SetupBuilder 2018 Build 6100

[NewsArchive]

Hi Friedrich -

No need to create a demo just for me, unless you already intended to
do it. Just trying to understand how you intend for this to work out
of the box.

The scenario that made me ask the question is where you "save" the
response files with the intent to re-load them at a later date. What
if someone (a "hacker" perhaps) wanted to trick the system into
thinking it performed a subsequent update, but sent the new files to a
black hole instead?
Would the initiator of the update be able to know that the files went
to the wrong place?

Thanks Friedrich.

Jeff Slarve
www.jssoftware.com

Ones and Zeros are my Heroes

[NewsArchive]

Hi Jeff,

> No need to create a demo just for me, unless you already intended to
> do it. Just trying to understand how you intend for this to work out
> of the box.

I think I'll create one to demonstrate the power of SetupBuilder :-)

> The scenario that made me ask the question is where you "save" the
> response files with the intent to re-load them at a later date. What
> if someone (a "hacker" perhaps) wanted to trick the system into
> thinking it performed a subsequent update, but sent the new files to a
> black hole instead?
> Would the initiator of the update be able to know that the files went
> to the wrong place?

By default, you store the (optional) response file to the folder where the
"setup.exe" is located in. The end-user can specify another location.

For example (at command line level):

setup.exe /S /RF "my_response_file.txt"

or:

setup.exe /S /RF "c:\test\response.txt"

And you can hard-code a response file name and location into the setup.exe.

For example, this line in the script:

Load Response File ("response.txt")

setup.exe /S will automatically use a "response.txt" response file.

But here comes the interesting part. First of all, you have to ENABLE the
response file feature. It is disabled by default. Secondly, you can
"protect" variable names.

Let us assume, you have a hidden "%TOP_SECRET_UNLOCK_VAR% variable name that
unlocks specific features based on a license key. In the attached
screenshot, the variable name of this protected variable can't be changed
from a response file.

Friedrich

[NewsArchive]

Thanks Friedrich.

>
>But here comes the interesting part. First of all, you have to ENABLE the
>response file feature. It is disabled by default. Secondly, you can
>"protect" variable names.
>
>Let us assume, you have a hidden "%TOP_SECRET_UNLOCK_VAR% variable name that
>unlocks specific features based on a license key. In the attached
>screenshot, the variable name of this protected variable can't be changed
>from a response file.

Jeff Slarve
www.jssoftware.com

Ones and Zeros are my Heroes