代码注入不好吗？
有一些相当强大的工具，例如 SIMBL 或 Airfoil/Instant Hijack 使用代码注入。
据我了解，这些工具将自己的代码注入其他程序中。 这个想法对我来说听起来很危险，因为这似乎有可能使完全稳定的软件变得脆弱和“有缺陷”。 这似乎也带来了安全风险。
出于稳定性或安全原因是否应该避免使用这些工具？
There are some fairly powerful tools like SIMBL or Airfoil/Instant Hijack which use code injection.
As far as I understand this, these tools inject their own code in other programs. This idea sounds dangerous to me as this seems to have the potential to make perfectly stable software fragile and "buggy". Also this seems to pose security risks.
Should these tools be avoided for stability or security reasons?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这取决于您使用它的目的以及所注入代码的质量。 可以有完全稳定的注入代码。 事实上，当我以前开发第三方游戏反作弊软件时，代码注入是其中很大一部分，我经常能够通过消除原始游戏开发者从未修复过的错误和漏洞来使游戏更加稳定。不再支持该游戏。
另一方面，我可能会对将第三方代码注入企业安全、审计或会计软件持怀疑态度。
It depends on what you're using it for and the quality of the code that is being injected. It's possible to have perfectly stable injected code. In fact, when I used to develop third party anti-cheat software for games, code injection was a big part of it, and I was often able to make the games more stable by eliminating bugs and exploits that the original game developers never fixed and no longer supported the game.
On the other hand, I would probably be skeptical of injecting third-party code into enterprise security, auditing or accounting software.
我相信它不仅仅指用于黑客攻击或破解系统的某种代码注入。
这也是 Java 世界中经常使用的技术，使用诸如 AOP 或 IPOjo。
当它们有意义时，它们会补充当前的代码，从而允许它们：
只要初始代码可以在没有代码注入的情况下运行，稳定性不是一个问题。
稳定性和安全性（在代码注入的这两种善意用法的情况下）应该在单独的测试代码中评估注入代码的稳定性和安全性。
I believe it does not just refer to that kind of code injection for hacking or cracking a system.
It is also a technique often used in java world, with tools like AOP or IPojo.
When they make sense, they complement the current code, allowing them:
As long as the initial code can run without that code injection, the stability is less an issue.
Stability and security - in the case of those two benevolent usages of code injection - of the injected code should be evaluated in a separate test code.