>On the Windows side, I disabled the annoying Windows defender by running (<kbd>Ctrl+R</kbd>) <code>gpedit.msc</code> and editing:</p>
1727<ul>
1728<li><em>Computer Configuration &gt; Administrative Templates &gt; Windows Components &gt; Windows Defender » Turn off Windows Defender » Enable</em></li>
1729<li><em>User Configuration &gt; Administrative Templates &gt; Start Menu and Taskbar » Remove Notifications and Action Center » Enable</em></li>
1730</ul>
1731<p>I also updated the <a href="https://github.com/WindowsLies/BlockWindows/raw/master/hosts"><code>hosts</code> file</a> (located at <code>%windir%\system32\Drivers\etc\hosts</code>) with the hope that it will stop some of the telemetry.</p>
1732<p>Last, to have consistent time on Windows and Linux, I changed the following registry key for a <code>qword</code> with value <code>1</code>:</p>
1733<pre><code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation\RealTimeIsUniversal
1734</code></pre>
1735<p>(The key might not exist, but you can create it if that's the case).</p>
1736<p>All this time, my laptop had the keyboard lights on, which have been quite annoying. Apparently, they also can cause <a href="https://www.reddit.com/r/ValveIndex/comments/cm6pos/psa_uninstalldisable_aura_sync_lighting_if_you/">massive FPS drops</a>. I headed over to <a href="https://rog.asus.com/downloads/">Asus Rog downloads</a>, selected Aura Sync…</p>
1737<pre><code class="language-md" data-lang="md"># Not Found
1738
1739The requested URL /campaign/aura/us/Sync.html was not found on this server.
1740
1741Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
1742</code></pre>
1743<p>…great! I'll just find the <a href="https://www.asus.com/campaign/aura/global/">Aura site</a> somewhere else…</p>
1744<pre><code class="language-md" data-lang="md"># ASUS
1745
1746# We'll be back.
1747
1748Hi, our website is temporarily closed for service enhancements.
1749
1750We'll be back shortly.Thank you for your patience!
1751</code></pre>
1752<p>Oh come on. After waiting for the next day, I headed over, downloaded their software, tried to install it and it was an awful experience. It felt like I was purposedly installing malware. It spammed and flashed a lot of <code>cmd</code>'s on screen as if it was a virus. It was stuck at 100% doing that and then, Windows blue-screened with <code>KERNEL_MODE_HEAP_CORRUPTION</code>. Amazing. How do you screw up this bad?</p>
1753<p>Well, at least rebooting worked. I tried to <a href="https://answers.microsoft.com/en-us/windows/forum/all/unable-to-uninstall-asus-aura-sync-utility/e9bec36c-e62f-4773-80be-88fb68dace16">uninstall Aura, but of course that failed</a>. Using the <a href="https://support.microsoft.com/en-us/help/17588/windows-fix-problems-that-block-programs-being-installed-or-removed">troubleshooter to uninstall programs</a> helped me remove most of the crap that was installed.</p>
1754<p>After searching around how to disable the lights (because <a href="https://rog.asus.com/forum/showthread.php?112786-Option-to-Disable-Aura-Lights-on-Strix-G-series-(G531GT)-irrespective-of-OSes">my BIOS did not have this setting</a>), I stumbled upon <a href="https://rog.asus.com/us/innovation/armoury_crate/">&quot;Armoury Crate&quot;</a>. Okay, fine, I will install that.</p>
1755<p>The experience wasn't much better. It did the same thing with a lot of consoles flashing on screen. And of course, it resulted in another blue-screen, this time <code>KERNEL_SECURITY_CHECK_FAILURE</code>. To finish up, the BSOD kept happening as I rebooted the system. <del>Time to reinstall Windows once more.</del> After booting and crashing a few more times I could get into secure mode and perform the reinstall from there, which saved me from burning the <code>.iso</code> again.</p>
1756<p>Asus software might be good, but the software is utter crap.</p>
1757<p>After trying out <a href="https://github.com/wroberts/rogauracore">rogauracore</a> (which didn't list my model), it worked! I could disable the stupid lights from Linux, and <a href="https://gitlab.com/CalcProgrammer1/OpenRGB/-/wikis/home">OpenRGB</a> also works on Windows which may be worth checking out too.</p>
1758<p>Because <code>rougauracore</code> helped me and they linked to <a href="https://github.com/linuxhw/hw-probe/blob/master/README.md#appimage">hw-probe</a>, I decided to <a href="https://linux-hardware.org/?probe=0e3e48c501">run it on my system</a>, with the hopes it is useful for other people.</p>
1759<h2 id="closing-words">Closing words</h2>
1760<p>I hope the installation journey is at least useful to someone, or that you enjoyed reading about it all. If not, sorry!</p>
1761</content>
1762 </entry>
1763 <entry xml:lang="en">
1764 <title>Tips for Outpost</title>
1765 <published>2020-05-10T00:00:00+00:00</published>
1766 <updated>2020-05-22T00:00:00+00:00</updated>
1767 <link href="https://lonami.dev/blog/tips-outpost/" type="text/html"/>
1768 <id>https://lonami.dev/blog/tips-outpost/</id>
1769 <content type="html"><p><a href="https://store.steampowered.com/app/1127110/Outpost/">Outpost</a> is a fun little game by Open Mid Interactive that has popped in recently in my recommended section of Steam, and I decided to give it a try.</p>
1770<p>It's a fun tower-defense game with progression, different graphics and random world generation which makes it quite fun for a few hours. In this post I want to talk about some tips I found useful to get past night 50.</p>
1771<h2 id="build-pattern">Build Pattern</h2>
1772<p>At first, you may be inclined to design a checkerboard pattern like the following, where &quot;C&quot; is the Crystal shrine, &quot;S&quot; is a stone launcher and &quot;B&quot; is a booster:</p>
1773<p><img src="https://lonami.dev/blog/tips-outpost/outpost-bad-pattern.svg" alt="Bad Outpost build pattern" /></p>
1774<p>Indeed, this pattern will apply <strong>4</strong> boosts to every turret, but unfortunately, the other 4 slots of the booster are wasted! This is because boosters are able to power 8 different towers, and you really want to maximize that. Here's a better design:</p>
1775<p><img src="https://lonami.dev/blog/tips-outpost/outpost-good-pattern.svg" alt="Good Outpost build pattern" /></p>
1776<p>The shrine's tower does get boosted, but it's still not really worth it to boost it. This pattern works good, and it's really easy to tile: just repeat the same 3x3 pattern.</p>
1777<p>Nonetheless, we can do better. What if we applied multiple boosters to the same tower while still applying all 8 boosts?</p>
1778<p><img src="https://lonami.dev/blog/tips-outpost/outpost-best-pattern.svg" alt="Best Outpost build pattern" /></p>
1779<p>That's what peak performance looks like. You can actually apply multiple boosters to the same tower, and it works great.</p>
1780<p>Now, is it really worth it building anywhere except around the shrine? Not really. You never know where a boss will come from, so all sides need a lot of defense if you want to stand a chance.</p>
1781<p>The addition of traps in 1.6 is amazing. You want to build these outside your strong &quot;core&quot;, mostly to slow the enemies down so your turrets have more time to finish them off. Don't waste boosters on the traps, and build them at a reasonable distance from the center (the sixth tile is a good spot):</p>
1782<p><img src="https://lonami.dev/blog/tips-outpost/outpost-trap-pattern.svg" alt="Trap Outpost build pattern" /></p>
1783<p>If you gather enough materials, you can build more trap and cannon layers outside, roughly at enough distance to slow them for enough duration until they reach the next layer of traps, and so on. Probably a single gap of &quot;cannon, booster, cannon&quot; is enough between trap layers, just not in the center where you need a lot of fire power.</p>
1784<h2 id="talents">Talents</h2>
1785<p>Talents are the way progression works in the game. Generally, after a run, you will have enough experience to upgrade nearly all talents of roughly the same tier. However, some are worth upgrading more than others (which provide basically no value).</p>
1786<p>The best ones to upgrade are:</p>
1787<ul>
1788<li>Starting supplies. Amazing to get good tools early.</li>
1789<li>Shrine shield. Very useful to hold against tough bosses.</li>
1790<li>Better buildings (cannon, boosters, bed and traps). They're a must to deal the most damage.</li>
1791<li>Better pickaxe. Stone is limited, so better make good use of it.</li>
1792<li>Better chests. They provide an insane amount of resources early.</li>
1793<li>Winter slow. Turrets will have more time to deal damage, it's perfect.</li>
1794<li>More time. Useful if you're running out, although generally you enter nights early after having a good core anyway.</li>
1795<li>More rocks. Similar to a better pickaxe, more stone is always better.</li>
1796</ul>
1797<p>Some decent ones:</p>
1798<ul>
1799<li>In-shrine turret. It's okay to get past the first night without building but not much beyond that.</li>
1800<li>Better axe and greaves. Great to save some energy and really nice quality of life to move around.</li>
1801<li>Tree growth. Normally there's enough trees for this not to be an issue but it can save some time gathering wood.</li>
1802<li>Wisps. They're half-decent since they can provide materials once you max out or max out expensive gear.</li>
1803</ul>
1804<p>Some okay ones:</p>
1805<ul>
1806<li>Extra XP while playing. Generally not needed due to the way XP scales per night, but can be a good boost.</li>
1807<li>Runestones. Not as reliable as chests but some can grant more energy per day.</li>
1808</ul>
1809<p>Some crap ones:</p>
1810<ul>
1811<li>Boosts for other seasons. I mean, winter is already the best, no use there.</li>
1812<li>Bow. The bow is very useless at the moment, it's not worth your experience.</li>
1813<li>More energy per bush. Not really worth hunting for bushes since you will have enough energy to do well.</li>
1814</ul>
1815<h2 id="turrets">Turrets</h2>
1816<p>Always build the highest tier, there's no point in anything lower than that. You will need to deal a lot of damage in a small area, which means space is a premium.</p>
1817<h2 id="boosters">Boosters</h2>
1818<p>If you're very early in the game, I recommend alternating both the flag and torch in a checkerboard pattern where the boosters should go in the pattern above. This way your towers will get extra speed and extra range, which works great.</p>
1819<p>When you're in mid-game (stone launchers, gears and campfires), I do not recommend using campfires. The issue is their range boost is way too long, and the turrets will miss quite a few shots. It's better to put all your power into fire speed for increased DPS, at least near the center. If you manage to build too far out and some of the turrets hardly ever shoot, you may put campfires there.</p>
1820<p>In end-game, of course alternate both of the highest tier upgrades. They are really good, and provide the best benefit / cost ratio.</p>
1821<h2 id="gathering-materials">Gathering Materials</h2>
1822<p>It is <strong>very</strong> important to use all your energy every day! Otherwise it will go to waste, and you will need a lot of materials.</p>
1823<p>As of 1.6, you can mine two things at once if they're close enough! I don't know if this is intended or a bug, but it sure is great.</p>
1824<p>Once you're in mid-game, your stone-based fort should stand pretty well against the nights on its own. After playing for a while you will notice, if your base can defend a boss, then it will have no issue carrying you through the nights until the next boss. You can (and should!) spend the nights gathering materials, but only when you're confident that the night won't run out.</p>
1825<p>Before the boss hits (every fifth night), come back to your base and use all of your materials. This is the next fort upgrade that will carry it the five next nights.</p>
1826<p>You may also speed up time during night, but make sure you use all your energy before hand. And also take care, in the current version of the game speeding up time only speeds up monster movement, not the fire rate or projectile speed of your turrets! This means they will miss more shots and can be pretty dangerous. If you're speeding up time, consider speeding it up for a little bit, then go back to normal until things are more calm, and repeat.</p>
1827<p>If you're in the end-game, try to rush for chests. They provide a huge amount of materials which is really helpful to upgrade all your tools early so you can make sure to get the most out of every rock left in the map.</p>
1828<p>In the end-game, after all stone has been collected, you don't really need to use all of your energy anymore. Just enough to have enough wood to build with the remaining stone. This will also be nice with the bow upgrades, which admitedly can get quite powerful, but it's best to have a strong fort first.</p>
1829<h2 id="season">Season</h2>
1830<p>In my opinion, winter is just the best of the seasons. You don't <em>really</em> need that much energy (it gets tiresome), or extra tree drops, or luck. Slower movement means your turrets will be able to shoot enemies for longer, dealing more damage over time, giving them more chance to take enemies out before they reach the shrine.</p>
1831<p>Feel free to re-roll the map a few times (play and exit, or even restart the game) until you get winter if you want to go for The Play.</p>
1832<h2 id="gear">Gear</h2>
1833<p>In my opinion, you really should rush for the best pickaxe you can afford. Stone is a limited resource that doesn't regrow like trees, so once you run out, it's over. Better to make the best use out of it with a good pickaxe!</p>
1834<p>You may also upgrade your greaves, we all known faster movement is a <em>really</em> nice quality of life improvement.</p>
1835<p>Of course, you will eventually upgrade your axe to chop wood (otherwise it's wasted energy, really), but it's not as much of a priority as the pickaxe.</p>
1836<p>Now, the bow is completely useless. Don't bother with it. Your energy is better spent gathering materials to build permanent turrets that deal constant damage while you're away, and the damage adds up with every extra turret you build.</p>
1837<p>With regards to items you carry (like sword, or helmet), look for these (from best to worst):</p>
1838<ul>
1839<li>Less minion life.</li>
1840<li>Chance to not consume energy.</li>
1841<li>+1 turret damage.</li>
1842<li>Extra energy.</li>
1843<li>+1 drop from trees or stones.</li>
1844<li>+1 free wood or stone per day.</li>
1845</ul>
1846<p>Less minion life, nothing to say. You will need it near end-game.</p>
1847<p>The chance to not consume energy is better the more energy you have. With a 25% chance not to consume energy, you can think of it as 1 extra energy for every 4 energy you have on average.</p>
1848<p>Turret damage is a tough one, it's <em>amazing</em> mid-game (it basically doubles your damage) but falls short once you unlock the cannon where you may prefer other items. Definitely recommended if you're getting started. You may even try to roll it on low tiers by dying on the second night, because it's that good.</p>
1849<p>Extra energy is really good, because it means you can get more materials before it gets too rough. Make sure you have built at least two beds in the first night! This extra energy will pay of for the many nights to come.</p>
1850<p>The problem with free wood or stone per day is that you have, often, five times as much energy per day. By this I mean you can get easily 5 stone every day, which means 5 extra stone, whereas the other would provide just 1 per night. On a good run, you will get around 50 free stone or 250 extra stone. It's a clear winner.</p>
1851<p>In end-game, more quality of life are revealing chests so that you can rush them early, if you like to hunt for them try to make better use of the slot.</p>
1852<h2 id="closing-words">Closing words</h2>
1853<p>I hope you enjoy the game as much as I do! Movement is sometimes janky and there's the occassional lag spikes, but despite this it should provide at least a few good hours of gameplay. Beware however a good run can take up to an hour!</p>
1854</content>
1855 </entry>
1856 <entry xml:lang="en">
1857 <title>Python ctypes and Windows</title>
1858 <published>2019-06-19T00:00:00+00:00</published>
1859 <updated>2019-06-19T00:00:00+00:00</updated>
1860 <link href="https://lonami.dev/blog/ctypes-and-windows/" type="text/html"/>
1861 <id>https://lonami.dev/blog/ctypes-and-windows/</id>
1862 <content type="html"><p><a href="https://www.python.org/">Python</a>'s <a href="https://docs.python.org/3/library/ctypes.html"><code>ctypes</code></a> is quite a nice library to easily load and invoke C methods available in already-compiled <a href="https://en.wikipedia.org/wiki/Dynamic-link_library"><code>.dll</code> files</a> without any additional dependencies. And I <em>love</em> depending on as little as possible.</p>
1863<p>In this blog post, we will walk through my endeavors to use <code>ctypes</code> with the <a href="https://docs.microsoft.com/en-us/windows/desktop/api/">Windows API</a>, and do some cool stuff with it.</p>
1864<p>We will assume some knowledge of C/++ and Python, since we will need to read and write a bit of both. Please note that this post is only an introduction to <code>ctypes</code>, and if you need more information you should consult the <a href="https://docs.python.org/3/library/ctypes.html">Python's documentation for <code>ctypes</code></a>.</p>
1865<p>While the post focuses on Windows' API, the code here probably applies to unix-based systems with little modifications.</p>
1866<h2 id="basics">Basics</h2>
1867<p>First of all, let's learn how to load a library. Let's say we want to load <code>User32.dll</code>:</p>
1868<pre><code class="language-python" data-lang="python">import ctypes
1869
1870ctypes.windll.user32
1871</code></pre>
1872<p>Yes, it's that simple. When you access an attribute of <code>windll</code>, said library will load. Since Windows is case-insensitive, we will use lowercase consistently.</p>
1873<p>Calling a function is just as simple. Let's say you want to call <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-setcursorpos"><code>SetCursorPos</code></a>, which is defined as follows:</p>
1874<pre><code class="language-c" data-lang="c">BOOL SetCursorPos(
1875 int X,
1876 int Y
1877);
1878</code></pre>
1879<p>Okay, it returns a <code>bool</code> and takes two inputs, <code>x</code> and <code>y</code>. So we can call it like so:</p>
1880<pre><code class="language-python" data-lang="python">ctypes.windll.user32.SetCursorPos(100, 100)
1881</code></pre>
1882<p>Try it! Your cursor will move!</p>
1883<h2 id="funky-stuff">Funky Stuff</h2>
1884<p>We can go a bit more crazy and make it form a spiral:</p>
1885<pre><code class="language-python" data-lang="python">import math
1886import time
1887
1888for i in range(200):
1889 x = int(500 + math.cos(i / 5) * i)
1890 y = int(500 + math.sin(i / 5) * i)
1891 ctypes.windll.user32.SetCursorPos(x, y)
1892 time.sleep(0.05)
1893</code></pre>
1894<p>Ah, it's always so pleasant to do random stuff when programming. Sure makes it more fun.</p>
1895<h2 id="complex-structures">Complex Structures</h2>
1896<p><code>SetCursorPos</code> was really simple. It took two parameters and they both were integers. Let's go with something harder. Let's go with <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-sendinput"><code>SendInput</code></a>! Emulating input will be a fun exercise:</p>
1897<pre><code class="language-c" data-lang="c">UINT SendInput(
1898 UINT cInputs,
1899 LPINPUT pInputs,
1900 int cbSize
1901);
1902</code></pre>
1903<p>Okay, <code>LPINPUT</code>, what are you? Microsoft likes to prefix types with what they are. In this case, <code>LP</code> stands for &quot;Long Pointer&quot; (I guess?), so <code>LPINPUT</code> is just a Long Pointer to <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-taginput"><code>INPUT</code></a>:</p>
1904<pre><code class="language-c" data-lang="c">typedef struct tagINPUT {
1905 DWORD type;
1906 union {
1907 MOUSEINPUT mi;
1908 KEYBDINPUT ki;
1909 HARDWAREINPUT hi;
1910 } DUMMYUNIONNAME;
1911} INPUT, *PINPUT, *LPINPUT;
1912</code></pre>
1913<p>Alright, that's new. We have a <code>struct</code> and <code>union</code>, two different concepts. We can define both with <code>ctypes</code>:</p>
1914<pre><code class="language-python" data-lang="python">INPUT_MOUSE = 0
1915INPUT_KEYBOARD = 1
1916INPUT_HARDWARE = 2
1917
1918class INPUT(ctypes.Structure):
1919 _fields_ = [
1920 ('type', ctypes.c_long),
1921 ...
1922 ]
1923</code></pre>
1924<p>Structures are classes that subclass <code>ctypes.Structure</code>, and you define their fields in the <code>_fields_</code> class-level variable, which is a list of tuples <code>(field name, field type)</code>.</p>
1925<p>The C structure had a <code>DWORD type</code>. <code>DWORD</code> is a <code>c_long</code>, and <code>type</code> is a name like any other, which is why we did <code>('type', ctypes.c_long)</code>.</p>
1926<p>But what about the union? It's anonymous, and we can't make anonymous unions (<em>citation needed</em>) with <code>ctypes</code>. We will give it a concrete name and a type.</p>
1927<p>Before defining the union, we need to define its inner structures, <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-tagmouseinput"><code>MOUSEINPUT</code></a>, <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-tagkeybdinput"><code>KEYBDINPUT</code></a> and <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/ns-winuser-taghardwareinput"><code>HARDWAREINPUT</code></a>. We won't be using them all, but since they count towards the final struct size (C will choose the largest structure as the final size), we need them, or Windows' API will get confused and refuse to work (personal experience):</p>
1928<pre><code class="language-python" data-lang="python">class MOUSEINPUT(ctypes.Structure):
1929 _fields_ = [
1930 ('dx', ctypes.c_long),
1931 ('dy', ctypes.c_long),
1932 ('mouseData', ctypes.c_long),
1933 ('dwFlags', ctypes.c_long),
1934 ('time', ctypes.c_long),
1935 ('dwExtraInfo', ctypes.POINTER(ctypes.c_ulong))
1936 ]
1937
1938
1939class KEYBDINPUT(ctypes.Structure):
1940 _fields_ = [
1941 ('wVk', ctypes.c_short),
1942 ('wScan', ctypes.c_short),
1943 ('dwFlags', ctypes.c_long),
1944 ('time', ctypes.c_long),
1945 ('dwExtraInfo', ctypes.POINTER(ctypes.c_ulong))
1946 ]
1947
1948
1949class HARDWAREINPUT(ctypes.Structure):
1950 _fields_ = [
1951 ('uMsg', ctypes.c_long),
1952 ('wParamL', ctypes.c_short),
1953 ('wParamH', ctypes.c_short)
1954 ]
1955
1956
1957class INPUTUNION(ctypes.Union):
1958 _fields_ = [
1959 ('mi', MOUSEINPUT),
1960 ('ki', KEYBDINPUT),
1961 ('hi', HARDWAREINPUT)
1962 ]
1963
1964
1965class INPUT(ctypes.Structure):
1966 _fields_ = [
1967 ('type', ctypes.c_long),
1968 ('value', INPUTUNION)
1969 ]
1970</code></pre>
1971<p>Some things to note:</p>
1972<ul>
1973<li>Pointers are defined as <code>ctypes.POINTER(inner type)</code>.</li>
1974<li>The field names can be anything you want. You can make them more &quot;pythonic&quot; if you want (such as changing <code>dwExtraInfo</code> for just <code>extra_info</code>), but I chose to stick with the original naming.</li>
1975<li>The union is very similar, but it uses <code>ctypes.Union</code> instead of <code>ctypes.Structure</code>.</li>
1976<li>We gave a name to the anonymous union, <code>INPUTUNION</code>, and used it inside <code>INPUT</code> with also a made-up name, <code>('value', INPUTUNION)</code>.</li>
1977</ul>
1978<p>Now that we have all the types we need defined, we can use them:</p>
1979<pre><code class="language-python" data-lang="python">KEYEVENTF_KEYUP = 0x0002
1980
1981def press(vk, down):
1982 inputs = INPUT(type=INPUT_KEYBOARD, value=INPUTUNION(ki=KEYBDINPUT(
1983 wVk=vk,
1984 wScan=0,
1985 dwFlags=0 if down else KEYEVENTF_KEYUP,
1986 time=0,
1987 dwExtraInfo=None
1988 )))
1989 ctypes.windll.user32.SendInput(1, ctypes.byref(inputs), ctypes.sizeof(inputs))
1990
1991
1992for char in 'HELLO':
1993 press(ord(char), down=True)
1994 press(ord(char), down=False)
1995</code></pre>
1996<p>Run it! It will press and release the keys <code>hello</code> to type the word <code>&quot;hello&quot;</code>!</p>
1997<p><code>vk</code> stands for &quot;virtual key&quot;. Letters correspond with their upper-case ASCII value, which is what we did above. You can find all the available keys in the page with all the <a href="https://docs.microsoft.com/en-us/windows/desktop/inputdev/virtual-key-codes">Virtual Key Codes</a>.</p>
1998<h2 id="dynamic-inputs-and-pointers">Dynamic Inputs and Pointers</h2>
1999<p>What happens if a method wants something by reference? That is, a pointer to your thing? For example, <a href="https://docs.microsoft.com/en-us/windows/desktop/api/winuser/nf-winuser-getcursorpos"><code>GetCursorPos</code></a>:</p>
2000<pre><code class="language-c" data-lang="c">typedef struct tagPOINT {
2001 LONG x;
2002 LONG y;
2003} POINT, *PPOINT, *NPPOINT, *LPPOINT;
2004
2005BOOL GetCursorPos(
2006 LPPOINT lpPoint
2007);
2008</code></pre>
2009<p>It wants a Long Pointer to <a href="https://docs.microsoft.com/en-us/windows/desktop/api/windef/ns-windef-point"><code>POINT</code></a>. We can do just that with <code>ctypes.byref</code>:</p>
2010<pre><code class="language-python" data-lang="python">class POINT(ctypes.Structure):
2011 _fields_ = [
2012 ('x', ctypes.c_long),
2013 ('y', ctypes.c_long)
2014 ]
2015
2016
2017def get_mouse():
2018 point = POINT()
2019 ctypes.windll.user32.GetCursorPos(ctypes.byref(point))
2020 # pass our point by ref ^^^^^
2021 # this lets GetCursorPos fill its x and y fields
2022
2023 return point.x, point.y
2024
2025
2026while True:
2027 print(get_mouse())
2028 time.sleep(0.05)
2029</code></pre>
2030<p>Now you can track the mouse position! Make sure to <code>Ctrl+C</code> the program when you're tired of it.</p>
2031<p>What happens if a method wants a dynamically-sized input?</p>
2032<pre><code class="language-python" data-lang="python">buffer = ctypes.create_string_buffer(size)
2033</code></pre>
2034<p>In that case, you can create an in-memory <code>buffer</code> of <code>size</code> with <code>ctypes.create_string_buffer</code>. It will return a character array of that size, which you can pass as a pointer directly (without <code>ctypes.byref</code>).</p>
2035<p>To access the buffer's contents, you can use either <code>.raw</code> or <code>.value</code>:</p>
2036<pre><code class="language-python" data-lang="python">entire_buffer_as_bytes = buffer.raw
2037up_until_null = buffer.value
2038</code></pre>
2039<p>When the method fills in the data, you can <code>cast</code> your buffer back into a pointer of a concrete type:</p>
2040<pre><code class="language-python" data-lang="python">result_ptr = ctypes.cast(buffer, ctypes.POINTER(ctypes.c_long))
2041</code></pre>
2042<p>And you can de-reference pointers with <code>.contents</code>:</p>
2043<pre><code class="language-python" data-lang="python">first_result = result_ptr.contents
2044</code></pre>
2045<h2 id="arrays">Arrays</h2>
2046<p>Arrays are defined as <code>type * size</code>. Your linter may not like that, and if you don't know the size beforehand, consider creating a 0-sized array. For example:</p>
2047<pre><code class="language-python" data-lang="python"># 10 longs
2048ten_longs = (ctypes.c_long * 10)()
2049for i in range(10):
2050 ten_longs[i] = 2 ** i
2051
2052# Unknown size of longs, e.g. inside some Structure
2053longs = (ctypes.c_long * 0)
2054
2055# Now you know how many longs it actually was
2056known_longs = ctypes.cast(
2057 ctypes.byref(longs),
2058 ctypes.POINTER(ctypes.c_long * size)
2059).contents
2060</code></pre>
2061<p>If there's a better way to initialize arrays, please let me know.</p>
2062<h2 id="wintypes">wintypes</h2>
2063<p>Under Windows, the <code>ctypes</code> module has a <code>wintypes</code> submodule. This one contains definitions like <code>HWND</code> which may be useful and can be imported as:</p>
2064<pre><code class="language-python" data-lang="python">from ctypes.wintypes import HWND, LPCWSTR, UINT
2065</code></pre>
2066<h2 id="callbacks">Callbacks</h2>
2067<p>Some functions (I'm looking at you, <a href="https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-enumwindows"><code>EnumWindows</code></a>) ask us to pass a callback. In this case, it wants a <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms633498(v=vs.85)"><code>EnumWindowsProc</code></a>:</p>
2068<pre><code class="language-c" data-lang="c">BOOL EnumWindows(
2069 WNDENUMPROC lpEnumFunc,
2070 LPARAM lParam
2071);
2072
2073BOOL CALLBACK EnumWindowsProc(
2074 _In_ HWND hwnd,
2075 _In_ LPARAM lParam
2076);
2077</code></pre>
2078<p>The naive approach won't work:</p>
2079<pre><code class="language-python" data-lang="python">def callback(hwnd, lParam):
2080 print(hwnd)
2081 return True
2082
2083ctypes.windll.user32.EnumWindows(callback, 0)
2084# ctypes.ArgumentError: argument 1: &lt;class 'TypeError'&gt;: Don't know how to convert parameter 1
2085# Aww.
2086</code></pre>
2087<p>Instead, you must wrap your function as a C definition like so:</p>
2088<pre><code class="language-python" data-lang="python">from ctypes.wintypes import BOOL, HWND, LPARAM
2089
2090EnumWindowsProc = ctypes.WINFUNCTYPE(BOOL, HWND, LPARAM)
2091
2092def callback(hwnd, lParam):
2093 print(hwnd)
2094 return True
2095
2096# Wrap the function in the C definition
2097callback = EnumWindowsProc(callback)
2098
2099ctypes.windll.user32.EnumWindows(callback, 0)
2100# Yay, it works.
2101</code></pre>
2102<p>You may have noticed this is what decorators do, wrap the function. So…</p>
2103<pre><code class="language-python" data-lang="python">from ctypes.wintypes import BOOL, HWND, LPARAM
2104
2105@ctypes.WINFUNCTYPE(BOOL, HWND, LPARAM)
2106def callback(hwnd, lParam):
2107 print(hwnd)
2108 return True
2109
2110ctypes.windll.user32.EnumWindows(callback, 0)
2111</code></pre>
2112<p>…will also work. And it is a <em>lot</em> fancier.</p>
2113<h2 id="closing-words">Closing Words</h2>
2114<p>With the knowledge above and some experimentation, you should be able to call and do (almost) anything you want. That was pretty much all I needed on my project anyway :)</p>
2115<p>We have been letting Python convert Python values into C values, but you can do so explicitly too. For example, you can use <code>ctypes.c_short(17)</code> to make sure to pass that <code>17</code> as a <code>short</code>. And if you have a <code>c_short</code>, you can convert or cast it to its Python <code>.value</code> as <code>some_short.value</code>. The same applies for integers, longs, floats, doubles… pretty much anything, char pointers (strings) included.</p>
2116<p>If you can't find something in their online documentation, you can always <a href="https://github.com/BurntSushi/ripgrep"><code>rg</code></a> for it in the <code>C:\Program Files (x86)\Windows Kits\10\Include\*</code> directory.</p>
2117<p>Note that the <code>ctypes.Structure</code>'s that you define can have more methods of your own. For example, you can write them a <code>__str__</code> to easily view its fields, or define a <code>@property</code> to re-interpret some data in a meaningful way.</p>
2118<p>For enumerations, you can pass just the right integer number, make a constant for it, or if you prefer, use a <a href="https://docs.python.org/3/library/enum.html#enum.IntEnum"><code>enum.IntEnum</code></a>. For example, <a href="https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism/dismloglevel-enumeration"><code>DismLogLevel</code></a> would be:</p>
2119<pre><code class="language-python" data-lang="python">class DismLogLevel(enum.IntEnum):
2120 DismLogErrors = 0
2121 DismLogErrorsWarnings = 1
2122 DismLogErrorsWarningsInfo = 2
2123</code></pre>
2124<p>And you <em>should</em> be able to pass <code>DismLogLevel.DismLogErrors</code> as the parameter now.</p>
2125<p>If you see a function definition like <code>Function(void)</code>, that's C's way of saying it takes no parameters, so just call it as <code>Function()</code>.</p>
2126<p>Make sure to pass all parameters, even if they seem optional they probably still want a <code>NULL</code> at least, and of course, read the documentation well. Some methods have certain pre-conditions.</p>
2127<p>Have fun hacking!</p>
2128</content>
2129 </entry>
2130 <entry xml:lang="en">
2131 <title>Shattered Pixel Dungeon</title>
2132 <published>2019-06-03T00:00:00+00:00</published>
2133 <updated>2019-06-03T00:00:00+00:00</updated>
2134 <link href="https://lonami.dev/blog/pixel-dungeon/" type="text/html"/>
2135 <id>https://lonami.dev/blog/pixel-dungeon/</id>
2136 <content type="html"><p><a href="https://shatteredpixel.com/shatteredpd/">Shattered Pixel Dungeon</a> is the classic roguelike RPG game with randomly-generated dungeons. As a new player, it was a bit frustrating to be constantly killed on the first levels of the dungeon, but with some practice it's easy to reach high levels if you can kill the first boss.</p>
2137<h2 id="basic-tips">Basic Tips</h2>
2138<p>The game comes with its own tips, but here's a short and straight-forward summary:</p>
2139<ul>
2140<li><strong>Don't rush into enemies</strong>. Abuse doors and small corridors to kill them one by one. You can use the clock on the bottom left to wait a turn without moving.</li>
2141<li><strong>Explore each level at full</strong>. You will find goodies and gain XP while doing so.</li>
2142<li><strong>Upon finding a special room</strong> (e.g. has a chest but is protected by piranhas), drink all potions that you found in that level until there's one that helps you (e.g. be invisible so piranhas leave you alone). There is guaranteed to be a helpful one per level with special rooms.</li>
2143<li><strong>Drink potions as early as possible</strong>. Harmful potions do less damage on early levels (and if you die, you lose less). This will keep them identified early for the rest of the game.</li>
2144<li><strong>Read scrolls as early as possible</strong> as well. This will keep them identified. It may be worth to wait until you have an item which may be cursed and until the level is clear, because some scrolls clean curses and others alert enemies.</li>
2145<li><strong>Food and health are resources</strong> that you have to <em>manage</em>, not keep them always at full. Even if you are starving and taking damage, you may not need to eat <em>just yet</em>, since food is scarce. Eat when you are low on health or in possible danger.</li>
2146<li><strong>Piranhas</strong>. Seriously, just leave them alone if you are melee. They're free food if you're playing ranged, though.</li>
2147<li><strong>Prefer armor over weapons</strong>. And make sure to identify or clean it from curses before wearing anything!</li>
2148<li><strong>Find a dew vial early</strong>. It's often a better idea to store dew (health) for later than to use it as soon as possible.</li>
2149</ul>
2150<h2 id="bosses">Bosses</h2>
2151<p>There is a boss every 5 levels.</p>
2152<ul>
2153<li><strong>Level 5 boss</strong>. Try to stay on water, but don't let <em>it</em> stay on water since it will heal. Be careful when he starts enraging.</li>
2154<li><strong>Level 10 boss</strong>. Ranged weapons are good against it.</li>
2155<li><strong>Level 15 boss</strong>. I somehow managed to tank it with a health potion.</li>
2156<li><strong>Level 20 boss</strong>. I didn't get this far just yet. You are advised to use scrolls of magic mapping in the last levels to skip straight to the boss, since there's nothing else of value.</li>
2157<li><strong>Level 25 boss</strong>. The final boss. Good job if you made it this far!</li>
2158</ul>
2159<h2 id="mage">Mage</h2>
2160<p>If you followed the basic tips, you will sooner or later make use of two scrolls of upgrade in a single run. This will unlock the mage class, which is ridiculously powerful. He starts with a ranged-weapon, a magic missile wand, which is really helpful to keep enemies at a distance. Normally, you want to use this at first to surprise attack them soon, and if you are low on charges, you may go melee on normal enemies if you are confident.</p>
2161<h2 id="luck">Luck</h2>
2162<p>This game is all about luck and patience! Some runs will be better than others, and you should thank and pray the RNG gods for them. If you don't, they will only give you cursed items and not a single scroll to clean them. So, good luck and enjoy playing!</p>
2163</content>
2164 </entry>
2165 <entry xml:lang="en">
2166 <title>Installing NixOS, Take 2</title>
2167 <published>2019-02-15T00:00:00+00:00</published>
2168 <updated>2019-02-16T00:00:00+00:00</updated>
2169 <link href="https://lonami.dev/blog/installing-nixos-2/" type="text/html"/>
2170 <id>https://lonami.dev/blog/installing-nixos-2/</id>
2171 <content type="html"><p>This is my second take at installing NixOS, after a while being frustrated with Arch Linux and the fact that a few kernel upgrades ago, the system crashed randomly from time to time. <code>journalctl</code> did not have any helpful hints and I thought reinstalling could be worthwhile anyway.</p>
2172<p>This time, I started with more knowledge! The first step is heading to the <a href="https://nixos.org">NixOS website</a> and downloading their minimal installation CD for 64 bits. I didn't go with their graphical live CD, because their <a href="https://nixos.org/nixos/manual">installation manual</a> is a wonderful resource that guides you nicely.</p>
2173<p>Once you have downloaded their <code>.iso</code>, you should probably verify it's <code>sha256sum</code> and make sure that it matches. The easiest thing to do in my opinion is using an USB to burn the image in it. Plug it in and check its device name with <code>fdisk -l</code>. In my case, it was <code>/dev/sdb</code>, so I went ahead with it and ran <code>dd if=nixos.iso of=/dev/sdb status=progress</code>. Make sure to run <code>sync</code> once that's done.</p>
2174<p>If either <code>dd</code> or <code>sync</code> seem &quot;stuck&quot; in the end, they are just flushing the changes to disk to make sure all is good. This is normal, and depends on your drives.</p>
2175<p>Now, reboot your computer with the USB plugged in and make sure to boot into it. You should be welcome with a pretty screen. Just select the first option and wait until it logs you in as root. Once you're there you probably want to <code>loadkeys es</code> or whatever your keyboard layout is, or you will have a hard time with passwords, since the characters are all over the place.</p>
2176<p>In a clean disk, you would normally create the partitions now. In my case, I already had the partitions made (100MB for the EFI system, where <code>/boot</code> lives, 40GB for the root <code>/</code> partition with my old Linux installation, and 700G for <code>/home</code>), so I didn't need to do anything here. The manual showcases <code>parted</code>, but I personally use <code>fdisk</code>, which has very helpful help I check every time I use it.</p>
2177<p><strong>Important</strong>: The <code>XY</code> in <code>/dev/sdXY</code> is probably different in your system! Make sure you use <code>fdisk -l</code> to see the correct letters and numbers!</p>
2178<p>With the partitions ready in my UEFI system, I formatted both <code>/</code> and <code>/boot</code> just to be safe with <code>mkfs.ext4 -L nixos /dev/sda2</code> and <code>mkfs.fat -F 32 -n boot /dev/sda1</code> (remember that these are the letters and numbers used in my partition scheme). Don't worry about the warning in the second command regarding lowercase letters and Windows. It's not really an issue.</p>
2179<p>Now, since we gave each partition a label, we can easily mount them through <code>mount /dev/disk/by-label/nixos /mnt</code> and, in UEFI systems, be sure to <code>mkdir -p /mnt/boot</code> and <code>mount /dev/disk/by-label/boot /mnt/boot</code>. I didn't bother setting up swap, since I have 8GB of RAM in my laptop and that's really enough for my use case.</p>
2180<p>With that done, we will now ask the configuration wizard to do some work for us (in particular, generate a template) with <code>nixos-generate-config --root /mnt</code>. This generates a very well documented file that we should edit right now (and this is important!) with whatever editor you prefer. I used <code>vim</code>, but you can change it for <code>nano</code> if you prefer.</p>
2181<p>On to the configuration file, we need to enable a few things, so <code>vim /mnt/etc/nixos/configuration.nix</code> and start scrolling down. We want to make sure to uncomment:</p>
2182<pre><code># We really want network!
2183networking.wireless.enable = true;
2184
2185# This &quot;fixes&quot; the keyboard layout. Put the one you use.
2186i18n = {
2187consoleKeyMap = &quot;es&quot;;
2188}
2189
2190# Timezones are tricky so let's get this right.
2191time.timeZone = &quot;Europe/Madrid&quot;;
2192
2193# We *really* want some base packages installed, such as
2194# wpa_supplicant, or we won't have a way to connect to the
2195# network once we install...
2196environment.systemPackages = with pkgs; [
2197wpa_supplicant wget curl vim neovim cmus mpv firefox git tdesktop
2198];
2199
2200# Printing is useful, sure, enable CUPS
2201services.printing.enable = true;
2202
2203# We have speakers, let's make use of them.
2204sound.enable = true;
2205hardware.pulseaudio.enable = true;
2206
2207# We want the X11 windowing system enabled, in Spanish.
2208services.xserver.enable = true;
2209services.xserver.layout = &quot;es&quot;;
2210
2211# I want a desktop manager in my laptop.
2212# I personally prefer XFCE, but the manual shows plenty
2213# of other options, such as Plasma, i3 WM, or whatever.
2214services.xserver.desktopManager.xfce.enable = true;
2215services.xserver.desktopManager.default = &quot;xfce&quot;;
2216
2217# Touchpad is useful (although sometimes annoying) in a laptop
2218services.xserver.libinput.enable = true;
2219
2220# We don't want to do everything as root!
2221users.users.lonami = {
2222isNormalUser = true;
2223uid = 1000;
2224home = &quot;/home/lonami&quot;;
2225extraGroups = [ &quot;wheel&quot; &quot;networkmanager&quot; &quot;audio&quot; ];
2226};
2227</code></pre>
2228<p><em>(Fun fact, I overlooked the configuration file until I wrote this and hadn't noticed sound/pulseaudio was there. It wasn't hard to find online how to enable it though!)</em></p>
2229<p>Now, let's modify <code>hardware-configuration.nix</code>. But if you have <code>/home</code> in a separate partition like me, you should run <code>blkid</code> to figure out its UUID. To avoid typing it out myself, I just ran <code>blkid &gt;&gt; /mnt/etc/nixos/hardware-configuration.nix</code> so that I could easily move it around with <code>vim</code>:</p>
2230<pre><code># (stuff...)
2231
2232fileSystems.&quot;/home&quot; =
2233{ device = &quot;/dev/disk/by-uuid/d344c686-cae7-4dd3-840e-308eddf86608&quot;;
2234fsType = &quot;ext4&quot;;
2235};
2236
2237# (more stuff...)
2238</code></pre>
2239<p>Note that, obviously, you should put your own partition's UUID there. Modifying the configuration is where I think the current NixOS' manual should have made more emphasis, at this step of the installation. They do detail it below, but that was already too late in my first attempt. Anyway, you can boot from the USB and run <code>nixos-install</code> as many times as you need until you get it working!</p>
2240<p>But before installing, we need to configure the network since there are plenty of things to download. If you want to work from WiFi, you should first figure out the name of your network card with <code>ip link show</code>. In my case it's called <code>wlp3s0</code>. So with that knowledge we can run <code>wpa_supplicant -B -i wlp3s0 -c &lt;(wpa_passphrase SSID key)</code>. Be sure to replace both <code>SSID</code> and <code>key</code> with the name of your network and password key, respectively. If they have spaces, surround them in quotes.</p>
2241<p>Another funny pitfall was typing <code>wpa_supplicant</code> in the command above twice (instead of <code>wpa_passphrase</code>). That sure spit out a few funny errors! Once you have ran that, wait a few seconds and <code>ping 1.1.1.1</code> to make sure that you can reach the internet. If you do, <code>^C</code> and let's install NixOS!</p>
2242<pre><code>nixos-install
2243</code></pre>
2244<p>Well, that was pretty painless. You can now <code>reboot</code> and enjoy your new, functional system.</p>
2245<h2 id="afterword">Afterword</h2>
2246<p>The process of installing NixOS was really painless once you have made sense out of what things mean. I was far more pleased this time than in my previous attempt, despite the four attempts I needed to have it up and running.</p>
2247<p>However not all is so good. I'm not sure where I went wrong, but the first time I tried with <code>i3</code> instead of <code>xfce</code>, all I was welcome with was a white, small terminal in the top left corner. I even generated a configuration file with <code>i3-config-wizard</code> to make sure it could detect my Mod1/Mod4 keys (which, it did), but even after rebooting, my commands weren't responding. For example, I couldn't manage to open another terminal with <code>Mod1+Enter</code>. I'm not even sure that I was in <code>i3</code>…</p>
2248<p>In my very first attempt, I pressed <code>Alt+F8</code> as suggested in the welcome message. This took me an offline copy of the manual, which is really nicely done. Funny enough, though, I couldn't exit <code>w3m</code>. Both <code>Q</code> and <code>B</code> to quit and take me back wouldn't work. Somehow, it kept throwing me back into <code>w3m</code>, so I had to forcibly shutdown.</p>
2249<p>In my second attempt, I also forgot to configure network, so I had no way to download <code>wpa_supplicant</code> without having <code>wpa_supplicant</code> itself to connect my laptop to the network! So, it was important to do that through the USB before installing it (which comes with the program preinstalled), just by making sure to add it in the configuration file.</p>
2250<p>Some other notes, if you can't reach the internet, don't add any DNS in <code>/etc/resolv.conf</code>. This should be done declaratively in <code>configuration.nix</code>.</p>
2251<p>In the end, I spent the entire afternoon playing around with it, taking breaks and what-not. I still haven't figured out why <code>nvim</code> was printing the literal escape character when going from normal to insert mode in the <code>xfce4-terminal</code> (and other actions also made it print this &quot;garbage&quot; to the console), why sometimes the network can reach the internet (and only some sites!) and sometimes not, and how to setup dualboot.</p>
2252<p>But despite all of this, I think it was a worth installing it again. One sure sees things from a different perspective, and gets the chance to write another blog post!</p>
2253<p>If there's something I overlooked or that could be done better, or maybe you can explain it differently, please be sure to <a href="https://lonami.dev/contact">contact me</a> to let me know!</p>
2254<h2 id="update">Update</h2>
2255<p>Well, that was surprisingly fast feedback. Thank you very much <a href="https://bb010g.keybase.pub/">@bb010g</a> for it! As they rightfully pointed out, one can avoid adding <code>/home</code> manually to <code>hardware-configuration.nix</code> if you mount it before generating the configuration files. However, the installation process doesn't need <code>/home</code> mounted, so I didn't do it.</p>
2256<p>The second weird issue with <code>w3m</code> is actually a funny one. <code>Alt+F8</code> <em>switches to another TTY</em>! That's why quitting the program wouldn't do anything. You'd still be in a different TTY! Normally, this is <code>Ctrl+Alt+FX</code>, so I hadn't even thought that this is what could be happening. Anyway, the solution is not quitting the program, but rather going back to the main TTY with <code>Alt+F1</code>. You can switch back and forth all you need to consult the manual.</p>
2257<p>More suggestions are having <a href="https://github.com/rycee/home-manager"><code>home-manager</code></a> manage the graphical sessions, since it should be easier to deal with than the alternatives.</p>
2258<p>Despite having followed the guide and having read it over and over several times, it seems like my thoughts in this blog post may be a bit messy. So I recommend you also reading through the guide to have two versions of all this, just in case.</p>
2259<p>Regarding network issues, they use <code>connman</code> so that may be worth checking out.</p>
2260<p>Regarding terminal issues with <code>nvim</code> printing the literal escape character, I was told off for not having checked what my <code>$TERM</code> was. I hadn't really looked into it much myself, just complained about it here, so sorry for being annoying about that. A quick search in the <code>nixpkgs</code> repository lets us find <a href="https://github.com/NixOS/nixpkgs/blob/release-18.09/pkgs/applications/editors/neovim/default.nix">neovim/default.nix</a>, with version 0.3.1. Looking at <a href="https://github.com/neovim/neovim">Neovim's main repository</a> we can see that this is a bit outdated, but that is fine.</p>
2261<p>If only I had bothered to look at <a href="https://github.com/neovim/neovim/wiki/FAQ#nvim-shows-weird-symbols-2-q-when-changing-modes">Neovim's wiki</a>, (which they found through <a href="https://github.com/neovim/neovim/issues/7749">Neovim's GitHub issues</a>) I would've seen that some terminals just don't support the program properly. The solution is, of course, to use a different terminal emulator with better support or to disable the <code>guicursor</code> in Neovim's config.</p>
2262<p>This is a pretty good life lesson. 30 seconds of searching, maybe two minutes and a half for also checking XFCE issues, are often more than enough to troubleshoot your issues. The internet is a big place and more people have surely came across the problem before, so make sure to look online first. In my defense I'll say that it didn't bother me so much so I didn't bother looking for that soon either.</p>
2263</content>
2264 </entry>
2265 <entry xml:lang="en">
2266 <title>Breaking Risk of Rain</title>
2267 <published>2019-01-12T00:00:00+00:00</published>
2268 <updated>2019-01-12T00:00:00+00:00</updated>
2269 <link href="https://lonami.dev/blog/breaking-ror/" type="text/html"/>
2270 <id>https://lonami.dev/blog/breaking-ror/</id>
2271 <content type="html"><p><a href="https://riskofraingame.com/">Risk of Rain</a> is a fun little game you can spend a lot of hours on. It's incredibly challenging for new players, and fun once you have learnt the basics. This blog will go through what I've learnt and how to play the game correctly.</p>
2272<h2 id="getting-started">Getting Started</h2>
2273<p>If you're new to the game, you may find it frustrating. You must learn very well to dodge.</p>
2274<p>Your first <a href="http://riskofrain.wikia.com/wiki/Category:Characters">character</a> will be <a href="http://riskofrain.wikia.com/wiki/Commando">Commando</a>. He's actually a very nice character. Use your third skill (dodge) to move faster, pass through large groups of enemies, and negate fall damage.</p>
2275<p>If there are a lot of monsters, remember to <strong>leave</strong> from there! It's really important for survival. Most enemies <strong>don't do body damage</strong>. Not even the body of the <a href="http://riskofrain.wikia.com/wiki/Magma_Worm">Magma Worm</a> or the <a href="http://riskofrain.wikia.com/wiki/Wandering_Vagrant">Wandering Vagrant</a> (just dodge the head and projectiles respectively).</p>
2276<p>The first thing you must do is always <strong>rush for the teleporter</strong>. Completing the levels quick will make the game easier. But make sure to take note of <strong>where the chests are</strong>! When you have time (even when the countdown finishes), go back for them and buy as many as you can. Generally, prefer <a href="http://riskofrain.wikia.com/wiki/Chest">chests</a> over <a href="http://riskofrain.wikia.com/wiki/Shrine">shrines</a> since they may eat all your money.</p>
2277<p>Completing the game on <a href="http://riskofrain.wikia.com/wiki/Difficulty">Drizzle</a> is really easy if you follow these tips.</p>
2278<h2 id="requisites">Requisites</h2>
2279<p>Before breaking the game, you must obtain several <a href="http://riskofrain.wikia.com/wiki/Item#Artifacts">artifacts</a>. We are interested in particular in the following:</p>
2280<ul>
2281<li><a href="http://riskofrain.wikia.com/wiki/Sacrifice">Sacrifice</a>. You really need this one, and may be a bit hard to get. With it, you will be able to farm the first level for 30 minutes and kill the final boss in 30 seconds.</li>
2282<li><a href="http://riskofrain.wikia.com/wiki/Command">Command</a>. You need this unless you want to grind for hours to get enough of the items you really need for the rest of the game. Getting this one is easy.</li>
2283<li><a href="http://riskofrain.wikia.com/wiki/Glass">Glass</a>. Your life will be very small (at the beginning…), but you will be able to one-shot everything easily.</li>
2284<li><a href="http://riskofrain.wikia.com/wiki/Kin">Kin</a> (optional). It makes it easier to obtain a lot of boxes if you restart the first level until you get <a href="http://riskofrain.wikia.com/wiki/Lemurian">lemurians</a> or <a href="http://riskofrain.wikia.com/wiki/Jellyfish">jellyfish</a> as the monster, since they're cheap to spawn.</li>
2285</ul>
2286<p>With those, the game becomes trivial. Playing as <a href="http://riskofrain.wikia.com/wiki/Huntress">Huntress</a> is excellent since she can move at high speed while killing everything on screen.</p>
2287<h2 id="breaking-the-game">Breaking the Game</h2>
2288<p>The rest is easy! With the command artifact you want the following items.</p>
2289<h3 id="common-items"><a href="http://riskofrain.wikia.com/wiki/Category:Common_Items">Common Items</a></h3>
2290<ul>
2291<li><a href="http://riskofrain.wikia.com/wiki/Soldier&#x27;s_Syringe">Soldier's Syringe</a>. <strong>Stack 13</strong> of these and you will triple your attack speed. You can get started with 4 or so.</li>
2292<li><a href="http://riskofrain.wikia.com/wiki/Paul&#x27;s_Goat_Hoof">Paul's Goat Hoof</a>. <strong>Stack +30</strong> of these and your movement speed will be insane. You can get a very good speed with 8 or so.</li>
2293<li><a href="http://riskofrain.wikia.com/wiki/Crowbar">Crowbar</a>. <strong>Stack +20</strong> to guarantee you can one-shot bosses.</li>
2294</ul>
2295<p>If you want to be safer:</p>
2296<ul>
2297<li><a href="http://riskofrain.wikia.com/wiki/Hermit&#x27;s_Scarf">Hermit's Scarf</a>. <strong>Stack 6</strong> of these to dodge 1/3 of the attacks.</li>
2298<li><a href="http://riskofrain.wikia.com/wiki/Monster_Tooth">Monster Tooth</a>. <strong>Stack 9</strong> of these to recover 50 life on kill. This is plenty, since you will be killing <em>a lot</em>.</li>
2299</ul>
2300<p>If you don't have enough and want more fun, get one of these:</p>
2301<ul>
2302<li><a href="http://riskofrain.wikia.com/wiki/Gasoline">Gasoline</a>. Burn the ground on kill, and more will die!</li>
2303<li><a href="http://riskofrain.wikia.com/wiki/Headstompers">Headstompers</a>. They make a pleasing sound on fall, and hurt.</li>
2304<li><a href="http://riskofrain.wikia.com/wiki/Lens-Maker&#x27;s_Glasses">Lens-Maker's Glasses</a>. <strong>Stack 14</strong> and you will always deal a critical strike for double the damage.</li>
2305</ul>
2306<h3 id="uncommon-items"><a href="http://riskofrain.wikia.com/wiki/Category:Uncommon_Items">Uncommon Items</a></h3>
2307<ul>
2308<li><a href="http://riskofrain.wikia.com/wiki/Infusion">Infusion</a>. You only really need one of this. Your life will skyrocket after a while, since this gives you 1HP per kill.</li>
2309<li><a href="http://riskofrain.wikia.com/wiki/Hopoo_Feather">Hopoo Feather</a>. <strong>Stack +10</strong> of these. You will pretty much be able to fly with so many jumps.</li>
2310<li><a href="http://riskofrain.wikia.com/wiki/Guardian&#x27;s_Heart">Guardian's Heart</a>. Not really necessary, but useful for early and late game, since it will absorb infinite damage the first hit.</li>
2311</ul>
2312<p>If, again, you want more fun, get one of these:</p>
2313<ul>
2314<li><a href="http://riskofrain.wikia.com/wiki/Ukulele">Ukelele</a>. Spazz your enemies!</li>
2315<li><a href="http://riskofrain.wikia.com/wiki/Will-o&#x27;-the-wisp">Will-o'-the-wisp</a>. Explode your enemies!</li>
2316<li><a href="http://riskofrain.wikia.com/wiki/Chargefield_Generator">Chargefield Generator</a>. It should cover your entire screen after a bit, hurting all enemies without moving a finger.</li>
2317<li><a href="http://riskofrain.wikia.com/wiki/Golden_Gun">Golden Gun</a>. You will be rich, so this gives you +40% damage.</li>
2318<li><a href="http://riskofrain.wikia.com/wiki/Predatory_Instincts">Predatory Instincts</a>. If you got 14 glasses, you will always be doing critical strikes, and this will give even more attack speed.</li>
2319<li><a href="http://riskofrain.wikia.com/wiki/56_Leaf_Clover">56 Leaf Clover</a>. More drops, in case you didn't have enough.</li>
2320</ul>
2321<h3 id="rare-items"><a href="http://riskofrain.wikia.com/wiki/Category:Rare_Items">Rare Items</a></h3>
2322<ul>
2323<li><a href="http://riskofrain.wikia.com/wiki/Ceremonial_Dagger">Ceremonial Dagger</a>. <strong>Stack +3</strong>, then killing one thing kills another thing and makes a chain reaction.</li>
2324<li><a href="http://riskofrain.wikia.com/wiki/Alien_Head">Alien Head</a>. <strong>Stack 3</strong>, and you will be able to use your abilities more often.</li>
2325</ul>
2326<p>For more fun:</p>
2327<ul>
2328<li><a href="http://riskofrain.wikia.com/wiki/Brilliant_Behemoth">Brilliant Behemoth</a>. Boom boom.</li>
2329</ul>
2330<h2 id="closing-words">Closing Words</h2>
2331<p>You can now beat the game in Monsoon solo with any character. Have fun! And be careful with the sadly common crashes.</p>
2332</content>
2333 </entry>
2334 <entry xml:lang="en">
2335 <title>WorldEdit Commands</title>
2336 <published>2018-07-11T00:00:00+00:00</published>
2337 <updated>2018-07-11T00:00:00+00:00</updated>
2338 <link href="https://lonami.dev/blog/world-edit/" type="text/html"/>
2339 <id>https://lonami.dev/blog/world-edit/</id>
2340 <content type="html"><p><a href="https://dev.bukkit.org/projects/worldedit">WorldEdit</a> is an extremely powerful tool for modifying entire worlds within <a href="https://minecraft.net">Minecraft</a>, which can be used as either a mod for your single-player worlds or as a plugin for your <a href="https://getbukkit.org/">Bukkit</a> servers.</p>
2341<p>This command guide was written for Minecraft 1.12.1, version <a href="https://dev.bukkit.org/projects/worldedit/files/2460562">6.1.7.3</a>, but should work for newer versions too. All WorldEdit commands can be used with a double slash (<code>//</code>) so they don't conlict with built-in commands. This means you can get a list of all commands with <code>//help</code>. Let's explore different categories!</p>
2342<h2 id="movement">Movement</h2>
2343<p>In order to edit a world properly you need to learn how to move in said world properly. There are several straightforward commands that let you move:</p>
2344<ul>
2345<li><code>//ascend</code> goes up one floor.</li>
2346<li><code>//descend</code> goes down one floor.</li>
2347<li><code>//thru</code> let's you pass through walls.</li>
2348<li><code>//jumpto</code> to go wherever you are looking.</li>
2349</ul>
2350<h2 id="information">Information</h2>
2351<p>Knowing your world properly is as important as knowing how to move within it, and will also let you change the information in said world if you need to.</p>
2352<ul>
2353<li><code>//biomelist</code> shows all known biomes.</li>
2354<li><code>//biomeinfo</code> shows the current biome.</li>
2355<li><code>//setbiome</code> lets you change the biome.</li>
2356</ul>
2357<h2 id="blocks">Blocks</h2>
2358<p>You can act over all blocks in a radius around you with quite a few commands. Some won't actually act over the entire range you specify, so 100 is often a good number.</p>
2359<h3 id="filling">Filling</h3>
2360<p>You can fill pools with <code>//fill water 100</code> or caves with <code>//fillr water 100</code>, both of which act below your feet.</p>
2361<h3 id="fixing">Fixing</h3>
2362<p>If the water or lava is buggy use <code>//fixwater 100</code> or <code>//fixlava 100</code> respectively.</p>
2363<p>Some creeper removed the snow or the grass? Fear not, you can use <code>//snow 10</code> or <code>//grass 10</code>.</p>
2364<h3 id="emptying">Emptying</h3>
2365<p>You can empty a pool completely with <code>//drain 100</code>, remove the snow with <code>//thaw 10</code>, and remove fire with <code>//ex 10</code>.</p>
2366<h3 id="removing">Removing</h3>
2367<p>You can remove blocks above and below you in some area with the <code>//removeabove N</code> and <code>//removebelow N</code>. You probably want to set a limit though, or you could fall off the world with <code>//removebelow 1 10</code> for radius and depth. You can also remove near blocks with <code>//removenear block 10</code>.</p>
2368<h3 id="shapes">Shapes</h3>
2369<p>Making a cylinder (or circle) can be done with through <code>//cyl stone 10</code>, a third argument for the height. The radius can be comma-separated to make a ellipses instead, such as <code>//cyl stone 5,10</code>.</p>
2370<p>Spheres are done with <code>//sphere stone 5</code>. This will build one right at your center, so you can raise it to be on your feet with <code>//sphere stone 5 yes</code>. Similar to cylinders, you can comma separate the radius <code>x,y,z</code>.</p>
2371<p>Pyramids can be done with <code>//pyramic stone 5</code>.</p>
2372<p>All these commands can be prefixed with &quot;h&quot; to make them hollow. For instance, <code>//hsphere stone 10</code>.</p>
2373<h2 id="regions">Regions</h2>
2374<h3 id="basics">Basics</h3>
2375<p>Operating over an entire region is really important, and the first thing you need to work comfortably with them is a tool to make selections. The default wooden-axe tool can be obtained with <code>//wand</code>, but you must be near the blocks to select. You can use a different tool, like a golden axe, to use as your &quot;far wand&quot; (wand usable over distance). Once you have one in your hand type <code>//farwand</code> to use it as your &quot;far wand&quot;. You can select the two corners of your region with left and right click. If you have selected the wrong tool, use <code>//none</code> to clear it.</p>
2376<p>If there are no blocks but you want to use your current position as a corner, use <code>//pos1</code> or 2.</p>
2377<p>If you made a region too small, you can enlarge it with <code>//expand 10 up</code>, or <code>//expand vert</code> for the entire vertical range, etc., or make it smaller with <code>//contract 10 up</code> etc., or <code>//inset</code> it to contract in both directions. You can use short-names for the cardinal directions (NSEW).</p>
2378<p>Finally, if you want to move your selection, you can <code>//shift 1 north</code> it to wherever you need.</p>
2379<h3 id="information-1">Information</h3>
2380<p>You can get the <code>//size</code> of the selection or even <code>//count torch</code> in some area. If you want to count all blocks, get their distribution <code>//distr</code>.</p>
2381<h3 id="filling-1">Filling</h3>
2382<p>With a region selected, you can <code>//set</code> it to be any block! For instance, you can use <code>//set air</code> to clear it entirely. You can use more than one block evenly by separting them with a comma <code>//set stone,dirt</code>, or with a custom chance <code>//set 20%stone,80%dirt</code>.</p>
2383<p>You can use <code>//replace from to</code> instead if you don't want to override all blocks in your selection.</p>
2384<p>You can make an hollow set with <code>//faces</code>, and if you just want the walls, use <code>//walls</code>.</p>
2385<h3 id="cleaning">Cleaning</h3>
2386<p>If someone destroyed your wonderful snow landscape, fear not, you can use <code>//overlay snow</code> over it (although for this you actually have <code>//snow N</code> and its opposite <code>//thaw</code>).</p>
2387<p>If you set some rough area, you can always <code>//smooth</code> it, even more than one time with <code>//smooth 3</code>. You can get your dirt and stone back with <code>//naturalize</code> and put some plants with <code>//flora</code> or <code>//forest</code>, both of which support a density or even the type for the trees. If you already have the dirt use <code>//green</code> instead. If you want some pumpkins, with <code>//pumpkins</code>.</p>
2388<h3 id="moving">Moving</h3>
2389<p>You can repeat an entire selection many times by stacking them with <code>//stack N DIR</code>. This is extremely useful to make things like corridors or elevators. For instance, you can make a small section of the corridor, select it entirely, and then repeat it 10 times with <code>//stack 10 north</code>. Or you can make the elevator and then <code>//stack 10 up</code>. If you need to also copy the air use <code>//stackair</code>.</p>
2390<p>Finally, if you don't need to repeat it and simply move it just a bit towards the right direction, you can use <code>//move N</code>. The default direction is &quot;me&quot; (towards where you are facing) but you can set one with <code>//move 1 up</code> for example.</p>
2391<h3 id="selecting">Selecting</h3>
2392<p>You can not only select cuboids. You can also select different shapes, or even just points:</p>
2393<ul>
2394<li><code>//sel cuboid</code> is the default.</li>
2395<li><code>//sel extend</code> expands the default.</li>
2396<li><code>//sel poly</code> first point with left click and right click to add new points.</li>
2397<li><code>//sel ellipsoid</code> first point to select the center and right click to select the different radius.</li>
2398<li><code>//sel sphere</code> first point to select the center and one more right click for the radius.</li>
2399<li><code>//sel cyl</code> for cylinders, first click being the center.</li>
2400<li><code>//sel convex</code> for convex shapes. This one is extremely useful for <code>//curve</code>.</li>
2401</ul>
2402<h2 id="brushes">Brushes</h2>
2403<p>Brushes are a way to paint in 3D without first bothering about making a selection, and there are spherical and cylinder brushes with e.g. <code>//brush sphere stone 2</code>, or the shorter form <code>//br s stone</code>. For cylinder, one must use <code>cyl</code> instead <code>sphere</code>.</p>
2404<p>There also exists a brush to smooth the terrain which can be enabled on the current item with <code>//br smooth</code>, which can be used with right-click like any other brush.</p>
2405<h2 id="clipboard">Clipboard</h2>
2406<p>Finally, you can copy and cut things around like you would do with normal text with <code>//copy</code> and <code>//cut</code>. The copy is issued from wherever you issue the command, so when you use <code>//paste</code>, remember that if you were 4 blocks apart when copying, it will be 4 blocks apart when pasting.</p>
2407<p>The contents of the clipboard can be flipped to wherever you are looking via <code>//flip</code>, and can be rotated via the <code>//rotate 90</code> command (in degrees).</p>
2408<p>To remove the copy use <code>//clearclipboard</code>.</p>
2409</content>
2410 </entry>
2411 <entry xml:lang="en">
2412 <title>An Introduction to Asyncio</title>
2413 <published>2018-06-13T00:00:00+00:00</published>
2414 <updated>2020-10-03T00:00:00+00:00</updated>
2415 <link href="https://lonami.dev/blog/asyncio/" type="text/html"/>
2416 <id>https://lonami.dev/blog/asyncio/</id>
2417 <content type="html"><h2 id="index">Index</h2>
2418<ul>
2419<li><a href="https://lonami.dev/blog/asyncio/#background">Background</a></li>
2420<li><a href="https://lonami.dev/blog/asyncio/#input_output">Input / Output</a></li>
2421<li><a href="https://lonami.dev/blog/asyncio/#diving_in">Diving In</a></li>
2422<li><a href="https://lonami.dev/blog/asyncio/#a_toy_example">A Toy Example</a></li>
2423<li><a href="https://lonami.dev/blog/asyncio/#a_real_example">A Real Example</a></li>
2424<li><a href="https://lonami.dev/blog/asyncio/#extra_material">Extra Material</a></li>
2425</ul>
2426<h2 id="background">Background</h2>
2427<p>After seeing some friends struggle with <code>asyncio</code> I decided that it could be a good idea to write a blog post using my own words to explain how I understand the world of asynchronous IO. I will focus on Python's <code>asyncio</code> module but this post should apply to any other language easily.</p>
2428<p>So what is <code>asyncio</code> and what makes it good? Why don't we just use the old and known threads to run several parts of the code concurrently, at the same time?</p>
2429<p>The first reason is that <code>asyncio</code> makes your code easier to reason about, as opposed to using threads, because the amount of ways in which your code can run grows exponentially. Let's see that with an example. Imagine you have this code:</p>
2430<pre><code class="language-python" data-lang="python">def method():
2431 line 1
2432 line 2
2433 line 3
2434 line 4
2435 line 5
2436</code></pre>
2437<p>And you start two threads to run the method at the same time. What is the order in which the lines of code get executed? The answer is that you can't know! The first thread can run the entire method before the second thread even starts. Or it could be the first thread that runs after the second thread. Perhaps both run the &quot;line 1&quot;, and then the line 2. Maybe the first thread runs lines 1 and 2, and then the second thread only runs the line 1 before the first thread finishes.</p>
2438<p>As you can see, any combination of the order in which the lines run is possible. If the lines modify some global shared state, that will get messy quickly.</p>
2439<p>Second, in Python, threads <em>won't</em> make your code faster most of the time. It will only increase the concurrency of your program (which is okay if it makes many blocking calls), allowing you to run several things at the same time.</p>
2440<p>If you have a lot of CPU work to do though, threads aren't a real advantage. Indeed, your code will probably run slower under the most common Python implementation, CPython, which makes use of a Global Interpreter Lock (GIL) that only lets a thread run at once. The operations won't run in parallel!</p>
2441<h2 id="input-output">Input / Output</h2>
2442<p>Before we go any further, let's first stop to talk about input and output, commonly known as &quot;IO&quot;. There are two main ways to perform IO operations, such as reading or writing from a file or a network socket.</p>
2443<p>The first one is known as &quot;blocking IO&quot;. What this means is that, when you try performing IO, the current application thread is going to <em>block</em> until the Operative System can tell you it's done. Normally, this is not a problem, since disks are pretty fast anyway, but it can soon become a performance bottleneck. And network IO will be much slower than disk IO!</p>
2444<pre><code class="language-python" data-lang="python">import socket
2445
2446# Setup a network socket and a very simple HTTP request.
2447# By default, sockets are open in blocking mode.
2448sock = socket.socket()
2449request = b'''HEAD / HTTP/1.0\r
2450Host: example.com\r
2451\r
2452'''
2453
2454# &quot;connect&quot; will block until a successful TCP connection
2455# is made to the host &quot;example.com&quot; on port 80.
2456sock.connect(('example.com', 80))
2457
2458# &quot;sendall&quot; will repeatedly call &quot;send&quot; until all the data in &quot;request&quot; is
2459# sent to the host we just connected, which blocks until the data is sent.
2460sock.sendall(request)
2461
2462# &quot;recv&quot; will try to receive up to 1024 bytes from the host, and block until
2463# there is any data to receive (or empty if the host closes the connection).
2464response = sock.recv(1024)
2465
2466# After all those blocking calls, we got out data! These are the headers from
2467# making a HTTP request to example.com.
2468print(response.decode())
2469</code></pre>
2470<p>Blocking IO offers timeouts, so that you can get control back in your code if the operation doesn't finish. Imagine that the remote host doesn't want to reply, your code would be stuck for as long as the connection remains alive!</p>
2471<p>But wait, what if we make the timeout small? Very, very small? If we do that, we will never block waiting for an answer. That's how asynchronous IO works, and it's the opposite of blocking IO (you can also call it non-blocking IO if you want to).</p>
2472<p>How does non-blocking IO work if the IO device needs a while to answer with the data? In that case, the operative system responds with &quot;not ready&quot;, and your application gets control back so it can do other stuff while the IO device completes your request. It works a bit like this:</p>
2473<pre><code>&lt;app&gt; Hey, I would like to read 16 bytes from this file
2474&lt;OS&gt; Okay, but the disk hasn't sent me the data yet
2475&lt;app&gt; Alright, I will do something else then
2476(a lot of computer time passes)
2477&lt;app&gt; Do you have my 16 bytes now?
2478&lt;OS&gt; Yes, here they are! &quot;Hello, world !!\n&quot;
2479</code></pre>
2480<p>In reality, you can tell the OS to notify you when the data is ready, as opposed to polling (constantly asking the OS whether the data is ready yet or not), which is more efficient.</p>
2481<p>But either way, that's the difference between blocking and non-blocking IO, and what matters is that your application gets to run more without ever needing to wait for data to arrive, because the data will be there immediately when you ask, and if it's not yet, your app can do more things meanwhile.</p>
2482<h2 id="diving-in">Diving In</h2>
2483<p>Now we've seen what blocking and non-blocking IO is, and how threads make your code harder to reason about, but they give concurrency (yet not more speed). Is there any other way to achieve this concurrency that doesn't involve threads? Yes! The answer is <code>asyncio</code>.</p>
2484<p>So how does <code>asyncio</code> help? First we need to understand a very crucial concept before we can dive any deeper, and I'm talking about the <em>event loop</em>. What is it and why do we need it?</p>
2485<p>You can think of the event loop as a <em>loop</em> that will be responsible for calling your <code>async</code> functions:</p>
2486<p><img src="https://lonami.dev/blog/asyncio/eventloop.svg" alt="The Event Loop" /></p>
2487<p>That's silly you may think. Now not only we run our code but we also have to run some &quot;event loop&quot;. It doesn't sound beneficial at all. What are these events? Well, they are the IO events we talked about before!</p>
2488<p><code>asyncio</code>'s event loop is responsible for handling those IO events, such as file is ready, data arrived, flushing is done, and so on. As we saw before, we can make these events non-blocking by setting their timeout to 0.</p>
2489<p>Let's say you want to read from 10 files at the same time. You will ask the OS to read data from 10 files, and at first none of the reads will be ready. But the event loop will be constantly asking the OS to know which are done, and when they are done, you will get your data.</p>
2490<p>This has some nice advantages. It means that, instead of waiting for a network request to send you a response or some file, instead of blocking there, the event loop can decide to run other code meanwhile. Whenever the contents are ready, they can be read, and your code can continue. Waiting for the contents to be received is done with the <code>await</code> keyword, and it tells the loop that it can run other code meanwhile:</p>
2491<p><img src="https://lonami.dev/blog/asyncio/awaitkwd1.svg" alt="Step 1, await keyword" /></p>
2492<p><img src="https://lonami.dev/blog/asyncio/awaitkwd2.svg" alt="Step 2, await keyword" /></p>
2493<p>Start reading the code of the event loop and follow the arrows. You can see that, in the beginning, there are no events yet, so the loop calls one of your functions. The code runs until it has to <code>await</code> for some IO operation to complete, such as sending a request over the network. The method is &quot;paused&quot; until an event occurs (for example, an &quot;event&quot; occurs when the request has been sent completely).</p>
2494<p>While the first method is busy, the event loop can enter the second method, and run its code until the first <code>await</code>. But it can happen that the event of the second query occurs before the request on the first method, so the event loop can re-enter the second method because it has already sent the query, but the first method isn't done sending the request yet.</p>
2495<p>Then, the second method <code>await</code>'s for an answer, and an event occurs telling the event loop that the request from the first method was sent. The code can be resumed again, until it has to <code>await</code> for a response, and so on. Here's an explanation with pseudo-code for this process if you prefer:</p>
2496<pre><code class="language-python" data-lang="python">async def method(request):
2497 prepare request
2498 await send request
2499
2500 await receive request
2501
2502 process request
2503 return result
2504
2505run in parallel (
2506 method with request 1,
2507 method with request 2,
2508)
2509</code></pre>
2510<p>This is what the event loop will do on the above pseudo-code:</p>
2511<pre><code>no events pending, can advance
2512
2513enter method with request 1
2514 prepare request
2515 await sending request
2516pause method with request 1
2517
2518no events ready, can advance
2519
2520enter method with request 2
2521 prepare request
2522 await sending request
2523pause method with request 2
2524
2525both requests are paused, cannot advance
2526wait for events
2527event for request 2 arrives (sending request completed)
2528
2529enter method with request 2
2530 await receiving response
2531pause method with request 2
2532
2533event for request 1 arrives (sending request completed)
2534
2535enter method with request 1
2536 await receiving response
2537pause method with request 1
2538
2539...and so on
2540</code></pre>
2541<p>You may be wondering &quot;okay, but threads work for me, so why should I change?&quot;. There are some important things to note here. The first is that we only need one thread to be running! The event loop decides when and which methods should run. This results in less pressure for the operating system. The second is that we know when it may run other methods. Those are the <code>await</code> keywords! Whenever there is one of those, we know that the loop is able to run other things until the resource (again, like network) becomes ready (when a event occurs telling us it's ready to be used without blocking or it has completed).</p>
2542<p>So far, we already have two advantages. We are only using a single thread so the cost for switching between methods is low, and we can easily reason about where our program may interleave operations.</p>
2543<p>Another advantage is that, with the event loop, you can easily schedule when a piece of code should run, such as using the method <a href="https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.call_at"><code>loop.call_at</code></a>, without the need for spawning another thread at all.</p>
2544<p>To tell the <code>asyncio</code> to run the two methods shown above, we can use <a href="https://docs.python.org/3/library/asyncio-future.html#asyncio.ensure_future"><code>asyncio.ensure_future</code></a>, which is a way of saying &quot;I want the future of my method to be ensured&quot;. That is, you want to run your method in the future, whenever the loop is free to do so. This method returns a <code>Future</code> object, so if your method returns a value, you can <code>await</code> this future to retrieve its result.</p>
2545<p>What is a <code>Future</code>? This object represents the value of something that will be there in the future, but might not be there yet. Just like you can <code>await</code> your own <code>async def</code> functions, you can <code>await</code> these <code>Future</code>'s.</p>
2546<p>The <code>async def</code> functions are also called &quot;coroutines&quot;, and Python does some magic behind the scenes to turn them into such. The coroutines can be <code>await</code>'ed, and this is what you normally do.</p>
2547<h2 id="a-toy-example">A Toy Example</h2>
2548<p>That's all about <code>asyncio</code>! Let's wrap up with some example code. We will create a server that replies with the text a client sends, but reversed. First, we will show what you could write with normal synchronous code, and then we will port it.</p>
2549<p>Here is the <strong>synchronous version</strong>:</p>
2550<pre><code class="language-python" data-lang="python"># server.py
2551import socket
2552
2553
2554def server_method():
2555 # create a new server socket to listen for connections
2556 server = socket.socket()
2557
2558 # bind to localhost:6789 for new connections
2559 server.bind(('localhost', 6789))
2560
2561 # we will listen for one client at most
2562 server.listen(1)
2563
2564 # *block* waiting for a new client
2565 client, _ = server.accept()
2566
2567 # *block* waiting for some data
2568 data = client.recv(1024)
2569
2570 # reverse the data
2571 data = data[::-1]
2572
2573 # *block* sending the data
2574 client.sendall(data)
2575
2576 # close client and server
2577 server.close()
2578 client.close()
2579
2580
2581if __name__ == '__main__':
2582 # block running the server
2583 server_method()
2584</code></pre>
2585<pre><code class="language-python" data-lang="python"># client.py
2586import socket
2587
2588
2589def client_method():
2590 message = b'Hello Server!\n'
2591 client = socket.socket()
2592
2593 # *block* trying to stabilish a connection
2594 client.connect(('localhost', 6789))
2595
2596 # *block* trying to send the message
2597 print('Sending', message)
2598 client.sendall(message)
2599
2600 # *block* until we receive a response
2601 response = client.recv(1024)
2602 print('Server replied', response)
2603
2604 client.close()
2605
2606
2607if __name__ == '__main__':
2608 client_method()
2609</code></pre>
2610<p>From what we've seen, this code will block on all the lines with a comment above them saying that they will block. This means that for running more than one client or server, or both in the same file, you will need threads. But we can do better, we can rewrite it into <code>asyncio</code>!</p>
2611<p>The first step is to mark all your <code>def</code>initions that may block with <code>async</code>. This marks them as coroutines, which can be <code>await</code>ed on.</p>
2612<p>Second, since we're using low-level sockets, we need to make use of the methods that <code>asyncio</code> provides directly. If this was a third-party library, this would be just like using their <code>async def</code>initions.</p>
2613<p>Here is the <strong>asynchronous version</strong>:</p>
2614<pre><code class="language-python" data-lang="python"># server.py
2615import asyncio
2616import socket
2617
2618# get the default &quot;event loop&quot; that we will run
2619loop = asyncio.get_event_loop()
2620
2621
2622# notice our new &quot;async&quot; before the definition
2623async def server_method():
2624 server = socket.socket()
2625 server.bind(('localhost', 6789))
2626 server.listen(1)
2627
2628 # await for a new client
2629 # the event loop can run other code while we wait here!
2630 client, _ = await loop.sock_accept(server)
2631
2632 # await for some data
2633 data = await loop.sock_recv(client, 1024)
2634 data = data[::-1]
2635
2636 # await for sending the data
2637 await loop.sock_sendall(client, data)
2638
2639 server.close()
2640 client.close()
2641
2642
2643if __name__ == '__main__':
2644 # run the loop until &quot;server method&quot; is complete
2645 loop.run_until_complete(server_method())
2646</code></pre>
2647<pre><code class="language-python" data-lang="python"># client.py
2648import asyncio
2649import socket
2650
2651loop = asyncio.get_event_loop()
2652
2653
2654async def client_method():
2655 message = b'Hello Server!\n'
2656 client = socket.socket()
2657
2658 # await to stabilish a connection
2659 await loop.sock_connect(client, ('localhost', 6789))
2660
2661 # await to send the message
2662 print('Sending', message)
2663 await loop.sock_sendall(client, message)
2664
2665 # await to receive a response
2666 response = await loop.sock_recv(client, 1024)
2667 print('Server replied', response)
2668
2669 client.close()
2670
2671
2672if __name__ == '__main__':
2673 loop.run_until_complete(client_method())
2674</code></pre>
2675<p>That's it! You can place these two files separately and run, first the server, then the client. You should see output in the client.</p>
2676<p>The big difference here is that you can easily modify the code to run more than one server or clients at the same time. Whenever you <code>await</code> the event loop will run other of your code. It seems to &quot;block&quot; on the <code>await</code> parts, but remember it's actually jumping to run more code, and the event loop will get back to you whenever it can.</p>
2677<p>In short, you need an <code>async def</code> to <code>await</code> things, and you run them with the event loop instead of calling them directly. So this…</p>
2678<pre><code class="language-python" data-lang="python">def main():
2679 ... # some code
2680
2681
2682if __name__ == '__main__':
2683 main()
2684</code></pre>
2685<p>…becomes this:</p>
2686<pre><code class="language-python" data-lang="python">import asyncio
2687
2688
2689async def main():
2690 ... # some code
2691
2692
2693if __name__ == '__main__':
2694 asyncio.get_event_loop().run_until_complete(main)
2695</code></pre>
2696<p>This is pretty much how most of your <code>async</code> scripts will start, running the main method until its completion.</p>
2697<h2 id="a-real-example">A Real Example</h2>
2698<p>Let's have some fun with a real library. We'll be using <a href="https://github.com/LonamiWebs/Telethon">Telethon</a> to broadcast a message to our three best friends, all at the same time, thanks to the magic of <code>asyncio</code>. We'll dive right into the code, and then I'll explain our new friend <code>asyncio.wait(...)</code>:</p>
2699<pre><code class="language-python" data-lang="python"># broadcast.py
2700import asyncio
2701import sys
2702
2703from telethon import TelegramClient
2704
2705# (you need your own values here, check Telethon's documentation)
2706api_id = 123
2707api_hash = '123abc'
2708friends = [
2709 '@friend1__username',
2710 '@friend2__username',
2711 '@bestie__username'
2712]
2713
2714# we will have to await things, so we need an async def
2715async def main(message):
2716 # start is a coroutine, so we need to await it to run it
2717 client = await TelegramClient('me', api_id, api_hash).start()
2718
2719 # wait for all three client.send_message to complete
2720 await asyncio.wait([
2721 client.send_message(friend, message)
2722 for friend in friends
2723 ])
2724
2725 # and close our client
2726 await client.disconnect()
2727
2728
2729if __name__ == '__main__':
2730 if len(sys.argv) != 2:
2731 print('You must pass the message to broadcast!')
2732 quit()
2733
2734 message = sys.argv[1]
2735 asyncio.get_event_loop().run_until_complete(main(message))
2736</code></pre>
2737<p>Wait… how did that send a message to all three of
2738my friends? The magic is done here:</p>
2739<pre><code class="language-python" data-lang="python">[
2740 client.send_message(friend, message)
2741 for friend in friends
2742]
2743</code></pre>
2744<p>This list comprehension creates another list with three
2745coroutines, the three <code>client.send_message(...)</code>.
2746Then we just pass that list to <code>asyncio.wait</code>:</p>
2747<pre><code class="language-python" data-lang="python">await asyncio.wait([...])
2748</code></pre>
2749<p>This method, by default, waits for the list of coroutines to run until they've all finished. You can read more on the Python <a href="https://docs.python.org/3/library/asyncio-task.html#asyncio.wait">documentation</a>. Truly a good function to know about!</p>
2750<p>Now whenever you have some important news for your friends, you can simply <code>python3 broadcast.py 'I bought a car!'</code> to tell all your friends about your new car! All you need to remember is that you need to <code>await</code> on coroutines, and you will be good. <code>asyncio</code> will warn you when you forget to do so.</p>
2751<h2 id="extra-material">Extra Material</h2>
2752<p>If you want to understand how <code>asyncio</code> works under the hood, I recommend you to watch this hour-long talk <a href="https://youtu.be/M-UcUs7IMIM">Get to grips with asyncio in Python 3</a> by Robert Smallshire. In the video, they will explain the differences between concurrency and parallelism, along with others concepts, and how to implement your own <code>asyncio</code> &quot;scheduler&quot; from scratch.</p>
2753</content>
2754 </entry>
2755 <entry xml:lang="en">
2756 <title>Atemporal Blog Posts</title>
2757 <published>2018-02-03T00:00:00+00:00</published>
2758 <updated>2021-02-19T00:00:00+00:00</updated>
2759 <link href="https://lonami.dev/blog/posts/" type="text/html"/>
2760 <id>https://lonami.dev/blog/posts/</id>
2761 <content type="html"><p>These are some interesting posts and links I've found around the web. I believe they are quite interesting and nice reads, so if you have the time, I encourage you to check some out.</p>
2762<h2 id="algorithms">Algorithms</h2>
2763<ul>
2764<li><a href="http://www.tannerhelland.com/4660/dithering-eleven-algorithms-source-code/">Image Dithering: Eleven Algorithms and Source Code</a>. What does it mean and how to achieve it?</li>
2765<li><a href="https://cristian.io/post/bloom-filters/">Idempotence layer on bloom filters</a>. What are they and how can they help?</li>
2766<li><a href="https://en.wikipedia.org/wiki/Huffman_coding">Huffman coding</a>. This encoding is a simple yet interesting way of compressing information.</li>
2767<li><a href="https://github.com/mxgmn/WaveFunctionCollapse">Wave Function Collapse</a>. Bitmap &amp; tilemap generation from a single example with the help of ideas from quantum mechanics.</li>
2768<li><a href="https://blog.nelhage.com/2015/02/regular-expression-search-with-suffix-arrays/">Regular Expression Search with Suffix Arrays</a>. A way to efficiently search large amounts of text.</li>
2769</ul>
2770<h2 id="culture">Culture</h2>
2771<ul>
2772<li><a href="https://www.wired.com/story/ideas-joi-ito-robot-overlords/">Why Westerners Fear Robots and the Japanese Do Not</a>. Explains some possible reasons for this case.</li>
2773<li><a href="http://catb.org/%7Eesr/faqs/smart-questions.html">How To Ask Questions The Smart Way</a>. Some bits of hacker culture and amazing tips on how to ask a question.</li>
2774<li><a href="http://apenwarr.ca/log/?m=201809#14">XML, blockchains, and the strange shapes of progress</a>. Some of history about XML and blockchain.</li>
2775<li><a href="https://czep.net/17/legion-of-lobotomized-unices.html">Legion of lobotomized unices</a>. A time where computers are treated a lot more nicely.</li>
2776<li><a href="https://eli.thegreenplace.net/2016/the-expression-problem-and-its-solutions/">The Expression Problem and its solutions</a>. What is it and what can we do to solve it?</li>
2777<li><a href="http://allendowney.blogspot.com/2015/08/the-inspection-paradox-is-everywhere.html">The Inspection Paradox is Everywhere</a>. Interesting and very common phenomena.</li>
2778<li><a href="https://github.com/ChrisKnott/Algojammer">An experimental code editor for writing algorithms</a>. Contains several links to different tools for reverse debugging.</li>
2779<li><a href="http://habitatchronicles.com/2017/05/what-are-capabilities/">What Are Capabilities?</a> Good ideas with great security implications.</li>
2780<li><a href="https://blog.aurynn.com/2015/12/16-contempt-culture">Contempt Culture</a>. Or why you should not speak crap about your non-favourite programming languages.</li>
2781<li><a href="https://www.lesswrong.com/posts/tscc3e5eujrsEeFN4/well-kept-gardens-die-by-pacifism">Well-Kept Gardens Die By Pacifism</a>. Risks any online community can run into.</li>
2782<li><a href="https://ncase.me/">It's Nicky Case!</a> They make some cool things worth checking out, I really like &quot;we become what we behold&quot;.</li>
2783</ul>
2784<h2 id="debate">Debate</h2>
2785<ul>
2786<li><a href="https://steemit.com/opensource/@crell/open-source-is-awful">Open Source is awful</a>. Has some points about why is it bad and how it could improve.</li>
2787<li><a href="http://www.mondo2000.com/2018/01/17/pink-lexical-goop-dark-side-autocorrect/">Pink Lexical Goop: The Dark Side of Autocorrect</a>. It can shape how you think.</li>
2788<li><a href="http://blog.ploeh.dk/2015/08/03/idiomatic-or-idiosyncratic/">Idiomatic or idiosyncratic?</a> Can porting code constructs from other languages have a positive effect?</li>
2789<li><a href="https://gamasutra.com/view/news/169296/Indepth_Functional_programming_in_C.php">In-depth: Functional programming in C++</a>. Is it useful to bother with functional concepts in a language like C++?</li>
2790<li><a href="https://vorpus.org/blog/notes-on-structured-concurrency-or-go-statement-considered-harmful/">Notes on structured concurrency, or: Go statement considered harmful</a>.</li>
2791<li><a href="https://queue.acm.org/detail.cfm?id=3212479">C Is Not a Low-level Language</a>. Could there be alternative programming models designed for more specialized CPUs?</li>
2792</ul>
2793<h2 id="food-for-thought">Food for Thought</h2>
2794<ul>
2795<li><a href="https://www.hillelwayne.com/post/divide-by-zero/">1/0 = 0</a>. Explores why it makes sense to redefine mathemathics under some circumstances, and why it is possible to do so.</li>
2796<li><a href="https://jeremykun.com/2018/04/13/for-mathematicians-does-not-mean-equality/">For mathematicians, = does not mean equality</a>. What other definitions does the equal sign have?</li>
2797<li><a href="https://www.lesswrong.com/posts/2MD3NMLBPCqPfnfre/cached-thoughts">Cached Thoughts</a>. How is it possible that our brains work at all?</li>
2798<li><a href="http://tonsky.me/blog/disenchantment/">Software disenchantment</a>. Faster hardware and slower software is a trend.
2799<ul>
2800<li><a href="https://blackhole12.com/blog/software-engineering-is-bad-but-it-s-not-that-bad/">Software Engineering Is Bad, But That's Not Why</a>. This post has some good counterpoints to Software disenchantment.</li>
2801</ul>
2802</li>
2803<li><a href="http://journal.stuffwithstuff.com/2015/02/01/what-color-is-your-function/">What Color is Your Function?</a>. Spoiler: can we approach asynchronous IO better?</li>
2804<li><a href="https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5">I'm harvesting credit card numbers and passwords from your site</a>. A word of warning when mindlessly adding dependencies.</li>
2805<li><a href="https://medium.com/message/everything-is-broken-81e5f33a24e1">Everything Is Broken</a>. Some of the (probable) truths about our world.</li>
2806<li><a href="http://johnsalvatier.org/blog/2017/reality-has-a-surprising-amount-of-detail">Reality has a surprising amount of detail</a>.</li>
2807</ul>
2808<h2 id="funny">Funny</h2>
2809<ul>
2810<li><a href="http://thedailywtf.com/articles/We-Use-BobX">We Use BobX</a>. BobX.</li>
2811<li><a href="http://thedailywtf.com/articles/the-inner-json-effect">The Inner JSON Effect</a>. For some reason, custom languages are in.</li>
2812<li><a href="https://thedailywtf.com/articles/exponential-backup">Exponential Backup</a>. Far better than git.</li>
2813<li><a href="https://thedailywtf.com/articles/ITAPPMONROBOT">ITAPPMONROBOT</a>. Solving software problems with hardware.</li>
2814<li><a href="https://thedailywtf.com/articles/a-tapestry-of-threads">A Tapestry of Threads</a>. More threads must mean faster code, right?</li>
2815<li><a href="https://medium.com/commitlog/a-brief-totally-accurate-history-of-programming-languages-cd93ec806124">A Brief Totally Accurate History Of Programming Languages</a>. Don't take offense for it!</li>
2816</ul>
2817<h2 id="graphics">Graphics</h2>
2818<ul>
2819<li><a href="http://shaunlebron.github.io/visualizing-projections/">Visualizing Projections</a>. Small post about different projection methods.</li>
2820<li><a href="http://www.iquilezles.org/www/index.htm">Inigo Quilez :: fractals, computer graphics, mathematics, shaders, demoscene and more</a> A <em>lot</em> of useful and quality articles regarding computer graphics.</li>
2821</ul>
2822<h2 id="history">History</h2>
2823<ul>
2824<li><a href="https://twobithistory.org/2018/08/18/ada-lovelace-note-g.html">What Did Ada Lovelace's Program Actually Do?</a>. And other characters that took part in the beginning's of programming.</li>
2825<li><a href="https://chrisdown.name/2018/01/02/in-defence-of-swap.html">In defence of swap: common misconceptions</a>. Swap is still an useful concept.</li>
2826<li><a href="https://www.pacifict.com/Story/">The Graphing Calculator Story</a>. A great classic Apple tale.</li>
2827<li><a href="https://twobithistory.org/2018/10/14/lisp.html">How Lisp Became God's Own Programming Language</a>. Lisp as a foundational programming language.</li>
2828</ul>
2829<h2 id="motivational">Motivational</h2>
2830<ul>
2831<li><a href="https://www.joelonsoftware.com/2002/01/06/fire-and-motion/">Fire And Motion</a>. What does actually take to get things done?</li>
2832<li><a href="https://realmensch.org/2017/08/25/the-parable-of-the-two-programmers/">The Parable of the Two Programmers</a>. This tale is about two different types of programmer and their respective endings in a company, illustrating how the one you wouldn't expect to actually ends in a better situation.</li>
2833<li><a href="https://byorgey.wordpress.com/2018/05/06/conversations-with-a-six-year-old-on-functional-programming/">Conversations with a six-year-old on functional programming</a>. Little kids today can be really interested in technological topics.</li>
2834<li><a href="https://bulletproofmusician.com/how-many-hours-a-day-should-you-practice/">How Many Hours a Day Should You Practice?</a>. While the article is about music, it applies to any other areas.</li>
2835<li><a href="http://nathanmarz.com/blog/suffering-oriented-programming.html">Suffering-oriented programming</a>. A possibly new approach on how you could tackle your new projects.</li>
2836<li><a href="https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/">Things You Should Never Do, Part I</a>. There is no need to rewrite your code.</li>
2837</ul>
2838<h2 id="optimization">Optimization</h2>
2839<ul>
2840<li><a href="http://blog.llvm.org/2011/05/what-every-c-programmer-should-know.html">What Every C Programmer Should Know About Undefined Behavior #1/3</a>. Explains what undefined behaviour is and why it makes sense.</li>
2841<li><a href="http://ridiculousfish.com/blog/posts/labor-of-division-episode-i.html">Labor of Division (Episode I)</a>. Some tricks to divide without division.</li>
2842<li><a href="http://blog.moertel.com/posts/2013-12-14-great-old-timey-game-programming-hack.html">A Great Old-Timey Game-Programming Hack</a>. Abusing instructions to make games playable even on the slowest hardware.</li>
2843<li><a href="https://web.archive.org/web/20191213224640/https://people.eecs.berkeley.edu/%7Esangjin/2012/12/21/epoll-vs-kqueue.html">Scalable Event Multiplexing: epoll vs kqueue</a>. How good OS primitives can really help performance and scability.</li>
2844<li><a href="https://adamdrake.com/command-line-tools-can-be-235x-faster-than-your-hadoop-cluster.html">Command-line Tools can be 235x Faster than your Hadoop Cluster</a>. Or how to use the right tool for the right job.</li>
2845<li><a href="https://nullprogram.com/blog/2018/05/27/">When FFI Function Calls Beat Native C</a>. How lua beat C at it and the explanation behind it.</li>
2846<li><a href="http://igoro.com/archive/gallery-of-processor-cache-effects/">Gallery of Processor Cache Effects</a>. Knowing a few things about the cache can make a big difference.</li>
2847</ul>
2848</content>
2849 </entry>
2850 <entry xml:lang="en">
2851 <title>Graphs</title>
2852 <published>2017-06-02T00:00:00+00:00</published>
2853 <updated>2017-06-02T00:00:00+00:00</updated>
2854 <link href="https://lonami.dev/blog/graphs/" type="text/html"/>
2855 <id>https://lonami.dev/blog/graphs/</id>
2856 <content type="html"><p><noscript>There are a few things which won't render unless you enable
2857JavaScript. No tracking, I promise!</noscript></p>
2858<blockquote>
2859<p>Don't know English? <a href="https://lonami.dev/blog/graphs/spanish.html">Read the Spanish version instead</a>.</p>
2860</blockquote>
2861<p>Let's imagine we have 5 bus stations, which we'll denote by ((s_i)):</p>
2862<div class="matrix">
2863 ' s_1 ' s_2 ' s_3 ' s_4 ' s_5 \\
2864s_1 ' ' V ' ' ' \\
2865s_2 ' V ' ' ' ' V \\
2866s_3 ' ' ' ' V ' \\
2867s_4 ' ' V ' V ' ' \\
2868s_5 ' V ' ' ' V '
2869</div>
2870<p>This is known as a &quot;table of direct interconnections&quot;.
2871The ((V)) represent connected paths. For instance, on the first
2872row starting at ((s_1)), reaching the ((V)),
2873allows us to turn up to get to ((s_2)).</p>
2874<p>We can see the above table represented in a more graphical way:</p>
2875<p><img src="https://lonami.dev/blog/graphs/example1.svg" alt="Table 1 as a Graph" /></p>
2876<p>This type of graph is called, well, a graph, and it's a directed
2877graph (or digraph), since the direction on which the arrows go does
2878matter. It's made up of vertices, joined together by edges (also known as
2879lines or directed arcs).</p>
2880<p>One can walk from a node to another through different paths. For
2881example, ((s_4 $rightarrow s_2 $rightarrow s_5)) is an indirect path of order
2882two, because we must use two edges to go from ((s_4)) to
2883((s_5)).</p>
2884<p>Let's now represent its adjacency matrix called A which represents the
2885same table, but uses 1 instead V to represent
2886a connection:</p>
2887<div class="matrix">
2888 0 ' 1 ' 0 ' 0 ' 0 \\
2889 1 ' 0 ' 0 ' 0 ' 1 \\
2890 0 ' 0 ' 0 ' 1 ' 0 \\
2891 0 ' 1 ' 1 ' 0 ' 0 \\
2892 1 ' 0 ' 0 ' 1 ' 0
2893</div>
2894<p>This way we can see how the ((a_{2,1})) element represents the
2895connection ((s_2 $rightarrow s_1)), and the ((a_{5,1})) element the
2896((s_5 $rightarrow s_1)) connection, etc.</p>
2897<p>In general, ((a_{i,j})) represents a connection from
2898((s_i $rightarrow s_j))as long as ((a_{i,j}$geq 1)).</p>
2899<p>Working with matrices allows us to have a computable representation of
2900any graph, which is very useful.</p>
2901<hr />
2902<p>Graphs have a lot of interesting properties besides being representable
2903by a computer. What would happen if, for instance, we calculated
2904((A^2))? We obtain the following matrix:</p>
2905<div class="matrix">
29061 ' 0 ' 0 ' 0 ' 1 \\
29071 ' 1 ' 0 ' 1 ' 0 \\
29080 ' 1 ' 1 ' 0 ' 0 \\
29091 ' 0 ' 0 ' 1 ' 1 \\
29100 ' 2 ' 1 ' 0 ' 0
2911</div>
2912<p>We can interpret this as the paths of order two.
2913But what does the element ((a_{5,2}=2)) represent? It indicates
2914the amount of possible ways to go from ((s_5 $rightarrow s_i $rightarrow s_2)).</p>
2915<p>One can manually multiply the involved row and column to determine which
2916element is the one we need to pass through, this way we have the row
2917(([1 0 0 1 0])) and the column (([1 0 0 1 0])) (on
2918vertical). The elements ((s_i$geq 1)) are ((s_1)) and
2919((s_4)). This is, we can go from ((s_5)) to
2920((s_2)) via ((s_5 $rightarrow s_1 $rightarrow s_2)) or via
2921((s_5 $rightarrow s_4 $rightarrow s_2)):
2922<img src="example2.svg" /></p>
2923<p>It's important to note that graphs to not consider self-connections, this
2924is, ((s_i $rightarrow s_i)) is not allowed; neither we work with multigraphs
2925here (those which allow multiple connections, for instance, an arbitrary
2926number ((n)) of times).</p>
2927<div class="matrix">
29281 ' 1 ' 0 ' 1 ' 0 \\
29291 ' 2 ' \textbf{1} ' 0 ' 1 \\
29301 ' 0 ' 0 ' 1 ' 1 \\
29311 ' 2 ' 1 ' 1 ' 0 \\
29322 ' 0 ' 0 ' 1 ' 2
2933</div>
2934<p>We can see how the first ((1)) just appeared on the element
2935((a_{2,3})), which means that the shortest path to it is at least
2936of order three.</p>
2937<hr />
2938<p>A graph is said to be strongly connected as long as there is a
2939way to reach all its elements.</p>
2940<p>We can see all the available paths until now by simply adding up all the
2941direct and indirect ways to reach a node, so for now, we can add
2942((A+A^2+A^3)) in such a way that:</p>
2943<div class="matrix">
29442 ' 2 ' 0 ' 1 ' 1 \\
29453 ' 3 ' 1 ' 1 ' 3 \\
29461 ' 1 ' 1 ' 2 ' 1 \\
29472 ' 3 ' 2 ' 2 ' 1 \\
29483 ' 2 ' 1 ' 2 ' 2
2949</div>
2950<p>There isn't a connection between ((s_1)) and ((s_3)) yet.
2951If we were to calculate ((A^4)):</p>
2952<div class="matrix">
29531 ' 2 ' 1 ' ' \\
2954 ' ' ' ' \\
2955 ' ' ' ' \\
2956 ' ' ' ' \\
2957 ' ' ' '
2958</div>
2959<p>We don't need to calculate anymore. We now know that the graph is
2960strongly connected!</p>
2961<hr />
2962<p>Congratulations! You've completed this tiny introduction to graphs.
2963Now you can play around with them and design your own connections.</p>
2964<p>Hold the left mouse button on the above area and drag it down to create
2965a new node, or drag a node to this area to delete it.</p>
2966<p>To create new connections, hold the right mouse button on the node you
2967want to start with, and drag it to the node you want it to be connected to.</p>
2968<p>To delete the connections coming from a specific node, middle click it.</p>
2969<table><tr><td style="width:100%;">
2970 <button onclick="resetConnections()">Reset connections</button>
2971 <button onclick="clearNodes()">Clear all the nodes</button>
2972 <br />
2973 <br />
2974 <label for="matrixOrder">Show matrix of order:</label>
2975 <input id="matrixOrder" type="number" min="1" max="5"
2976 value="1" oninput="updateOrder()">
2977 <br />
2978 <label for="matrixAccum">Show accumulated matrix</label>
2979 <input id="matrixAccum" type="checkbox" onchange="updateOrder()">
2980 <br />
2981 <br />
2982 <div>
2983 <table id="matrixTable"></table>
2984 </div>
2985</td><td>
2986 <canvas id="canvas" width="400" height="400" oncontextmenu="return false;">
2987 Looks like your browser won't let you see this fancy example :(
2988 </canvas>
2989 <br />
2990</td></tr></table>
2991<script src="tinyparser.js"></script>
2992<script src="enhancements.js"></script>
2993<script src="graphs.js"></script>
2994</content>
2995 </entry>
2996 <entry xml:lang="en">
2997 <title>Installing NixOS</title>
2998 <published>2017-05-13T00:00:00+00:00</published>
2999 <updated>2019-02-16T00:00:00+00:00</updated>
3000 <link href="https://lonami.dev/blog/installing-nixos/" type="text/html"/>
3001 <id>https://lonami.dev/blog/installing-nixos/</id>
3002 <content type="html"><h2 id="update">Update</h2>
3003<p><em>Please see <a href="../installing_nixos_2/index.html">my followup post with NixOS</a> for a far better experience with it</em></p>
3004<hr />
3005<p>Today I decided to install <a href="http://nixos.org/">NixOS</a> as a recommendation, a purely functional Linux distribution, since <a href="https://xubuntu.org/">Xubuntu</a> kept crashing. Here's my journey, and how I managed to install it from a terminal for the first time in my life. Steps aren't hard, but they may not seem obvious at first.</p>
3006<ul>
3007<li>
3008<p>Grab the Live CD, burn it on a USB stick and boot. I recommend using <a href="https://etcher.io/">Etcher</a>.</p>
3009</li>
3010<li>
3011<p>Type <code>systemctl start display-manager</code> and wait.<sup class="footnote-reference"><a href="#1">1</a></sup></p>
3012</li>
3013<li>
3014<p>Open both the manual and the <code>konsole</code>.</p>
3015</li>
3016<li>
3017<p>Connect to the network using the GUI.</p>
3018</li>
3019<li>
3020<p>Create the disk partitions by using <code>fdisk</code>.</p>
3021<p>You can list them with <code>fdisk -l</code>, modify a certain drive with <code>fdisk /dev/sdX</code> (for instance, <code>/dev/sda</code>) and follow the instructions.</p>
3022<p>To create the file system, use <code>mkfs.ext4 -L &lt;label&gt; /dev/sdXY</code> and swap with <code>mkswap -L &lt;label&gt; /dev/sdXY</code>.</p>
3023<p>The EFI partition should be done with <code>mkfs.vfat</code>.</p>
3024</li>
3025<li>
3026<p>Mount the target to <code>/mnt</code> e.g. if the label was <code>nixos</code>, <code>mount /dev/disk/by-label/nixos /mnt</code></p>
3027</li>
3028<li>
3029<p><code>mkdir /mnt/boot</code> and then mount your EFI partition to it.</p>
3030</li>
3031<li>
3032<p>Generate a configuration template with <code>nixos-generate-config --root /mnt</code>, and modify it with <code>nano /etc/nixos/configuration.nix</code>.</p>
3033</li>
3034<li>
3035<p>While modifying the configuration, make sure to add <code>boot.loader.grub.device = &quot;/dev/sda&quot;</code></p>
3036</li>
3037<li>
3038<p>More useful configuration things are:</p>
3039<ul>
3040<li>Uncomment the whole <code>i18n</code> block.</li>
3041<li>Add some essential packages like <code>environment.systemPackages = with pkgs; [wget git firefox pulseaudio networkmanagerapplet];</code>.</li>
3042<li>If you want to use XFCE, add <code>services.xserver.desktopManager.xfce.enable = true;</code>, otherwise, you don't need <code>networkmanagerapplet</code> either. Make sure to add <code>networking.networkmanager.enable = true;</code> too.</li>
3043<li>Define some user for yourself (modify <code>guest</code> name) and use a UID greater than 1000. Also, add yourself to <code>extraGroups = [&quot;wheel&quot; &quot;networkmanager&quot;];</code> (the first to be able to <code>sudo</code>, the second to use network related things).</li>
3044</ul>
3045</li>
3046<li>
3047<p>Run <code>nixos-install</code>. If you ever modify that file again, to add more packages for instance (this is how they're installed), run <code>nixos-rebuild switch</code> (or use <code>test</code> to test but don't boot to it, or <code>boot</code> not to switch but to use on next boot.</p>
3048</li>
3049<li>
3050<p><code>reboot</code>.</p>
3051</li>
3052<li>
3053<p>Login as <code>root</code>, and set a password for your user with <code>passwd &lt;user&gt;</code>. Done!</p>
3054</li>
3055</ul>
3056<p>I enjoyed the process of installing it, and it's really cool that it has versioning and is so clean to keep track of which packages you install. But not being able to run arbitrary binaries by default is something very limitting in my opinion, though they've done a good job.</p>
3057<p>I'm now back to Xubuntu, with a fresh install.</p>
3058<h2 id="update-1">Update</h2>
3059<p>It is not true that &quot;they don't allow running arbitrary binaries by default&quot;, as pointed out in their <a href="https://nixos.org/nixpkgs/manual/#sec-fhs-environments">manual, buildFHSUserEnv</a>:</p>
3060<blockquote>
3061<p><code>buildFHSUserEnv</code> provides a way to build and run FHS-compatible lightweight sandboxes. It creates an isolated root with bound <code>/nix/store</code>, so its footprint in terms of disk space needed is quite small. This allows one to run software which is hard or unfeasible to patch for NixOS -- 3rd-party source trees with FHS assumptions, games distributed as tarballs, software with integrity checking and/or external self-updated binaries. It uses Linux namespaces feature to create temporary lightweight environments which are destroyed after all child processes exit, without root user rights requirement.</p>
3062</blockquote>
3063<p>Thanks to <a href="https://github.com/bb010g">@bb010g</a> for pointing this out.</p>
3064<h2 id="notes">Notes</h2>
3065<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
3066<p>The keyboard mapping is a bit strange. On my Spanish keyboard, the keys were as follows:</p>
3067</div>
3068<table><thead><tr><th>Keyboard</th><th>Maps to</th><th>Shift</th></tr></thead><tbody>
3069<tr><td>'</td><td>-</td><td>_</td></tr>
3070<tr><td>´</td><td>'</td><td>&quot;</td></tr>
3071<tr><td>`</td><td>[</td><td></td></tr>
3072<tr><td>+</td><td>]</td><td></td></tr>
3073<tr><td>¡</td><td>=</td><td></td></tr>
3074<tr><td>-</td><td>/</td><td></td></tr>
3075<tr><td>ñ</td><td>;</td><td></td></tr>
3076</tbody></table>
3077</content>
3078 </entry>
3079</feed>