A bloated new Windows, cleaned up properly — in one double-click.
A new PC comes with ads in the Start menu, apps you never asked for, and switches that send your usage data to Microsoft. This tool runs one fixed, tested cleanup for all of it.
Before it changes anything, it saves a way back. When it finishes, it shows you a measured report card — not promises.
中文版在下方：跳到中文版
- Your Start menu shows ads and "suggested" apps you never asked for.
- Games, shopping apps and trial software come pre-installed. Removing them one by one eats an evening.
- Windows sends usage data to Microsoft by default. The switches to stop it are buried across five different settings pages.
- You turn something off. The next Windows update quietly turns it back on.
- A free cleanup tool shows you 200 checkboxes. Tick the wrong one and something breaks — with no way back.
- Another "optimizer" wants a yearly fee, shows ads, and installs extra junk of its own along the way.
You make no choices. The cleanup set is fixed, and it was tested as a set. You double-click, approve the admin prompt, and wait.
It saves a way back first. Before the first change, the tool creates a restore point — a snapshot of your system that Windows can return to. If that snapshot cannot be created, the tool stops and changes nothing.
It tidies what people actually notice. Ads and suggestions off. Data-collection switches off. Pre-installed promo apps removed. Background services you don't need put to sleep.
It proves its work. After each change, the tool reads the setting back and checks it is really there. A command that merely "ran fine" is not proof, and this tool does not treat it as proof.
It reports with numbers. At the end you get a scorecard: boot time, memory use, running processes, start-up entries, and installed app count — before and after, measured on your own machine.
Failure is loud, never hidden. If a check fails, the run stops and says so. This tool never writes "done" next to something that did not happen.
Undo is one click. A restore file is left on your desktop. Run it, and every change unwinds in reverse order.
Interactive tweak tools — WinUtil is a good one — hand you hundreds of switches and let you pick. That is real power if you know every switch.
If you don't, you are gambling. And the set you picked was never tested as a set.
This kit is the opposite bet: one fixed set, chosen and tested together, where you choose nothing and every change has an undo.
Scattered debloat scripts are usually one person's list, written for one person's PC, passed around forums. Many make no restore point.
Many also print "done" even when a step failed. You find out weeks later, when something you use turns out to be missing.
This kit makes the restore point first, checks every change by reading it back, and fails loudly when a check fails.
Paid optimizer software usually means a subscription. Some titles show ads or push upgrades. Some collect usage data of their own.
This kit is source-available — the source is public to read, and it is free for personal and noncommercial use. It shows no ads, it collects nothing, and it downloads nothing — ever.
Built for the awkward editions too. The kit runs fully on Windows 11 LTSC — the stripped-down long-term edition many work machines run, which has no Microsoft Store. Nothing here needs the Store, and nothing here needs the internet.
| Interactive tweak tools | Random debloat scripts | Paid optimizers | This kit | |
|---|---|---|---|---|
| Restore point before changes | Your job to arrange | Often skipped | Varies | Always — or it refuses to run |
| Choices you must make | Hundreds of checkboxes | None, but no checks either | A few | None — one fixed, tested set |
| Proof it worked | You check it yourself | "Done" printed either way | Its own dashboard | Measured scorecard; every change read back |
| When something fails | A line in a log | Often silent | Varies | Stops, and says so |
| Price, ads, your data | Free | Free | Subscription; ads are common | Free; no ads; collects nothing |
We ran this on a fresh test machine and published the numbers, good and bad.
The machine: a Windows 11 IoT Enterprise LTSC 2024 evaluation copy running in a virtual machine (VMware Workstation, 8 GB RAM, 4 processors, 80 GB disk), installed fresh on 2026-11-13.
The optimizer's real run: 40 changes applied · 16 skipped by design · 0 failed · 0 warnings. A restore point was created and confirmed first. 11 background services were trimmed. Your power settings' original values were written down before anything touched them, and the one-click restore file was left on the desktop.
The pilot machine after both suites ran: Docker Desktop and Tailscale resident, the input-method indicator in the taskbar.
| Metric | Before | After the run (same boot) | After reboot + the installer ran too |
|---|---|---|---|
| Boot to desktop | 53.9 s | 53.9 s (re-measured after reboot) | 53.9 s |
| Memory in use when idle | 1,885 MB (23.0%) | 1,947 MB (23.8%) | 2,008 MB (24.5%) |
| Running processes | 119 | 114 | 130 |
| Start-up entries | 3 | 3 | 7 |
| Installed apps (built-in, provisioned) | 50 (1) | 50 (1) | 54 (1) |
Full artifact: docs/scorecard-pilot.html.
How to read this honestly: LTSC starts lean — 3 start-up entries and no consumer apps at all — so on this edition there is little fat to trim, and the boot time did not move on virtual hardware.
The rises in the last column are the installer's doing, not a step backwards: the setup tool (sister repo) had installed its loadout by then, and those programs keep their own services running.
On a normal consumer Windows 11 — the usual case, with its full load of pre-installed extras — the same run trims far more. The scorecard exists so you never have to take that on faith: your machine prints its own numbers.
The pilot also earned its keep the other way. It found five defects in this suite — including an installer file that popped up a dialog and hung unattended runs, and a check that once recorded a cancelled install as done.
All five are fixed and re-tested. That pattern is exactly why the safety machinery below exists.
A normal run changes nothing. Double-clicking shows you the current
numbers and the full plan. Only a run with -Apply changes anything.
No restore point, no changes. If the snapshot cannot be made and confirmed, the run stops before touching anything.
It never touches the door. Windows Update, Microsoft Defender (the built-in antivirus), and the tools you use to reach the machine from another computer are protected in the code. No list you feed the tool can trim them.
It downloads nothing. The support files it needs are files you place
in the vendor folder yourself. Each one is checked against a recorded
SHA-256 fingerprint before use — a fingerprint is a short code computed
from the file; change one byte of the file and the code no longer
matches.
- Make the config yours. In
config\, copyfleet.example.jsontofleet.jsonandroles.example.jsontoroles.json, then edit them. Place any payload files you use invendor\(seevendor\README.txt); each is fingerprint-checked againstvendor\SHA256SUMS. - Look first. Run
.\Run-Optimize.cmdwith no switches. It changes nothing and prints the whole plan plus your current numbers. - Run it. Run
.\Run-Optimize.cmd -Apply. You get the restore point first, then the cleanup, then your scorecard — and一键还原.cmd(one-click restore) on your Desktop.
Origin: this suite was built for a small fleet of real machines — servers, daily drivers and a TV box — where a bad tweak can strand a machine nobody is sitting in front of. That is why the priorities are: restore point first, read-back over exit codes, a paired restore for every tweak, and a remote-access door that is never touched.
Pipeline modules, each with Apply / Verify / Restore and idempotent re-runs:
| Module | Job |
|---|---|
00-Preflight |
Admin + OS check, the named restore point, power/network pins with read-back, Wi-Fi-only detection |
05-Metrics |
The five acceptance numbers (boot, idle memory, processes, autostarts, Appx) |
10-Foundations |
VC++ 2015-2022 + DirectX June 2010 runtimes from staged, hash-checked files; Windows Update driver-exclusion policy |
20-RemoteStack |
The remote door (mesh VPN + sshd): verify-only — hardening is an attended pass, the optimizer just reports drift |
30-Tweaks |
Native privacy/consumer tweaks (telemetry essentials, advertising ID, activity history, widgets, Copilot, search highlights, lock-screen tips…) + the gated WinUtil hook (below) |
31-AutostartTrim |
Reversible autostart trims (originals recorded first) |
32-ServicesTrim |
Curated service trims — structurally skipped on servers |
35-Appx |
Consumer/promo Appx removal from an audited list; a functional never-remove set (Store, Edge, Defender family, shell, IME, print stack) |
40-Apps |
The standard toolbox (7-Zip, Git, PowerShell 7, Everything, AutoHotkey, rclone) via winget, presence proven from the registry |
50-Role-Server |
Server-only Defender scan tuning (low CPU priority, 30% cap); exclusions are report-only, never added |
60-Autologon |
netplwiz pre-stage only — the password is typed by a human, on the box, never by a script |
90-Verify |
The gates: Device Manager clean, door services up, event-log scan, pending-reboot flags |
Roles (server / daily / tv) resolve from config/roles.json
hostname patterns, else auto-detection; -Role always wins.
Modes: (none) / -DryRun · -Apply · -Restore [-Module X] ·
-Recheck [-Fix] · -ReportOnly (re-measure after reboot and refresh
the scorecard). Helper launchers 复查.cmd (recheck) and 复查并修复.cmd
(recheck + fix) are in the root; an -Apply run also leaves
一键还原.cmd (one-click restore) on the Desktop.
- Restore point before changes, verified by polling enumeration — if it can't be created, the run aborts having changed nothing.
- Read-back beats exit codes. Every write is re-read and compared; a failed Verify stops the pipeline. Installers that lie are treated as failed.
- The only-door guard (
lib/Whitelist.ps1): sshd, the mesh VPN, WlanSvc, WSearch, the Defender stack, the servicing chain and more are protected in code. A trim list naming one is refused at runtime, and a static self-audit fails any-Applyrun whose own files name a protected service next to a dangerous cmdlet without an Assert. - Paired restores.
-Restoreunwinds everything in reverse order from the applied-state file;-Recheckreports OK / DRIFTED / ABSENT per item,-Recheck -Fixre-applies only the drifted ones (usually Windows Update reverting a tweak). - Production window. With
-Production, change segments on a server refuse to run outside 08:30–17:30 local time (-ForceWindowexists, and is loud about it). - No downloads, ever. Nothing in the suite fetches anything;
third-party payloads are staged in
vendor/and SHA-256-gated (vendor/SHA256SUMS). The official one-lineirm | iexinstallers of upstream projects are banned by policy here, however convenient.
This suite can drive Chris Titus Tech's WinUtil
(pinned build, offline, hash-gated) — and by default it doesn't.
config/fleet-winutil.json carries a payload-level audit of every
intended tweak against the pinned build: only 1 of 12 intents mapped
cleanly. The rest bundled service disables (forbidden here — service
trimming is owned by the whitelist-governed list), set values backwards,
or rode along AppX removals. So _schemaVerified stays false, the
hook skips, and the 12 intents are carried by native, individually
restorable tweak items in module 30 instead. That is the design working
as intended: an upstream preset is a proposal you audit, never a
conveyor belt. If you verify a mapping yourself, flip the flag in your
own config and the hook will feed WinUtil the audited file.
Optimize-Win11.ps1 entry point (modes above)
Run-Optimize.cmd double-click launcher
lib\ Whitelist.ps1 (the guard) + Common.ps1 (plumbing)
modules\ the pipeline (00-90)
config\ YOUR layer: roles, fleet values, trim lists (examples shipped)
vendor\ staged third-party payloads (binaries not in this repo)
docs\ pilot screenshot + generated scorecard artifact
Code is public; config is private. Hostnames, fleet values and trim
decisions live only in config/ — see config/README.md for the
governance rules. The provisioning half of the suite (one-click app
installs) lives in the sibling repo,
win11-oneclick-setup.
- ChrisTitusTech/winutil — MIT. The pinned engine behind the (default-off) module-30 hook; audit-first usage pattern is ours.
- Raphire/Win11Debloat — MIT. The Appx candidate universe in
config/appx-lists.jsonis adapted from its list (attribution in the file), then screened by the never-remove rules. - farag2/Sophia-Script-for-Windows — MIT. Engineering patterns borrowed: paired Apply/Restore per item, preset-files-reviewed-before-running.
- xM4ddy/OFGB — Unlicense (key research: Shawn Brink / ElevenForum). The advertising-key set used as a difference audit for the consumer-off tweaks.
把臃肿的新 Windows 收拾干净 — 双击一次就行。
新电脑的开始菜单里有广告，预装了你没要过的软件，还有一堆开关在把你的 使用数据发给微软。这个工具把这些一次处理干净，用的是一个固定的、整体 测试过的方案。
动手之前，它先存好退路。跑完之后，它给你一张实测的成绩单 — 不是口头 承诺。
- 开始菜单里有广告和"推荐"应用，你从来没要过。
- 游戏、购物软件和试用版软件全是预装的，一个个删要花一晚上。
- Windows 默认会把使用数据发给微软，关掉它们的开关分散在五个不同的 设置页面里。
- 你刚关掉某个东西，下一次 Windows 更新又悄悄给你打开了。
- 免费清理工具给你 200 个勾选框，勾错一个就出问题 — 而且没有后悔药。
- 另一个"优化大师"要收年费、弹广告，还顺手给你装上别的东西。
你什么都不用选。 清理项是固定的一套，整套一起测试过。你双击、 同意管理员提示，然后等着就行。
它先存好退路。 在第一处改动之前，工具会创建一个还原点 — 还原点 是 Windows 保存的一份系统快照，出问题时可以退回去。如果这个快照建 不出来，工具就停下，什么都不改。
它收拾的都是你真能感觉到的东西。 广告和推荐关掉。收集数据的开关 关掉。预装的推广应用删掉。你用不上的后台服务让它们歇着。
它做的每件事都验证。 每改一处，工具都会把设置读回来确认真的改了。 一条命令"运行成功"不算数 — 它不认这个。
它用数字说话。 跑完你会拿到一张成绩单：开机时间、内存占用、正在 运行的进程数、开机自启项、已装应用数 — 改动前后都有，在你自己的机器 上实测。
失败就大声说，绝不藏着。 哪一项检查没过，整个运行就停下来并告诉你。 这个工具绝不会在没做成的事旁边写上"完成"。
后悔了一键就能退。 桌面上会留一个还原文件，点一下，所有改动按 相反顺序全部退回。
交互式调整工具 — WinUtil 是其中的好工具 — 把几百个开关摆在你面前 让你自己挑。你要是每个开关都懂，那是真本事。
要是不懂，那就是赌。而且你挑出来的那一套，从来没被当作一整套测试过。
这个工具赌的是反面：一套固定的、一起选定一起测试过的方案，你什么都不 用挑，每一处改动都有退路。
网上流传的精简脚本，大多是某个人按自己的电脑写的清单，在论坛里传 来传去。很多不建还原点。
很多还会在某一步失败时照样打印"完成"。你要过几周才会发现，某个你用的 东西没了。
这个工具先建还原点，每处改动都读回来验证，检查不过就大声停下来。
收费的优化软件，通常是订阅制。有些会弹广告、推升级。有些自己也在 收集使用数据。
这个工具源码公开 — 源码人人可读，个人和非商用免费使用。不弹广告， 不收集任何东西，也从不下载任何东西。
难搞的版本它也能跑。 它完整支持 Windows 11 LTSC — 很多工作机用的 精简长期版，这个版本没有微软商店。这个工具做的任何事都不需要商店， 也不需要联网。
| 交互式调整工具 | 网上流传的精简脚本 | 收费优化软件 | 本工具 | |
|---|---|---|---|---|
| 改动前建还原点 | 要你自己安排 | 经常跳过 | 看产品 | 永远先建 — 建不了就不跑 |
| 你要做的选择 | 几百个勾选框 | 不用选，但也没人验证 | 几个 | 一个都不用 — 一套固定方案 |
| 怎么证明做成了 | 你自己检查 | 不管成没成都打印"完成" | 它自己的面板 | 实测成绩单 + 每处改动读回验证 |
| 出了失败会怎样 | 日志里一行字 | 经常不出声 | 看产品 | 停下来，明说 |
| 价格、广告、你的数据 | 免费 | 免费 | 订阅制；广告常见 | 免费；无广告；不收集任何东西 |
我们在一台全新的测试机上真跑了一遍，数字照实公布，好的坏的都公布。
测试机：一台虚拟机里的 Windows 11 IoT 企业版 LTSC 2024 评估版 (VMware Workstation，8 GB 内存、4 核处理器、80 GB 磁盘），2026-11-13 全新安装。
优化器的真实运行结果：应用改动 40 项 · 按设计跳过 16 项 · 失败 0 · 警告 0。 还原点先建好并确认到位。11 个后台服务被精简。你电源设置的 原始值在动手前先记了下来，一键还原文件留在了桌面上。
试点机在两套工具都跑完之后的样子：Docker Desktop 和 Tailscale 常驻， 任务栏里有输入法指示器。
| 指标 | 运行前 | 运行后（同一次开机） | 重启且装机工具也跑完之后 |
|---|---|---|---|
| 开机到桌面 | 53.9 秒 | 53.9 秒（重启后复测） | 53.9 秒 |
| 空闲时内存占用 | 1,885 MB (23.0%) | 1,947 MB (23.8%) | 2,008 MB (24.5%) |
| 正在运行的进程 | 119 | 114 | 130 |
| 开机自启项 | 3 | 3 | 7 |
| 已装应用（内置，预置） | 50 (1) | 50 (1) | 54 (1) |
完整成绩单原文件：docs/scorecard-pilot.html。
怎么诚实地看这张表：LTSC 本身就很精简 — 自启项只有 3 个、消费类应用 一个都没有 — 所以在这个版本上能剪掉的本来就不多，开机时间在虚拟硬件 上也没有动。
最后一列涨上去的数字是装机工具带来的，不是退步：姊妹仓的装机工具 那时已经把整套软件装好了，那些程序自己带着常驻服务。
换成普通的消费版 Windows 11 — 也就是最常见的情况，预装的额外东西一 大堆 — 同样一轮能剪掉的要多得多。而成绩单的意义就在这里：你不用信我 的话，你的机器会打印它自己的数字。
这次试点还从反面立了功：它找出了这套工具的五个缺陷 — 其中包括一个安装 文件会弹出对话框、把无人值守的运行卡死，还有一处检查曾经把一次取消的 安装记成了完成。
五个都已修复并复测过。正是这类事说明了下面这套安全机制为什么存在。
普通运行什么都不改。 双击只是给你看当前的数字和完整的计划。只有
带 -Apply 的运行才会真的改东西。
没有还原点，就没有改动。 快照要是建不出来、确认不了，运行在动手 之前就停下。
它绝不碰那扇门。 Windows 更新、Microsoft Defender（系统自带的杀 毒）和你用来从另一台电脑连进这台机器的工具，都在代码里被保护着。你喂 给它任何清单，都精简不到它们头上。
它从不下载任何东西。 它需要用到的支持文件，由你自己放进 vendor
文件夹。每个文件用之前都会对一遍记录在案的 SHA-256 指纹 — 指纹是根据
文件算出来的一串短代码，文件哪怕改了一个字节，代码就对不上了。
- 把配置改成你的。 在
config\里，把fleet.example.json复制 成fleet.json、把roles.example.json复制成roles.json，然后 编辑它们。你要用的载荷文件放进vendor\（见vendor\README.txt); 每个文件都会对vendor\SHA256SUMS做指纹核对。 - 先看一遍。 运行
.\Run-Optimize.cmd，不带任何参数。它什么都不 改，会把完整计划和你当前的数字打印出来。 - 正式跑。 运行
.\Run-Optimize.cmd -Apply。顺序是：先还原点， 然后清理，最后是你的成绩单 — 桌面上还会出现一键还原.cmd。
来历：这套工具最初是为一小队真实机器做的 — 有服务器、有日常主力机、 有一台电视盒子 — 在那些机器上，一次改坏就可能把没人坐在跟前的机器困 住。所以优先级是：还原点优先、读回验证高于退出码、每处调整都有配对的 还原、远程访问的那扇门绝不碰。
流水线模块，每个模块都有 应用 / 验证 / 还原 三件套，重跑不会重复生效：
| 模块 | 职责 |
|---|---|
00-Preflight |
管理员与系统检查、具名还原点、电源/网络锁定并读回、仅 Wi-Fi 检测 |
05-Metrics |
五项验收数字（开机、空闲内存、进程、自启、Appx） |
10-Foundations |
VC++ 2015-2022 + DirectX June 2010 运行库（暂存文件、哈希校验）;Windows 更新驱动排除策略 |
20-RemoteStack |
远程门（mesh VPN + sshd)：只验证 — 加固是有人在场时做的事，优化器只报告漂移 |
30-Tweaks |
原生隐私/消费类调整（遥测要点、广告 ID、活动历史、小组件、Copilot、搜索亮点、锁屏提示…）+ 下文的 WinUtil 闸门钩子 |
31-AutostartTrim |
可逆的自启精简（先记录原始值） |
32-ServicesTrim |
精选服务精简 — 服务器上结构性跳过 |
35-Appx |
按审计过的清单移除消费/推广 Appx；有一组功能性的永不移除集合（商店、Edge、Defender 家族、外壳、输入法、打印栈） |
40-Apps |
标准工具箱（7-Zip、Git、PowerShell 7、Everything、AutoHotkey、rclone)，经 winget 安装，存在性由注册表证明 |
50-Role-Server |
仅服务器：Defender 扫描调优（低 CPU 优先级、30% 上限）;排除项只报告、从不添加 |
60-Autologon |
只做 netplwiz 预备 — 密码由真人在机器上输入，脚本绝不代劳 |
90-Verify |
守门检查：设备管理器干净、门服务在跑、事件日志扫描、待重启标志 |
角色（server / daily / tv）由 config/roles.json 的主机名模式解
析，否则自动检测；-Role 永远优先。
模式：（无） / -DryRun · -Apply · -Restore [-Module X] ·
-Recheck [-Fix] · -ReportOnly（重启后复测并刷新成绩单）。根目录有
辅助启动器 复查.cmd（复查）和 复查并修复.cmd（复查 + 修复）;-Apply
运行还会在桌面留下 一键还原.cmd。
- 改动前先建还原点，用轮询枚举验证 — 建不出来，整个运行中止，且 什么都没改。
- 读回高于退出码。 每次写入都会读回比对；验证失败，流水线停下。 会撒谎的安装程序按失败处理。
- 唯一的门守卫（
lib/Whitelist.ps1):sshd、mesh VPN、WlanSvc、 WSearch、Defender 全家、系统 servicing 链等都在代码里受保护。精简 清单要是点名了其中之一，运行时直接拒绝；静态自审还会拦下任何在自 己的文件里把受保护服务和危险命令放在一起、又没有 Assert 的-Apply运行。 - 配对还原。
-Restore按应用状态文件以相反顺序全部退回；-Recheck逐项报告 OK / DRIFTED / ABSENT,-Recheck -Fix只重新 应用漂移的那些（通常是 Windows 更新把某项调整改了回去）。 - 生产窗口。 带
-Production时，服务器上的改动段在本地时间 08:30–17:30 之外拒绝运行（-ForceWindow存在，并且会大声说明）。 - 从不下载。 套件里的任何东西都不联网取文件；第三方载荷暂存在
vendor/并过 SHA-256 闸门（vendor/SHA256SUMS）。上游项目官方 的一行式irm | iex安装法在这里按规矩禁用，再方便也不用。
这套工具可以驱动 Chris Titus Tech 的 WinUtil
（锁定版本、离线、哈希闸门）— 但默认不驱动。config/fleet-winutil.json
里有一份逐项审计：对着锁定版本，每一个预期调整都核到了载荷层面，只有
12 项里的 1 项干净对上。其余的要么捆绑禁用服务（这里禁止 — 服务
精简归白名单管辖的清单管），要么把值设反了，要么顺带捎上 AppX 移除。
所以 _schemaVerified 保持 false，钩子跳过，12 项意图改由模块
30 里原生的、逐项可还原的调整来承担。这正是设计想要的结果：上游的预
设是一份供你审计的提案，不是一条传送带。你要是自己核对过某项映射，
在你自己的配置里把标志翻过来，钩子就会把审计过的文件喂给 WinUtil。
Optimize-Win11.ps1 入口（模式见上）
Run-Optimize.cmd 双击启动器
lib\ Whitelist.ps1（守卫）+ Common.ps1（管道）
modules\ 流水线（00-90）
config\ 你的层：角色、舰队值、精简清单（附示例）
vendor\ 暂存的第三方载荷（二进制不在本仓）
docs\ 试点截图 + 生成的成绩单文件
代码公开；配置私有。主机名、舰队数值和精简决定只存在于 config/
— 治理规则见 config/README.md。这套工具的装机那一半（应用一键安装）
在姊妹仓
win11-oneclick-setup。
- ChrisTitusTech/winutil — MIT。模块 30 那个（默认关闭的）钩子背后的锁定引擎；先审计再使用的用法是我们的。
- Raphire/Win11Debloat — MIT。
config/appx-lists.json里的 Appx 候选全集改编自它的清单（文件内有署名），再过永不移除规则筛选。 - farag2/Sophia-Script-for-Windows — MIT。借鉴的工程模式：逐项配对的 应用/还原、运行前先审预设文件。
- xM4ddy/OFGB — Unlicense（关键研究：Shawn Brink / ElevenForum）。广告键集合用作消费类关闭项的差异审计。
Versions up to and including v1.0.0 were released under the MIT License. From v1.0.1 onward, this project is source-available under the PolyForm Noncommercial License 1.0.0 — free for personal and noncommercial use; commercial use requires a separate license from the author.
For a commercial license, contact Ze (Mark) Song via https://github.com/marksong0917.