functioning of the Adobe Flash Player plug-in Auto-Update (for Windows)
In the first part we have learned what the Flash Player plugin is. Now we'll see a little difficult at the update system.
Update configure
first Settings Manager (see picture)
click the right mouse button (a right-handed) on any flash advertising, choose "Preferences ..." . Choose When the dialog "Settings for Adobe Flash Player" message, click on the blue question mark top right. Note: If the Flash animation is too small, does not the window. Click
On the website, which is now left under the "Table of Contents" to "Global Notifications Settings Panel". Then you should see the dialog shown in the picture. There you can set how often updates (updates) are searched.
disadvantage: The Settings Manager allows you to select only 60, 30, 14 or 7 days.
second Config file
The plugin / control searches for a file named mms.cfg in the following directories:
- Windows: \\ Windows \\ System32 \\ Macromed \\ Flash
- Macintosh: / Library / Application Support / Macromedia
- Linux: / etc / adobe /
In this text file you can set various things. Flash Player Administration Guide for details see under Links. What is interesting here, especially the entry
AutoUpdateInterval = 1
This looks for the plug / Control every day for updates.
Important: If the check mark in the Settings Manager "If you enable this setting ..." in dialogue will not put up, even in the AutoUpdateInterval mms.cfg file ignored. The box is checked by default.
As is now the update?
The plugin tries to create a file and write a value in the Registry:
C: \\ WINDOWS \\ system32 \\ Macromed \\ Flash \\ testUpdate.txt
HKLM \\ SOFTWARE \\ Macromedia \\ Flash Player \\ AutoUpdate test
Both usually requires administrator privileges. If that does not work no update is performed. The file is deleted.
Then the plugin the latest version from the Internet.
- http://fpdownload.macromedia.com/get/flashplayer/update/current/xml/express/version_win_ax.xml (ActiveX)
- http://fpdownload.macromedia.com/get/flashplayer/ update / current / xml / express / version_win_pl.xml (NPAPI / Netscape)
If an update is available, install the plugin with a "runonce" in the registry (HKCU branch). A runonce is a special startup. When the system starts the entry is executed once and then deleted.
This Runonce start the update program of Flash Player. The updater is NPAPI NPSWF32_FlashUtil.exe . The ActiveX Updater is FlashUtil10b.exe or so. The exact file name of the ActiveX update depends on the version number.
invites the update (for NPAPI version) the file fpdownload2.macromedia.com/get/flashplayer/update/current/install/install_all_win_pl_sgn.z.
This file is compressed obvious. The method I do not know (it's not compress [1]). Relevant information to contact me.
disadvantages of the update system
The update system has a devastating design flaw: When an update is found, no message and nothing installed. When the user with admin rights logs after the next reboot the update is displayed.
This is obviously a problem if the computer is not every day a fresh start - or if the user is not Admin.
is really sick because a restart is not technically necessary. It presents the to end browser and start the update program. The new version will be activated immediately.
Since the update system is partly built into the Flash Player plug-in, it only works if you use it. If you use Firefox or Opera for example (NPAPI) you will not be alerted to updates to the ActiveX Controls.
only as an administrator
Another disadvantage of the update system is that it only works if you use the web browser as an administrator. With a few tricks, it also works as a restricted user. If the user can write to the test file and the registry value (see above) indicates that runonce is also applied for limited users. However, does the update program itself only as an administrator. With the expressed Surun useful to work around this problem.
idea for a better update program
Theoretically, it should be possible to the version of the Flash Player to read DLLs. Then compare with the current version number from the XML document from Adobe's website to start these the updater. This program could be run from Task Scheduler every hour, so that updates appear immediately - even if you use just a Web browser.
The good news: I wrote this program already. I'll upload it in a few days if I do something I debugged.
The popular Google advertising Firefox in version 3.5.3 a detection of outdated versions of Flash Player. In fact, the recognition in the corresponding site is built. In the browser, it is only in version 3.6 hike.
This is a little slanted, but better than nothing. It is doubtful however, whether the people actually doing the update.
Soon I shall write something about Flash Cookies (LSO).
Tip: At the address http://www.adobe.com/software/flash/about/ you can view the version of the plugin / Controls. This page can be in the context menu of plug-in Open the "About Flash Player".
Links
- About Adobe Flash Player (Part 1: Blah blah) . C-Ko
- Adobe Flash Player Administration Guide for Flash Player 10 . Adobe
- Firefox: New version recognizes unsafe Flash plugin . Network World
- Mozilla protects users from outdated Flash plug-in . Heise Online
- Firefox: Spy program disguised as a Flash Update . The press
