From that same post: > The interesting thing here was how the program decided where to install its patches, and in particular how it managed to patch an functi

From that same post: > The interesting thing here was how the program decided where to install its patches, and in particular how it managed to patch an function that was never exported or stored in a vtable: It found the function by contacting the Microsoft symbol server to get the names of all the functions in Explorer and their addresses! I don't think anyone would make a program do hacky binary patching like that just for fun. Presumably, they did it that way because Microsoft doesn't offer any reasonable way to accomplish the same functionality. If enough people used the hacky binary patch that it produced a noticeable spike in crashes, then I do blame Microsoft for making it necessary in the first place.