Auto patching

Sure, that would work.

Auto patching may bring security concerns with it depending how its implemented. If the patch is executed at any point theres an ideal chance for false data to be delivered to the client and then left to run amok.

I wouldn''t rate it as likely but its something to be considered.

No no, you''re right i haven''t thought of that.
The upload exe is only for developpers, so no problem with conflicts on upload. For the download, do you think that a database implementation will be best than the text file? Is it possible for multiple users to access a text file on server at the same time? (probably not in real time, but i want to know if it will create a problem, a crash)

( Be Side )

My 2 Cents:

You will also need cumulative patches. For example, if you release:
version 1.0, then
version 1.1, then
version 1.3, then
version 1.7, then
version 2.0

So, there is all those versions, so you need patches that will bring the game from any version to the most recent one, so:
Patch 1.0 -> 2.0
Patch 1.1 -> 2.0
Patch 1.3 -> 2.0
Patch 1.7 -> 2.0

You will eventually also have in your table some older entries, like:

Patch 1.1 -> 1.3
Patch 1.3 -> 1.7
(etc)

So your DB Table should look something like this:
id, Label, Description, filename, fromVersion, toVersion, active, NumberDownloads, Date, etc...
1, "Patch 2.0", "Upgrades the game from version 1.0 (Install) to 2.0", p_10_20.zip, "1.0", "2.0", true, 1195, "2004-30-02", ...

Hope it helped

---

[Hugo Ferreira][Positronic Dreams][Colibri 3D Engine][Entropy HL2 MOD][My DevDiary]
[Yann L.][Enginuity] [Penny Arcade] [MSDN][VS RoadMap][Humus][BSPs][UGP][NeHe]
"...if you had one shot, one oportunity, to seize everything you ever wanted for one moment, would you capture it? or just let it slip?" - Eminem

Yes interesting,
I think just one system can do the all the job.

1.1->1.3
1.3->1.7
1.7->2.0

So if the client have 1.1, then he downloads the 1.1->1.3 and install it and finally downloads/installs 1.3->1.7. Since this is an automatic patching, the user has no choice, it is all needed i think. I don''t know if the active state is needed.

Update menu-item goes to:
- htt://www.yourhost.com/checkforupdate.php?version=1.3

if (PHP finds newer)
- Print download link;
else
- Print other message;
------------------

I think that the user will be more happy with just 1 patch than 10 patches. But it depends on the 'jump'. 1.3 -> 1.4 -> 1.7 could be 2 patchs. But 1.3 -> 1.4 -> 1.7 -> 1.9 -> 2.0 should definitely be 1 patch only.

You could even design your patcher to always be on executed before the game starts, and when executed it checks what files are new and downloads. This way, you can just pump the newer installers on, and leave it to the patcher to update for the older installers.



--
You're Welcome,
Rick Wong
- Google | Google for GameDev.net | GameDev.net's DirectX FAQ. (not as cool as the Graphics and Theory FAQ)

[edited by - Pipo DeClown on June 10, 2004 3:50:07 PM]

[edited by - Pipo DeClown on June 10, 2004 3:50:34 PM]

php?
This is an automatic download of patch, no need the user to go on a site.
Or could I use php for something other than a html page?
I need an exe to access a database on a server, i think the best solution is C++ anyway, but is there a php possibility?
(no link of download, must tell directly to the exe that there is a new patch such as anarchy online or other MMORPG i think)

[edited by - Jis on June 10, 2004 3:55:17 PM]

Wouldn''t it be safer to open up a browser and let PHP connect to the DB?

Anyway, I''d go for the automatic patcher that checks for update on every startup. The patcher would show howmany packages it would have to download, and if possible a 1 file patcher.

--
You''re Welcome,
Rick Wong
- Google | Google for GameDev.net | GameDev.net''s DirectX FAQ. (not as cool as the Graphics and Theory FAQ)

You can access an URL, and pass some data to it, and PHP, on the server-side, can then print information on the webpage, so:

http://www.yourserver.com?ver=10&co=uk

Your patcher program access the above url, which means the user has version 1.0 (ver=10) and has the UK version of the game (co=uk).

PHP then prints onto the webpage:
Patch Available [true]
Patch File [p_10_20.zip]

All you have to do is read the php-constructed webpage, parse it, and you have all the info you require. the above page just told us that we are in need of an upgrade, and the location of that upgrade.

On the server side, PHP & mySQL are quite enough for this sort of project.

Also, on my previous post, i wanted to make it quite clear that downloading patches after patches is not acceptable, you, as a developer, must see to it that there is allways a patch that bridges the install version to the most recent version...

...otherwise, i format my pc, re-install the game (v1.0), and because we are now at version 4.0, i''m forced to patch consecutively... instead of patching cumulatively...

---

[Hugo Ferreira][Positronic Dreams][Colibri 3D Engine][Entropy HL2 MOD][My DevDiary]
[Yann L.][Enginuity] [Penny Arcade] [MSDN][VS RoadMap][Humus][BSPs][UGP][NeHe]
"...if you had one shot, one oportunity, to seize everything you ever wanted for one moment, would you capture it? or just let it slip?" - Eminem

Mmm you're right in a way.
I think i will use two levels.
The first one is basically one patch to another.
And then manage big patches that takes modifications from lower versions.
1.0->2.0
- 1.0->1.5
- 1.5->2.0
2.0->3.0
- 2.0->2.3
- ...
Your php parsing idea is interesting. For the beginning ! After perhaps i will use a compiled version (on the server). I have now a better idea on how to implement the auto patching. (thanks for the php solution)

Hey !!! I have now a tester that would format his pc for me.
Thanks to you prozak !!!
The job will be like that:
auto patch -> format -> auto patch -> format -> auto patch
Thanks for your help

[edited by - Jis on June 10, 2004 4:28:21 PM]

On the same topic, are there any security disadvantages of doing an automatic update instead of showing user the updated link (aside from the obvious lack of user awareness). If the user is given a link, chances are that the user will download and run stuff from the link anyway, and both approaches are prone to DNS spoofing, both can be made to incorporate SSL. So why bother the user, why not just do an informative ''new features'' popup once the update completes?

No no, the php page is not seem by the user. if you want we can put binary data perhaps instead of writing "patch needeed, big chief".
This is parsed directly in the exe. Only patching box is diplayed to prevent the user.

Hang on... you said this was for developers (hence you aren''t worried about the security issues).

Shouldn''t you be looking at a source code control system instead? (CVS/Perforce/etc)

Mmmmm
This is a good solution, but the problem is the file version.
Perhaps i could use the last-modified value. Is it stored in each file type in the header? I''m sure this solution is the fastest, it is simple and more securised than the php one. It can also reduce the data eight cost on the server if there are a lot of patches and if they are big. But on the other side, all the game will have to be on the server. But for the developping time i think this is great. Perhaps i will make a exe to send new files and change the text file on the server to make everything auto.

( Be Side )

quote:

---

Original post by Voxelsoft
On the same topic, are there any security disadvantages of doing an automatic update instead of showing user the updated link (aside from the obvious lack of user awareness). If the user is given a link, chances are that the user will download and run stuff from the link anyway, and both approaches are prone to DNS spoofing, both can be made to incorporate SSL. So why bother the user, why not just do an informative ''new features'' popup once the update completes?

---

The main difference (and there are a few catches) is that with a download from http you can list the MD5 number and any tampering should become apparent. The trouble is that unless you go out of your way to design a ''nice'' system the user will probably ignore it anyway.

Maybe if the game incorporated an MD5 checker at a windowed loading screen, which only appears when an update is due? The user could let the file autodownload and enter the corrosponding MD5 number from the website, if they don''t enter it they can''t update.

But if the DNS is spoofed, then the website itself can be faked with the ''correct'' MD5 of the exploit. So I now think automatic patching is no less secure than making the user go through a link to download the patch.

Hahaha yes but with automatic md5 used(md5?), he must find a copy of the game first, not downloading it directly from the website.

quote:

---

Original post by Voxelsoft
But if the DNS is spoofed, then the website itself can be faked with the 'correct' MD5 of the exploit. So I now think automatic patching is no less secure than making the user go through a link to download the patch.

---

While thats still possible it means an attacker would first have to replicate the games website, this could be made more difficult by adding scripting etc. I believe tha manual method is more secure but may not be worth the extra effort on the users part, more than likely they would prefer the automatic process.

In any case i don't believe that its a likely attack, just something to be aware of and the hazard is greatly reduced by letting the engine apply the patch instead of running the patch file.

Good luck with it Jis

[edited by - RdF on June 12, 2004 11:15:22 AM]

quote:

---

Original post by Squirm
Shouldn''t you be looking at a source code control system instead? (CVS/Perforce/etc)

---

What is that?
I don''t know this.

( Be Side )