#LC Mod Sync

125 messages · Page 1 of 1 (latest)

gloomy wren
#

This mod will sync server mods to connected clients and allow them to be hot loaded without restarting the game.
I am releasing this as an alpha as it may have bugs that are unknown as of writing, but also because it is not feature complete. There are security features I would like to implement, as well as support for mods downloaded directly from thunderstore.

Mod developers, implementing is super easy. follow the steps on the github. I will be making a video on this and sharing it in a few minutes that give an example so it makes more sense, however it is super easy.

https://github.com/lawrencea13/LCModSync

GitHub
GitHub - lawrencea13/LCModSync: a mod that will allow you to sync h...

a mod that will allow you to sync host mods with client mods in Lethal Company - GitHub - lawrencea13/LCModSync: a mod that will allow you to sync host mods with client mods in Lethal Company

white star
gloomy wren
#

Obligatory:
https://www.youtube.com/watch?v=ujz4CnfkhNc

YouTube
MrMiinxx
ModSync - Sync your server mods with all the clients that join!

In this video, we take a step away from GameMaster and look at ModSync. This mod allows the server to tell clients that join to download a mod before hopping in. Along side ScriptEngine, they can be hotloaded in real time!

This is releasing as an alpha, and as we update it, add security and other features, this will slowly push to full release....

▶ Play video
short pier
#

This is so needed

gloomy wren
#

Compiled releases removed until adequate security is in place. The way it links up with other mods won't change unless I find a better way to do it, so if any modders want a copy of the DLL to add support in the mean time, let me know

rustic lynx
#

the modders can probably compile it themselves if the gh is up to date

gloomy wren
#

good point

spring ermine
#

that's unsafe

gloomy wren
# spring ermine that's unsafe

“Compiled releases removed until adequate security is in place. The way it links up with other mods won't change unless I find a better way to do it, so if any modders want a copy of the DLL to add support in the mean time, let me know”

thorny moth
#

This would be amzing especially if it's hot loaded, although it would be nice to allow the clients to query the host for the files in case a mod goes abandoned

#

Or if it's to be tested and each file doesn't need to be at a website to allow it to download to clients

gloomy wren
#

Security is a huge priority, that may not be something I'm willing to do

cyan bluff
gloomy wren
#

Ah shit lol I didn’t even notice

calm kraken
#

when is this mod releasing (compiled)

gloomy wren
#

When it is secure, potentially this weekend but it may be longer.

halcyon steppe
#

I can't help but feel like this mod is a really cool concept but like super dangerous

#

I can't even offer to be another set of eyes on the security front either, I just don't have the experience trying to lock down something like this

covert tulip
#

I dunno how modding works but I'm pretty sure tmodloader does something similar to this when clients are joining a modded server, might be worth it to look into how they implemented it for inspiration (I imagine there implementation is secure, sorry if this response is dumb lol just tryna help)

gloomy wren
#

it looks like it uses workshop, unfortunately we don't have the liberty of using that D:

halcyon steppe
#

I don't know how Terraria mods are made but these are assemblies we'd be downloading and running on the user's computer. They're just programs, with full permissions to do things on their computer. At least when you use and download mods manually you're signing up for it but syncing mods is kinda different. I'm not trying to be negative, just pragmatic. I know you're planning to add some UI elements to make sure the user gets what they are signing up for

#

I'm not very good at it but I'll keep an eye out for ways to break your Sync function and let you know if I find any

gloomy wren
# halcyon steppe I don't know how Terraria mods are made but these are assemblies we'd be downloa...

Currently Implemented:
The input is a string that has no special chars
It is used to query thunderstore, rather than getting a URL from the inputting mod dev
If the api does not return a thunderstore url it will straight up refuse to do anything.

Next up:
GUI confirmation of downloads
Minimum required time on Thunderstore

Potential solutions for future issues:
Whitelist

I don't see any attack vectors except:
A timebomb on the thunderstore, e.g. a mod with packaged malware that waits to execute until it exceeds the amount of time required
Distributing malicious copies of this mod

#

However, gonna continue to gather feedback and do testing to ensure it is secure prior to release.

covert tulip
gloomy wren
covert tulip
frail cradle
thorny moth
#

Workshop support would be bliss, but also just making this only work in Private lobbies would work

gloomy wren
frail cradle
#

I think this can easily make a backdoor if they're good enough

gloomy wren
#

have you looked at the current souce?

#

source* @frail cradle

frail cradle
#

Im not a modder my brother

#

im just a guy who plays with mods lol

gloomy wren
#

fair enough lol

#

Here's this:
Currently Implemented:
The input is a string that has no special chars
It is used to query thunderstore, rather than getting a URL from the inputting mod dev
If the api does not return a thunderstore url it will straight up refuse to do anything.

Next up:
GUI confirmation of downloads
Minimum required time on Thunderstore

Potential solutions for future issues:
Whitelist

I don't see any attack vectors except:
A timebomb on the thunderstore, e.g. a mod with packaged malware that waits to execute until it exceeds the amount of time required
Distributing malicious copies of this mod
However, gonna continue to gather feedback and do testing to ensure it is secure prior to release.

#

just know that security is a huge factor with this mod, not an afterthought

halcyon steppe
#

Minx, I had a thought. Since you're hot reloading the assemblies you download doesn't that mean you could create an application context they run in? You could restrict a few dangerous namespaces from received mods and let modders know if they expect their mods to work with the Sync mod they shouldn't use things like OS for instance

twin furnace
#

Reflection being the worst one

halcyon steppe
#

Oh actually I just looked it up and Code Access Security is just obsolete now? How does one control a loaded assembly now?

gloomy wren
#

I guess I'm gonna have to research that, unsure

#

but that is a great idea

halcyon steppe
#

I think you have to use Application Domains now

gloomy wren
#

We'll have to write a test mod that intentionally does something that would try to bypass it for testing

twin furnace
#

Also, how about a blacklist hosted in pastebin / a gist / etc. in case someone uploads a virus? That'd be hand in hand with the "minimum days published" feature imho

#

So if someone uploads SomeExtremelySneakyBypass you can just manually blacklist it before a few days pass and gets past the minimum days threshold

#

I'm actually reading through the source code and amazing work Minx 👍🏻👍🏻👍🏻

halcyon steppe
#

Looks like you can combine Addin security with AppDomain stuff by calling the Token.Activate(AppDomain) so you can activate your token inside a domain you've created

twin furnace
#

But what about the second time around? Mod Sync may load the DLL the first time, but the next time BepInEx does it and doesn't use the AppDomain

#

Or does Mod Sync delete the mod afterwards?

gloomy wren
#

So modsync doesn't delete the DLLs after but maybe that's a good idea, I can unload and load at will so I can have bep release a handle on the DLL and delete it

#

List of changes:
Security update

  • Mod creators no longer give URLs, instead they would give a creator and mod name
  • Creates API requests to the thunderstore to get the correct download link
  • checks the link to ensure it is a thunderstore URL
  • Now supports zip files
  • Does not support asset bundles just yet
#

I don't think it's possible to get a non thunderstore URL in there at this point, so next step would be ensuring the security of the actual DLL when downloaded

twin furnace
#

I can be a backseat dev and say "Heh, just use dnlib to inspect every mod" but that'd take a lot of time PensiveCry

gloomy wren
#

Alrighty I'll await your list of mods that are safe, what year do you think that'd be done?

halcyon steppe
#

I'm sure we'll have it by 2030

twin furnace
#

some don't even have to be a virus, just can load an offensive .fbx

#

no way to block that otherwise

gloomy wren
#

I can do a blacklist..I'm just not sure how to update it without having the user download the updated version of the list

twin furnace
#

reading it from a raw github gist is one (lazy) way to do it

#

pastebin is another

gloomy wren
#

ahh yes from a pastebin

twin furnace
#

only problem is you'd be pinged by people to add it to the list

gloomy wren
#

What I could do is add a config for the blacklist URL and default it to mine, then if someone wants to make their own blacklist they can

twin furnace
#

Yeah, maybe even a list of strings for different blacklists

#

That way you can just wipe your hands, include an offensive list from another dev by default and call it a day

halcyon steppe
#

I agree it would probably be good to have a blacklist even if its empty so the user can define mods they don't want to download. It would be like the last line of defense against mods that somehow get thru everything we're putting in front of them

twin furnace
#

but yeah there's:

  • virus
  • annoying sound mods
  • offensive stuff
  • Stuff that lags in certain computers. This one should be the most "optional" list and who tf decides which ones are heavy, for which pcs ShrugLyfe
gloomy wren
#

Cool, I will add that to the scope of the project

halcyon steppe
#

You let me know if you figure out all that token and appdomain stuff I sent ya cuz it kinda looks like Latin to me, if we're honest

gloomy wren
#

haha yeah I looked at it and I was like..............hmmmm

#

to be honest I'm not even sure if it's gonna work under the current circumstances

#

It looks like I can sandbox stuff

#

but mod creators are going to be required to implement sandboxing in their own app

halcyon steppe
#

I'd def feel better if we could somehow get a sandbox on those downloaded assemblies but it looks like the CAS system got deprecated and there isn't really a functional replacement in the SDK anymore. That's a bold move from Microsoft, tbh

gloomy wren
#

ope nevermind I found something really cool off to the dungeon for testing

gloomy wren
#

progression..

Screenshot_2023-11-19_121211.png
halcyon steppe
#

Nice

gloomy wren
gloomy wren
#

Tutorial video for modders to integrate their mod with ModSync, the video is 4 minutes because I explain things and show an example, but actually implementing took up less than 1 minute:
https://www.youtube.com/watch?v=Zq8herBrzWI

YouTube
MrMiinxx
How to integrate your mod with ModSync

Today, we go over a quick example of how to integrate your mod with ModSync. When the DLL becomes available, please add a reference and add support as soon as you can! The goal is that this process never changes, so once you add support you are set!

Github Repo: https://github.com/lawrencea13/LCModSync

▶ Play video
#

Please share feedback, if you like it, don't like it, if there's a better way to do it, etc.

#

Note: Please do not use this DLL in production. Use it as a reference until I do a full release, as your access point will not change.

halcyon steppe
#

Should SendModInfo always be on the plugin base or can it be wherever?

#

also the video has the response to being sender.sendModInfo but all I can find on the ModSyncPlugin class is GetModUrlAndName, is that what I'm using now?

gloomy wren
#

Oh

#

Idk if it needs to be in mod base, not super familiar with the broadcast message

#

So the DLL here has the method listed as url and name?

halcyon steppe
#

I think broadcast message might have to find a monobehavior to link up with, also not super familiar with it

#

lmk if I'm a dummy and didn't do it right

gloomy wren
#

If you referenced the DLL I shared then I somehow managed to share the wrong DLL -_- idk how

halcyon steppe
#

This is the only public function in the one you sent

image.png
#

It looks right but its just a different name than the video uses

gloomy wren
#

Man idk how I sent the wrong DLL lmao I must’ve grabbed it from the release instead of debug folder or something

halcyon steppe
#

😬

gloomy wren
gloomy wren
gloomy wren
#

No reference needed now for modders, instead, you can send a message and it will gather it, this should be completely independent and not impact anything else in your project.

public void sendModInfo()
 {
     foreach (var plugin in Chainloader.PluginInfos)
     {
         if (plugin.Value.Metadata.GUID.Contains("ModSync"))
         {
             try
             {
                 List<string> list = new List<string>
                 {
                     "GameMasterDevs",
                     "GameMaster"
                 };
                 plugin.Value.Instance.BroadcastMessage("getModInfo", list, UnityEngine.SendMessageOptions.DontRequireReceiver);
             }
             catch (Exception e)
             {
                 // ignore mod if error, removing dependency
                 mls.LogInfo($"Failed to send info to ModSync, go yell at Minx");
             }
             break;
         }
        
     }
 }
gloomy wren
#

Current list of whitelisted mods
*LC_API
*Lethal_Company_Enhancer
*HotbarPlus
*FasterItemDropship
*SpectateEnemies
*MoreCompany
*anormaltwig
*MikesTweaks
*Brutal_Company

halcyon steppe
#

I suppose I'll have to implement some way to sync mod settings with the client to make sure Enhancer works. So do I need to keep that sendModInfo method in my plugin or is it not needed anymore?

gloomy wren
#

I haven’t done that yet, for something like that it would require something ridiculous. Either you have to send the info to my mod via the list string parameter indicated above and I implement it or I send a file from the host machine to the client machines

#

Either way is just awful, someone has implemented syncing with their mod though

halcyon steppe
#

If you're planning to support sending network data to the client that would be cool, otherwise I just planned to use LC API to do it

gloomy wren
#

It’s one of the mods on the list.. I don’t remember which one, I think mikestweaks

#

If I ever do that’ll be way down the line

halcyon steppe
#

Neato mosquito, do I have to do anything special with my assembly like before or will it just tell the client to download my mod without me now?

gloomy wren
#

You don’t need to do anything with your mod that’s on the list, it just works

halcyon steppe
#

Yey

halcyon steppe
#

@gloomy wren #dev-general message
Solution to this problem ended up being remove LCModSync

#

Figured you'd like to know

gloomy wren
#

Ty my mod definitely has the potential for that since it kinda decides whether the user gets to load in or not

gloomy wren
#

We have updated to ModSyncBeta 0.2.1
With this release comes a minor but important change, and some bugfixes:
Local mod checking, probably should have been in from the start, but if you have mods installed already, it will not attempt to redownload them.
Fixed infinite loading issues!

grizzled oyster
#

does this work with biggerlobby

gloomy wren
gloomy wren
gloomy wren