Xusheng Li

LG Updated Its “Adware”

Sat, 19 Sep 2026 00:00:00 +0000

LG has been under fire for what its devices do after people buy them. Gamers Nexus found that some LG monitors caused Windows to install an LG app that promoted more software, including McAfee. More recently, its investigation 216,000,000 Spy TVs: The LG Smart TV Problem examined LG’s Automatic Content Recognition and other privacy concerns. Different products, same question: who decides what a device does after it enters your home?

I previously reversed LG’s Monitor App Installer and the driver that installed it. Today, Windows Update offered a new version of that SoftwareComponent. Given the recent criticism, I wanted to know what LG had changed.

Detecting Insecure Software Updates at Scale with LLM Agents

Wed, 16 Sep 2026 00:00:00 +0000

TL;DR

I used a hierarchy of low-cost source-reading agents, stronger review agents, and manual verification to trace how 3,006 open-source projects handle software updates.
I found 624 with an updater that could download and then install, load, or execute code: 134 used a pinned signing key, 109 enforced a publisher identity, 332 relied only on HTTPS, and 49 used broken transport security. The other 2,382 had no updater or were notification-only.
In those 49 projects, a man-in-the-middle attacker could replace update payloads and achieve remote code execution on users’ machines.

Browse the dataset or inspect and correct it in the public repository.

Bringing Chinese Chess Master III: Jiangzu Back to Life

Tue, 08 Sep 2026 00:00:00 -0400

简体中文版

Chinese Chess Master III: Jiangzu (象棋大師 III／將族) was a popular DOS Xiangqi game. Its developer’s historical company profile claims 200,000 copies sold. I played a number of games against it when I was yong and won most of them. I’m an international Xiangqi grandmaster, so that wasn’t particularly surprising, but I still found it a worthwhile opponent.

My father is also a Xiangqi fan and used to play this game when he was younger. I found his disk and played it a little myself. It came out in 1992, the same year I was born.

Rebuilding a Lost iOS Game: From Screenshots to Reverse Engineering to AI

Sun, 06 Sep 2026 00:00:00 -0400

My wife used to play an iOS puzzle game called Block Crush Blitz. When we wanted to install it on a new iPad in march 2026, we found that it was no longer available in the App Store. She liked the game, and it did not look too complicated to recreate. So I decided to give it a try. Happy wife, happy life.

I started by asking Claude to rewrite it from screenshots. That got us a working game quite quickly, but some of the pieces were different from the original. To figure out which pieces should actually appear, I eventually had to download the old app, buy an iPhone, jailbreak it, and reverse engineer the executable. Then I got distracted by another idea: how well could an AI play this game?

Windows Age APIs Can Expose Your Date of Birth to Apps

Fri, 04 Sep 2026 00:00:00 +0000

TL;DR

Windows’ new age API is supposed to give an app only your age range
The current implementation first obtains your date of birth, then calculates the range inside the requesting app’s process
The requesting process can intercept the token or DOB

The API returns a range—but that is not the whole story

Windows Latest recently reported that Windows 11 will allow apps to request an age range without receiving the user’s birthday. Microsoft’s documentation describes GetUserAgeRangeAsync, which returns ranges such as 13–15, 16–17, or 18+.

Bring Your Own Trusted Caller (BYOTC): A New Way to Exploit Vulnerable Windows Drivers (Part 1)

Thu, 03 Sep 2026 00:00:00 -0400

Bring Your Own Vulnerable Driver (BYOVD) is a familiar Windows attack technique: an attacker loads a legitimate, signed driver and abuses a flaw in it to gain kernel-level capabilities. Microsoft maintains a vulnerable-driver blocklist to make this harder, while the community-maintained LOLDrivers project catalogs known vulnerable and malicious Windows drivers.

But sometimes the dangerous capability is intentional. A security or system-inspection driver may legitimately need to terminate processes, open privileged handles, or resist interference. Removing that functionality would break the product, so the driver must instead decide who is allowed to request it. Vendors therefore add caller authentication:

How Zoom Detects Google Meet Without Microphone Access

Wed, 02 Sep 2026 00:00:00 +0000

TL;DR

Zoom can notice that Google Meet, Teams, Slack, and other applications may be in a meeting and offer to start My Notes
On macOS, Zoom monitors Control Center’s sensor-indicators log stream
The messages contain records such as [mic] Google Chrome (com.google.Chrome)
Zoom extracts an application identity and detects when microphone use starts or stops
On Windows, it obtains equivalent application-usage information from the per-user Capability Access Manager microphone records in the registry
Reading this metadata requires neither administrator/root privileges nor Zoom microphone permission

Microsoft Teams Can Detect Recording Apps and Notify Other Participants

Mon, 31 Aug 2026 00:00:00 +0000

TL;DR

Teams has a feature that can detect third-party recording and AI note-taking applications during a meeting
On Windows and macOS, it enumerates running processes every 30 seconds and compares their names with a classification table
The local user sees the detected application name
Eligible meeting participants are told which participant may be recording, but not which application was found
Separate Microsoft telemetry contains the matched app name, type, and risk level
Microsoft can update the table remotely through its Experimentation and Configuration Service (ECS)
It only runs in meetings where the host organization’s policy enables it; the default is off
This detector is separate from Teams’ “Prevent screen capture” feature

How Windows UCPD Grew from a 29 KB Registry Filter into a 196 KB Policy Engine

Sun, 23 Aug 2026 00:00:00 +0000

TL;DR

I collected 38 UCPD.sys binaries representing 24 versions
UCPD first shipped in August 2023, seven months before its public discovery
It grew from a 29 KB browser-association filter into a 196 KB registry and process policy engine
Later versions added ACL, rename, injection, UI Automation, backtrace, and dynamic-rule defenses
Versions 4.4–4.7 added cross-device resume, gaming, FeatureV3, and an expanded deny list

Going backward

My recent article examined how the Dynamic Rules (DR) work in the UCPD driver, and earlier research by Christoph Kolbicz, Gunnar Haslinger, and me captured individual stages of its development. The remaining piece was to track how the driver evolved over time.

Microsoft Paint and Photos Embed Server-Issued GUIDs as Invisible Watermarks in Locally-Generated Images

Fri, 21 Aug 2026 00:00:00 +0000

TL;DR

Microsoft Paint supports both local and cloud image generation
Paint and Photos also ship local AI models
The two apps send the prompt to a remote server for moderation
The server returns a GUID along with the moderated prompt
The GUID is embedded into the locally generated image as an invisible watermark
A separate visible-watermark setting does not control this invisible watermark
On Copilot+ PCs, image generation is local but prompt moderation remains remote
Microsoft discloses that Paint adds C2PA metadata to AI-generated images
AI-generated image saves limited to C2PA-preserving formats: PNG, JPEG, GIF, and .paint

Windows' Performance Optimizer Is More Capable Than It Needs to Be

Sun, 16 Aug 2026 00:00:00 +0000

Earlier this month, a post on X went viral by claiming Microsoft had quietly slipped a spy into Windows 11:

MICROSOFT ADDED A NEW BACKGROUND SERVICE TO YOUR PC IN WINDOWS 11. It is called Windows Health and Optimized Experiences. It starts automatically every time you boot. It monitors your CPU, thermals, and battery then sends data to Microsoft every 15 minutes.

Enough people believed it that Microsoft’s Scott Hanselman replied personally:

How Sogou Browser Rewrites Search Affiliate Codes

Tue, 11 Aug 2026 00:00:00 +0000

I recently poked at Sogou Browser (version 13.9.6121.400) out of curiosity and found that it rewrites hundreds of affiliate codes in Baidu or Sogou search URLs. Specifically, there is a list of search affiliate codes hardcoded in the binary, and when one is seen, it is replaced. The search engine only ever sees the substituted code — the original never reaches it.

Affiliate codes, briefly

If you have looked closely at a Baidu search URL you have seen something like this:

Freeing Dev Hunter from Excel 2000

Sun, 19 Jul 2026 00:00:00 +0000

Dev Hunter is a small game hidden inside Microsoft Excel 2000. It was one of the few pastimes I had during the dull computer classes I sat through in high school, and, like all adults who grow nostalgic for the things they had when they were young, I eventually went looking for it again.

This post is the whole story of chasing it down: first getting the game to run on its own outside of Excel, and then — years later — freeing it completely, into a standalone program that carries nothing of Excel with it at all.

What is LG Monitor App Manager actually doing?

Sat, 18 Jul 2026 00:00:00 +0000

I recently bought an LG 34-inch UltraWide monitor. The screen itself works great — no complaints there. But a little while after setting it up, I started to notice this LGMonitorAppManager thing on my machine:

It showed up on its own — I never went to LG’s website and downloaded anything. It just appeared one day, offering to install “Dual Controller” and a few other LG utilities. I did not think about it too much at the time; I clicked the little x and moved on with my life.

Solving a VM Challenge Using BinaryNinja

Sun, 18 Apr 2021 00:00:00 +0000

Recently, my friend Towel created a VM challenge. I have not done any VM crackmes in the last year and decided to try this one. Towel says the challenge should be easy and serves mostly as an introduction for VM crackmes. More importantly, this one has no anti-debugging or static obfuscation, to allow the solver to concentrate on the VM itself.

Preliminary

The main() function is actually quite simple:

Just one function call and a branch, which decides if the player succeeds. The core function looks like what a VM should be:

International Grand Master

Sat, 13 Feb 2021 19:44:00 +0800

I was awarded the title of International Grand Master for Xiangqi in late 2020. I am very excited about this title!

I earned this title since I am the Champnion of the 8th North American Cup. Game records can be viewed online.

The certificate is shown here:

Photo Works

Sat, 13 Feb 2021 00:00:00 +0000

I used to be a keen photographer. I treat photography as a way of expressing my views toward the world. My photos capture both the beauty and absurdity of this world.

However, I have not taken very few photos in recent years. One excuse is I become busy and get obsessed with reverse engineering. But a more convincing reason is I am less interested in this world. The situation might change in the future, though.

My New Blog is Ready!

Thu, 11 Feb 2021 18:46:24 +0800

I spent some time with Hugo and now my blog is hosted on GitHub. Feel free to visit it at xusheng.dev!

I will write about reversing, coding, Xiangqi, and other stuff.

How to Avoid Writing a Bad Crackme

Tue, 29 Dec 2020 00:00:00 +0000

Recently, I was promoted to a reviewer on crackmes.one (along with @zed). I am so honored with this and I appreciate the recognition and trust from @stan (creator of crackmes.one) and the entire community. The task for a reviewer is interesting, that I read submitted solutions and verify new crackmes. This allows me to grasp the latest trend on the website.

I did not tally the statistics, but there is a fairly good amount of new submissions (of both crackmes and solutions) every week. And most of them are nice! For me, crackmes.one is a place for reversers to exchange knowledge and joyfulness. So I am very glad that we see a steady flow of input. Now that we have three reviewers, and I hope an increase in the reviewing speed will shorten the feedback loop for contributors, which, in turn, will lead to more contributions from the community.

Solving Two OCaml Crackmes Without Knowing Much about OCaml

Sun, 13 Dec 2020 00:00:00 +0000

Earlier this year, my friend Towel uploaded two OCaml crackmes to crackmes.one. One of them is Baby OCaml, and the other one is called Teenager OCaml. Well, interesting names!

This is not the first time Towel came up with OCaml crackmes. Qt Scanner, rated as level 5, is a hard challenge. I attempted that, but have not succeeded yet. So, when I first saw these two new OCaml challenges, I am not very eager to try them, despite they are rated as level 1 and 3. Nevertheless, we cannot hide from challenges forever, so I decided to try it last week. And the outcome is good, I managed to solve them without digging deep into the OCaml runtime.

Deciphering a Windows Anti-debugging Challenge

Sun, 29 Nov 2020 00:00:00 +0000

It has been a long while since I last wrote about anything. We try to post something every week, but it has been, at least for me, super busy recently. So sorry for the gap. The good news is I am going to post several writeups recently.

This time I am writing about the challenge ReverseMe3 from jochen_. The challenge can be found on crackmes.one. The password to unzip is “crackmes.one”.

Dealing with Manipulated ELF Binary and Manually Resolving Import Functions

Sun, 30 Aug 2020 00:00:00 +0000

Unfortunately, this writeup is delayed for almost a week because I am super busy recently. Please take my apologies and I will try my best to keep the weekly challenge going, forever!

The challenge can be downloaded at https://crackmes.one/crackme/5e727daa33c5d4439bb2decd. It is created by user BinaryNewbie, who is NOT a newbie for binary reversing.

We will discuss an important topic in this writeup: how to mutate binary executable to obstruct reverse engineering tools. Specifically, these techniques aim to fool the binary parsers so that they fail to parse the binary or the parsing result is missing important information. In the worst case, the binary crashes the analysis tool. For convenience, we will call these techniques Executable Format Manipulation (EFP).

Making and solving a Reversing Challenge Based-on x86 ISA Encoding

Sun, 02 Aug 2020 00:00:00 +0000

This time the writeup is a little bit different – I am the maker of this challenge so the narrative is from a different perspective. I will first cover how I made it, and then show two possible ways to solve it.

The Plan

I have always been hoping to make some reversing challenges based-on the encoding of the x86 instruction set. It does not have to be super hard, maybe just explore some interesting aspects of the x86, which goes lower than the disassembly. Recently, thanks to my intern task that lifts x86 instructions, as well as reading this blog post, I decided to do it rather than set it for the future (indefinitely).

Solving a Recursive Crackme by Automating GDB

Mon, 27 Jul 2020 00:00:00 +0000

The last week’s challenge is called Recursion. From the name we already expect to do some automation – manually solving stuff recursively is not a wise idea.

First Impression

The forum probably does not allow users to post binary files, so challenges are all posted as base64 encoded. There are too many ways to restore the binary, but Binary Ninja saves you from remembering the command: Just copy the encoded text, create a new empty binary, and then click “Paste From” -> “Base64”. Then you are done!

Solving an Obfuscated Crackme with BinaryNinja and Triton

Thu, 02 Jul 2020 00:00:00 +0000

The last week’s challenge was created by Dennis Yurichev. It is also hosted on crackmes.one. The challenge is compiled by a modified Tiny C Compiler (TCC) which obfuscates the generated code during compilation. We will cover the major techniques to deobfuscate the binary, followed by a quick analysis of the algorithm itself.

First Impression

The target (keygenme4.exe) is a PE. The entry point looks like this:

There are several things which we can notice easily:

Examining the difference between C program and Assembly -- An Example of << and shl

Sat, 20 Jun 2020 00:00:00 +0000

Encountering a Weird Issue

Recently, I needed to write one function that returns a bitmask according to the number of bits. Basically, if the input is 8, it should return 0xff. The input n is in the range of 0-64 (both side include).

The first idea is to use left shift and then minus 1:

uint64_t getBitMask(size_t n)
{
    uint64_t ret = (1UL << n) - 1;
    return ret;
}

This works well when n is in the range of 0-63. However, when n is 64, the code returns 0 instead of 0xffffffffffffffff.

Solving an ARM challenge with z3

Thu, 18 Jun 2020 00:00:00 +0000

First Impression

The last week’s challenge is hosted at https://crackmes.one/crackme/5edb0b8533c5d449d91ae73b. It is authored by Towel and it is a real challenge in UMDCTF 2019.

Loading it into BinaryNinja reveals that it is an ARM binary. Not very surprised as its name is armageddon. ARM is no longer special for me as I gradually become familiar with the ISA. After all, it is simpler than the x86 and those frequently used instructions are easy to understand and remember.

Debugging and Solving an Android Challenge

Sat, 30 May 2020 00:00:00 +0000

Our first challenge is an Android challenge that features native library reverse engineering and debugging. Since the algorithm itself is not very complex, in this writeup I will cover the major steps to set up an Android debugging environment. I will also share some of my thoughts as we progress.

First Impression

The challenge is created by Quarkslab. The crackme-telegram.apk is ~25MB in size which is larger than a typical crackme. One of the challenges in real-world reverse engineering is the huge size of the binary. There are too many possible places to hide the crucial code so even finding it is non-trivial in the first place.

Solving a Reversing Challenge with Mitmproxy and OCR

Mon, 27 Apr 2020 00:00:00 +0000

Over the weekend I had some fun with the Houseplant CTF. Among the reversing challenges, the RTCP Trivia is particularly interesting and I would like to share my unconventional way of solving it.

First Impression

We get a client.apk after downloading the challenge. I have no Android phones so I ran it in an emulator. It has no ARM native library so it runs well in x86 emulators.

After asking for a user name, the app presents a multiple-choice problem with four options (shown below). The problem itself is not difficult. However, there is a ten-second countdown and we must answer it before the time elapses. The challenge description says that we need to correctly answer 1000 such problems. So manual solving is probably not a wise idea.

Reverse Engineering and Repairing a Fan

Sun, 26 Apr 2020 00:00:00 +0000

Last summer, I broke a fan and managed to repair it. Although the repairing process is not so exciting, I recently find it can serve as a good example to explain a reverser’s mindset. Like how I approached the problem and solved it. I hope to share some of my understanding about reverse engineering in this writeup.

A Broken Fan

I have a fan – an eight-year-old fan – that is NOT smart or IoT. It is just a simple fan. One day it fell from the table to the ground and stopped working. RIP. It accompanied me for several summers and I love it. I decided to take it apart and see what is indeed broken, before saying farewell to my friend.

排局-20

Sun, 06 May 2018 16:19:08 +0800

车八退一士４进５
车八平六士５进４
炮八进九马５退４
炮八退三马４进３
马九退七将５平４
兵四平五炮７平５
炮八进三象３进５
兵五进一将４进１
炮八退一

排局-19

Sun, 06 May 2018 16:10:59 +0800

炮六平八士４进５
马四进五! 士５进４
马五进六!

排局-18

Sun, 06 May 2018 16:06:56 +0800

兵六平五炮７平５
兵三平四马５退６
马一进二车７退７
炮七进一士５退４
马四进六士４退５
炮七退七

由此红方转为进攻黑方底士，此亦本局取名《峰回路转》之意。

…… 车７平８
炮七平六车８进６
炮六平二马８退７
炮二进一马７进９

如马7退6，炮二平四，困毙红胜

炮二平六马９进７
帅四退一马７退８
帅四进一马８退７
帅四退一马７进５
帅四进一马５退４
炮六进一马４退３
炮六进三马３退２
炮六进二红胜

排局-17

Sun, 06 May 2018 15:31:13 +0800

帅六退一士５进６
兵五平四将４退１
炮五平七将４进１
炮七平四将４平５
炮四退一将５平４
炮四平五士６退５
兵四平五士５退６
炮五进一士６进５
炮五平六

排局-16

Sun, 06 May 2018 15:30:08 +0800

兵九平八将４进１
兵八平七将４退１
帅五退一象３进１
马七进八象１进３
兵七进一将４退１
马八进七象３退５
兵七平六将４平５
马七退五车１退１
仕六退五车１平４
马五进四将５平６
兵六平五车４退２
马四进二

排局-15

Sun, 06 May 2018 15:27:58 +0800

排局-14

Sun, 06 May 2018 15:25:19 +0800

车四平六将４平５
车六平五将５平６
相五进三车７平６
车五平二将６退１
帅五平六车６平９
车二进五将６退１
车二退八车９平７
车二进三车７平９
帅六进一车９进１
帅六进一车９平２
帅六平五车２退２
仕五进六车２退６
车二进六将６进１
车二退一将６退１
车二平八

排局-13

Sun, 06 May 2018 15:23:59 +0800

炮九平六士５进４
仕六退五车４平５
炮六平八卒６平７
炮八退八卒７平６
帅五平六士４退５
炮八进四卒６平７
炮八平五卒７平６
炮五平一卒６平７
炮一退四卒７平６
相九进七将６进１
相七退五将６退１
炮一进四卒６平７
炮一平八卒７平６
炮八退四将６进１
仕五退四车５平６
炮八平四

排局-12

Sun, 06 May 2018 15:21:12 +0800

马七退五将６退１
马五进三将６进１
马三退一士５退４
前马退二将６退１
马一进二将６平５
帅五平六象５进７
后马退四象７退９
马四退二将５进１
后马进三将５平６
马三进二将６平５
后马进四象９进７
马四退三将５退１
马二退一象３进５
马一进三将５平６
前马进二将６平５
马二退四象５退３
马四退五象７退９
马五进七

排局-11

Sun, 06 May 2018 15:19:51 +0800

马六退七将５退１
马七进八象１进３
相九进七象３退１
帅四退一象１进３
相七退五象３退１
帅四平五象１进３
帅五平六象３退１
帅六退一象１进３
炮九退一将５进１
马八退七将５平６
马七进六将６平５
炮九退七将５退１
炮九平五象３退５
相五进七象５进７
马六退五象３进５
马五进三将５平６
炮五进八

排局-10

Sun, 06 May 2018 15:09:32 +0800

排局-09

Sun, 06 May 2018 15:05:02 +0800

车五退一炮５进６
兵五平四卒９平８
相三退一象７退５
后兵进一炮５退４
后兵进一卒６平５
帅五平四

第一步只有车五退一可以获胜

排局-08

Sun, 06 May 2018 15:01:11 +0800

2b6/9/3k5/9/6b2/6B2/9/3A5/4AK3/p4CB1p w

如图形势，红方当然可以连续打掉两个黑卒。但这样黑方得以调整阵型，红方无法取胜。

正确的走法是借叫杀之机，调整士相，将黑方双象赶到两边，进而获胜。

炮四平六将４平５
炮六平五将５平４
仕五退四将４平５

如改走将4退1，则帅四平五，红必得象，胜定。

相三退五将５平４
相五进七将４平５
仕四进五将５平４
炮五平七

驱黑象到边线。

…… 象３进１
炮七平六将４平５
炮六平五将５平４
仕五进四将４平５
相七退五将５平６
帅四平五将６平５
帅五平六

红帅移行换位。

…… 将５平４
相五进三将４平５
仕六退五将５平６
仕五退六将６平５
相三进五将５平６
相五进七将６平５
仕六进五将５平６
炮五平三象７退９

再驱另一象到边线。

帅六进一将６退１
帅六平五红胜。

排局-07

Sat, 05 May 2018 23:18:22 +0800

4ka3/9/5a3/6CC1/9/9/9/3K5/9/8c w

如图形势，红方仅有双炮做攻，似乎难以进取。

第一步的进攻方向很是重要，如果沉底叫将，则与胜利失之交臂。

排局-06

Sat, 05 May 2018 22:21:07 +0800

3r1r3/5k3/3a1a3/4C4/9/9/9/C8/5K3/3A5 w

如图形式，红方双炮巧妙腾挪，迫使黑方子力自相堵塞，最终一举获胜。

此局的进攻思路比较直接，运炮叫将，利用黑士自相阻塞，重炮或者闷宫而胜。

炮九平四将６平５
炮五退六！

红方退炮引而不发，伏有士六进五，将5平4，炮四平六，士4退5，炮五平六重炮杀。黑方只有先将5平4才能解杀，红方则士六进五追杀：

…… 将５平４
仕六进五士４退５

黑方退士也是仅有的解着。如图形式，直观的攻法是架炮做杀，但均难以奏效。试演两变如下：

炮四平六将４进１
帅四进一车４平３
帅四平五车３进９

红方无杀，黑方胜势

炮五平六将４进１
仕五进六将４平５

红方无杀，黑方胜势

正确的走法是先士五进六做准备。细看之下，其实这是叫杀，演变如下：

仕五进六车４平３？
炮五平六士５进４
仕六退五将４平５
炮六平五将５平４
炮四平六士４退５
炮五平六重炮胜

此路攻法虽是连杀，但需要来回运炮，粗看之下不易发现，可以算作此局的核心。

仕五进六扬士之后，黑方无暇挪车。最顽强的防守是先将4进1，当然红方辗转腾挪，攻势依然紧凑：

仕五进六将４进１
帅四平五！将４退１
炮五平六士５进４
帅五平四！

以上着法，红方先进帅做杀，逼黑方下将，而后平炮打将，待黑方扬士时候再出帅，次序井然。注意此时红方仍然威胁士六退五然后连杀。

…… 将４平５
仕六退五将５退１

红方出帅，黑方顺势占中解杀。然而红方一手士六退五继续做杀，此时四六两路均已被控制，黑方只有坐将求生，但仍难免被重炮：

炮六平五士６退５
仕五退六士５进６
炮四平五

从开始的局面看，谁又能想到最后黑将会在原位被擒住呢？

排局-05

Fri, 04 May 2018 17:13:21 +0800

6R2/3r5/3kr4/9/9/9/9/5C3/4A4/3A1K3 w

如图，红方似乎可以车三退三叫杀得车．可红方的取胜之路真的如此简单嘛？

显然不是这样简单–不过黑方的应对也可谓奇思妙想:

车三退三车５退１!

一着花心车龟缩防守，红方也暂时无计可施．此时平车打将会自找麻烦，因为黑方平将躲避后会形成兑车，红方反而不好处理．不过借打将之机调整炮位，进而扬士叫杀似乎是可行之策．

车三进一车５进１
炮四进五车５退１
炮四退六车５进１
车三退一车５退１
仕五进六

此时红方伏有炮四平六，将４平５，车三平五的杀着．黑方不能车５平６牵炮，因为红方车三进一绝杀．其他解杀手段均会丢４路车．看似红方已经取得了胜利，但这真的是黑方最顽强的抵抗嘛？非也！惯性思维导致黑方在第５回合还是退花心车，但此时红炮的位置已经挡住了自己的老帅，所以黑方可以车５平８反杀！

５．　　　　车５平８！

此时红方无暇抽车，只有借打将之机先占中路，然后进帅做杀：

车三平六将４平５
车六平五将５平４
帅四平五

此时黑方有两种防守方法，均难逃一败：

…… 车４平８
仕五退四前车进１
车五进一将４退１
炮四平六前车进５

此路变化黑方双车并线，与红方邀兑．无奈红方借先手打将，进而运炮卡位，胜势已成．前车进５是比较顽强的防守．如果后车进１？则车五进一！将４退１，车五退四，红胜定．注意这里车五进一的过们是必须的，如果直接车五退三，黑方有前车进２！红方车五平六，黑有后车平４，反而节外生枝．

仕六进五后车进５
车五退一后车退４
车五退三

以上几步红方顿挫井然，如下图形势，黑方如果动前车，则红方士五进六得车胜．黑方如果动将或者移动后车，如将４退１，红方仍有士五进六，弃炮绝杀！以下黑方前车平４，车五平六，车８平４，车六进四绝杀红胜．

此路变化，黑方竖向连车难以抵挡红方进攻，如果改为横向会怎样呢？

…… 车４平７
仕五退四将４退１
炮四平六车７进１
车五平六车７平４

此路变化黑车会被红方栓住，但以炮换车红方只能得到和局，所以红方并不会轻易交换．

仕六进五车８平５
炮六退一　红胜定

红方士六进五，暗伏车六进一，将４进１，士五进六绝杀．黑方不能简单车８进１弃车解杀，否则仍是车六进一，将４进１，士五进六，红得车亦胜．

从最初的车三退三看似一步即胜，到后来的占中，架炮，红方的取胜之路可谓曲折．

排局-04

Fri, 04 May 2018 16:00:41 +0800

1R1ara3/9/4k4/9/2b6/6B2/9/5K3/7p1/9 w

如图形势，红方进攻子力仅有一车，如何才能利用黑车的位置取得胜利？

最直观的思路并不能奏效：

车八退三士６进５
车八平五将５平４
帅四平五将４退１
车五平六士５进４

虽然黑方篡位车位置尴尬，但这样直接叫吃还是太过急躁．同样，如果直接车八退八，确实可以吃掉黑卒，但红方并不能取得胜利．

正确的走法是先将黑将打到二楼，然后退车捉卒：

车八退二将５退１
车八退六

此时黑方虽然没有丢车之虞，但也无法疏通子力．当然不能回中象，否则红方车八进七绝杀．将５平４躲避会被红方车八平六先手带将吃掉卒，上将则会送车．所以黑方只有躲卒．这里有一个小陷阱，就是黑方卒８平７送吃：

…… 卒８平７
车八平三象３退５
车三平八将５平４

红方无法取胜，和棋

红方急于吃卒，但车被自己的高相挡住，黑方侥幸某得和局．细看之下，死卒不急吃，红方没有必要立刻杀卒，可以先落边相给车通头．

相三退一

接下来，黑卒走投无路，红方可以将其吃掉并且保持车通头，已成胜势．具体的胜方可以参考后文着法．

黑方较为顽强的抵抗是卒８进１沉底：

车八退二将５退１
车八退六卒８进１
车八退一卒８平７！
相三退一卒７平６！

黑方先将卒沉底，然后平移进入红方九宫，如入无人之境．红方为了保持车通头，竟然不能简单将其杀掉．如下图形势，红方如帅四退一捉卒，黑方可以卒６平５占中！红方车八平五杀卒叫将则象３退５，进而某得和局．

那红方怎样才能取得胜利呢？这里红方需要切换一下进攻思路，不再用车捉卒，而是采用排局中常见的捉弄底卒的方式来将其擒获．正着初看之下有点不可思议，红方不仅不吃卒，还主动抬车；并且抬车的方式必须是车八进三或进四，连看起来更有威胁的车八进六都不行：

车八进三卒６平５
相一进三卒５平４
相三退五卒４平５
帅四退一卒５平４
帅四退一

以上着法对于排局爱好者并不陌生，首先运相回中路让黑卒无法离开九宫，然后下帅挤掉其仅有的活动空间．此时黑方只有动将，而对红方来说，取得胜利已经不再困难：

…… 将５平４
车八平六将４平５
车六进三卒４平５

红方叫将后进车点穴，黑方无子可动．其实黑方的高象也是有意为之，如果黑方是底象，没有这一手塞象眼，红方还是无法取得胜利．此时只有方弃卒一搏，不过仍难免一败：

帅四平五将５平６
车六平四将６平５
帅五平四将５平４
车四平六将４平５
相五进七　红胜定

如果黑方先出将，则红方先车八平六叫将然后车六进三点穴．黑卒还是会被困死．细心的读者可能已经发现前面为什么只能车八进三或进四，不能直接进六．否则，由于不需要进车点穴，差了一步棋．换句话说，最后单双步不对，并不能困死黑卒．

排局-03

Thu, 18 Jan 2018 20:47:50 +0800

2rr5/9/3a1k3/3P5/2R6/2B6/9/9/3K5/9 w

如图，黑方将位不安，且双车略背，红方如何凭借先行之利取胜？

按照惯例，首先分析一路不成熟的攻势，打将之后占中做杀：

车七平四将６平５
车四平五将５平６
帅六平五车４平５
兵六平五将６退１

红方平兵继续叫杀，黑方当然不能直接车5进3砍兵，否则红方顺势车五进一吃掉之后即是绝杀。黑如车3进4弃车解杀，则红方兵五平四之后吃掉底车，仍是胜势。黑方下将正着，红如兵五进一，黑方便可以车5进2某得和局。

车五平四将６平５
兵五进一将５平４
车四进三将４退１

红劣黑胜

黑方下将是一步容易被忽略的着法。最初算到这里的时候我以为黑方只能落士，红兵五进一之后由于黑车低头，形成巧胜。不料黑方有此着躲避，从而反败为胜。所以红方正确的攻法是打两将之后平兵叫杀：

车七平四将６平５
车四平五将５平６
兵六平五将６退１

黑方当然不能士4退5打将，否则红方帅六平五占中之后，黑方速败。

兵五进一将６退１
车五平四将６平５
车四平二将５平６

此时红方走不到兵五平四做杀，因为黑方可以士4退5带将抽掉。又不能帅六平五，否则黑方车3进5弃车杀相可以谋和。红方攻势暂时受阻，怎样才能打开局面呢？

车二进四将６进１
车二退五将６退１

红方借叫杀之机保住自己的高相，使得黑方杀相谋和的计划落空。但此时平帅黑方还是可以车3进4通头，下步即可以抢占中路，红方似乎还是难有进取。

帅六平五车３进４

如图形势，红方有两路较为直观的攻法，但都难以奏效：

兵五平四车４平５！
相七退五车３进４
帅五退一车５进７黑胜

黑方车4平5妙手，粉碎了红方的攻势，一举反败为胜

车二平四将６平５
帅五平四士４退５
车四进四车３平６!
车四退三车４进８
帅四进一车４平５
相七退五车５进１!
帅四退一车５退２

黑方弃车照将的手法颇有排局味道，且即使红方落相盖车，黑方还是有沉底车的冷手，最终谋得和局。

排局-02

Thu, 11 Jan 2018 23:08:29 +0800

rr1ak4/9/9/9/9/9/9/5K3/R8/3AC4 w

如图，双方子力不多，且黑方双车通头，红方怎样才能借先行之利取胜？

初看之下，红方虽有空头炮，但黑方双车相连，抽将也得不到便宜。且边线双车对头，所以红方第一步究竟要不要打将就是值得思索的问题。如果打将，黑方必定士4进5，等红车再次打将离开中路，黑方可以有针对性的支士落士，红方难以进取。但若是不打将，则只有平车躲避，此时黑方可以进车打将，似乎很快可以化解红方尚不成熟的攻势。

当然，红方还是可以先车九平三叫杀（伏士六进五，士4进5，车三进八杀）。此时黑方并不能打将抽车，因为车2进7，帅四退一，车2进1? 士六进五，反将红胜。简单上将并不能解杀：

车九平三将５进１
车三平五将５平４
车五平六将４平５
仕六进五红胜

所以将5进1的走法是错误的。那黑方怎样才能化解红方攻势呢？看来只有先车2进7打将，红方必定帅四退一躲避。此时再将5进1，红方没法平车打将，是不是可以守住呢？非也，此时红方可以从竖线进攻：

车九平三车２进７
帅四退一将５进１
车三进七将５进１
仕六进五将５平４
车三退二红胜定

可惜，红方的胜利是建立在黑方的失误之上，当然正解也绝非寻常着法：

车九平三车２进７
帅四退一车１进９

黑方一手车1进9（亦可车2进2），明为送，实为捉，红方不能炮五平九，否则车2进1抽车黑速胜。因炮被牵制，士六进五也不成，所以红方只能车三进八借打将之机先吃一车。

车三进八将５进１
炮五平九

此时红方不仅净多一炮，且底车先捉黑士，怎么看黑方也是败势难逃。但黑方自有妙计：

…… 车２进１
帅四进一车２进１

黑方车2进1打将，迫使红帅定位。红方如果帅四退一下帅，黑方则车2进1捉双，随后车2平4吃士，然后车4平5占中成单车守和车炮之势。红方不肯，只好帅上三楼。黑方随即再度进车捉双。为什么黑方不直接车2进2捉双呢？这里按下不表，稍后揭晓。

炮九进九车２平４
车三平五将５平４

排局-01

Thu, 11 Jan 2018 23:04:07 +0800

9/9/5k3/9/9/9/9/4BA2B/3K5/3A3Cc w

如图局面，是我不久前从残局库中发现的一个挺有意思的局面，红先胜。

分析：

从初始盘面来看，双方各有一炮，红方有士相，黑方仅光将且在三楼，估计是要在困炮的同时调整阵型，最后白脸将杀。

最直接的思路是打两将之后扬相，然后帅占中路做杀。但黑方有一手叫闷可解：

炮二平四将６平５
炮四平五将５平６
相五进三将６平５
仕六进五将５平６
帅六进一炮９平８

此路虽不通，但红方另有一路攻法，就是先上帅，然后再运炮做攻。由于红炮占位，黑方走不到炮9平8，形势十分不妙。将如6平5红方则顺势炮二平五打将。炮9退1也难挽颓势：

帅六进一炮９退１
炮二平四炮９平６
帅六退一将６平５
炮四平五将５平６
帅六平五炮６进１
相五进七将６退１
帅五进一将６退１
仕六进五炮６退１
炮五平四将６进１
仕五进六将６进１
帅五退一捉死炮胜

当然，这则排局并非如此简单。黑方炮9退1不是应对帅六进一的最顽强走法。黑方有一手将6退1可以某得和局。下将后，红方当然不能急于炮二平四打将，否则黑方可以从容炮9平8再炮8退7防守。于是红方只有先飞相，但无论红相往哪边去，黑方都有妙手化解。

如图形势，如红飞三七高相，则黑方炮击底士，而后绕回防守，红方无计可施：

相五进七炮９平４
炮二平四将６平５
炮四平五炮４平２

如红落相，黑方当然不能打士（否则炮被困死）。正确走法是将6平5占中：

相五退七将６平５
仕六进五炮９平３
炮二平五将５平６
帅六平五炮３退７

红方自己落下来的底相被黑方打掉然后借机回防，也是十分有趣。

那正确的攻法是什么呢？还是先从运炮入手：

炮二平四将６平５
炮四平五将５平６
相五进三将６平５
仕六进五将５平６

红方直接上帅并不能奏效，但这里如果46路的子力调换一下，红帅在4路，士和黑将在6路，则黑方无法借助炮9平8防守。但红方怎样才能调整阵型，达到上述目标呢？且看后续着法：

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Email (preferred): xusheng@vector35.com
Discord: xusheng
GitHub: xusheng6
X: @CrackmesOne
LinkedIn: Xusheng Li