Patching?!

[Devil Panther]

can someone please explain me how software patches work?
let say i have a software and the vendor releases a patch, i install the patch and the software is fixed, how does it work?



thanks.

[Vicious]

Well most of these applications use external files and/or libraries.

So patches usually replace either these files or the actual executable.

[Devil Panther]

by libraries you mean dll files?

[7smurfs]

DLLs, MPQs, and the like. Basicly any library file type can be used to allow for easier patching, by overriding them. This way you don't always need to change the whole program itself.

[Devil Panther]

never heard of mpq before, are they like the dll?

[7smurfs]

It's only really used (accutely I think it's ONLY used) by Blizzard Entertainment in their games. It's more like a .zip than a DLL. It basicly holds a bunch of files, like models and important .txt files, that can easily be called from in the main file. Its almost like a folder file. Search for WinMPQ for more information on it, althought I don't think anyone really knows how to use it except for Blizzard.

But basicly they just place any patch change information in it, so in small patches they can just replace the patch.mpq file and easily change stuff.

[Devil Panther]

so if i'm not part of the Blizard crew the only way to patch my software without changing the entire program is to use dlls!?

[7smurfs]

Or develop your own type of library. Also, if the file isn't very large, you could just redistirbute a new .exe that overwrites the old one wih the new, patched, one.

[Devil Panther]

got it, thanks.

[Waldo2k2]

The fastest patch I've ever seen run was one put out by lucas arts for their jedi knight series. All it did was patch a few bytes in the .exe and it was done (ie: changed some bytes around, I'm sure it only had to do with the graphics engine). So there are several ways it can be done. The most foolproof has already been covered here, but the quickest and coolest is to actually patch files by changing the byte-code...very cool stuff.

[Fordy]

The fastest patch I've ever seen run was one put out by lucas arts for their jedi knight series. All it did was patch a few bytes in the .exe and it was done (ie: changed some bytes around, I'm sure it only had to do with the graphics engine). So there are several ways it can be done. The most foolproof has already been covered here, but the quickest and coolest is to actually patch files by changing the byte-code...very cool stuff.

Also pretty difficult for anything more than swapping a few bites (i've managed to add a new section, hijack the thread before running the startup code, open a messagebox and then return to the original code - always seems a little shakey though and doesnt always work too well)

Also, antivirus programs hate this method and can sometimes see this as a virus (thereby stopping the patched program from running).

Youre better off swapping dlls

[Driver]

I was going to say much the same thing as Fordy, so instead I'll just add that some malware will do exactly that - modify or even delete legitimate system files.

I'd guess that if you could open a valid Windows file for writing and squirt some extra code in there, you could be capable of writing a pretty nasty piece of malware. If the manufacturer, date, and version details are left intact, it would not be easy to spot that something is seriously wrong.

The best (only?) way you'd be able to detect it would be to compare it (or its MD5 hash) against the correct versions of the file, and give alert based on the differences.

I've even seen cases where Notepad has been replaced with a malware installer!

Edit: Where I work, we use PowerBuilder. The software, as delivered, comes as executables (.exe) and PowerBuilder Dynamic libraries (.pbd) (in addition to others irrelevant to this). When a customer requires a patch, I make a change in the source library (pbl) and recompile the required pbd file(s), then deliver it to the customer.

Problem: Supposing somsone raises a patch that involves a.pbd and b.pbd, then I come along at a later date and raise another patch to b.pbd, I can't just deliver b.pbd as this could leave a system with half another patch. All patches must be delivered to prevent this from occurring.

[Waldo2k2]

>>All patches must be delivered to prevent this from occurring.

this is why nearly all games that can be played online now force updating of the software before connecting to servers. And I've seen several programs btw that patch windows files...many of them are used for...well lets just say some people prefer not to pay for software. I've always wanted to be able to do this type of thing, I just don't have the patience to step through a program under softice for hours on end to get everything mapped out. That's mainly why I was so impressed with lucas arts. They did exactly what I've always wanted to do and it worked perfectly (and afaik my antivirus didn't complain at all).