The current message is misleading. It implies the user does not have a legal install of Halo Custom Edition despite not explicitly checking for product activation.
The function searches for 'HaloCE.exe' and nothing else.

This function may fail if the Halo Custom Edition was installed in an unconventional manner and is not installed to either HXE's working directory or to the game's default path in Program Files.

🚨 The automated release from the main branch failed. 🚨

I recommend you give this issue a high priority, so other packages depending on you can benefit from your bug fixes and new features again.

You can find below the list of errors reported by semantic-release. Each one of them has to be resolved in order to automatically publish your package. I’m sure you can fix this 💪.

Errors are usually caused by a misconfiguration or an authentication problem. With each error reported below you will find explanation and guidance to help you to resolve it.

Once all the errors are resolved, semantic-release will release your package the next time you push a commit to the main branch. You can also manually restart the failed CI job that runs semantic-release.

If you are not sure how to resolve this, here are some links that can help you:

• Usage documentation
• Frequently Asked Questions
• Support channels

If those don’t help, or if this issue is reporting something you think isn’t right, you can always ask the humans behind semantic-release.

No npm token specified.

An npm token must be created and set in the NPM_TOKEN environment variable on your CI environment.

Please make sure to create an npm token and to set it in the NPM_TOKEN environment variable on your CI environment. The token must allow to publish to the registry https://registry.npmjs.org/.

Good luck with your project ✨

Your semantic-release bot 📦🚀

The server-side will be backed by an XML file containing file links, mirrors, and hashes/checksums.

Planned uses:

• Download modular add-ons for SPV3 (Firefight, Legacies).
• The library must support resuming interrupted downloads.
• If a file does not match a checksum during a manually-initiated file validation procedure, download that file from a remote source.
  • To save bandwidth, compare the checksums of 8MiB chunks of the file. Requirements:
    • a server-end app to calculate chunks' checksums and cache them
    • download-managing library and the server must support segmented downloads. Alternatively, trick a library that supports resumeable downloads into "resuming" a damaged file.

Additionally, it would be nice if it has a link-crawler built-in.
Simply writing our own would be the normal solution, but we're short on time.

...and inform users that they should only report crashes on the newest version of SPV3.

This should become a higher priority when older versions are made available.

Notes

• This is to alllow IL trimming of code that does not reference WPF/WinForms
• Non-GUI namespace will remain as 'HXE'
• GUI namespace will be 'HXE.GUI', reflecting AmaiSosu's layout
• 'HXE.GUI' will become the main project because it needs to reference the non-GUI components; the default startup object will remain as 'HXE.Program' (Console App)

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz, ansi-regex-3.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

• commitizen-4.2.4.tgz (Root Library)
  • inquirer-6.5.2.tgz
    • strip-ansi-5.2.0.tgz
      • ❌ ansi-regex-4.1.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semantic-release/node_modules/ansi-regex/package.json,/node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex/package.json,/node_modules/cliui/node_modules/ansi-regex/package.json,/node_modules/yargs/node_modules/ansi-regex/package.json,/node_modules/wrap-ansi/node_modules/ansi-regex/package.json

Dependency Hierarchy:

• semantic-release-19.0.2.tgz (Root Library)
  • yargs-16.2.0.tgz
    • string-width-4.2.2.tgz
      • strip-ansi-6.0.0.tgz
        • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Dependency Hierarchy:

• commitizen-4.2.4.tgz (Root Library)
  • inquirer-6.5.2.tgz
    • string-width-2.1.1.tgz
      • strip-ansi-4.0.0.tgz
        • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1

Step up your Open Source Security Game with Mend here

See https://github.com/yumiris/SPV3/issues/13

If this menu doesn't already exist, then it would be great it did.

Related Issues

• #201

https://github.com/HaloSPV3/HXE/actions/runs/1204844353
https://github.com/HaloSPV3/HXE/actions/workflows/codeql-analysis.yml

https://gist.github.com/BinToss/26da68aa5a44b3707573069103231a1a

Thanks to ArecadianFox for help with research!

bool Setting;
long Offset = 0xc;
byte Value = Setting ? 0x01 : 0x00;

See HaloSPV3/Gemini#54 for planning and discussion.

KEY ISSUES

Native Interop

More often than not, this involves DllImport attribute on functions/methods marked with the extern keyword.
Wherever we call one of these methods, the caller should wrap this in a try-catch statement.
https://stackoverflow.com/a/970134/14894786

HXE.HCE.Registry

This class is used to discover an existing ProductID of either Retail (halo) or Custom Edition (haloce). If one if found, we use the same patch Chimera uses to skip redundant product activation checks when the game runs.

GUI windows

• Settings
• Positions
  Both of these windows use WPF which is Windows-only. This dependency could be replaced with UNO, Blazor (web app) or MAUI (not Linux-compatible) more easily than in the case of SPV3-Loader.

Runtime-Specific AppHosts

This is going to be interesting (read as 'aggravating') depending on whether we compile for Windows with some compatibility logic or compile separate apps for Windows and Linux hosts.

If we compile separate apps for each platform/runtime, there will be one less headache to deal with.
Otherwise, we'll have to work around Runtime and OS behavior being unexpectedly different from DotNet on Windows.

In either case, we will need to introduce platform-specific code paths.

I hope HXE.SFX won't become an issue...

This solution to remove duplicate files involves two issues.

• Files in the Halo CE installer may not be complete duplicates of those in the HXE payload.
  1. The Halo CE installer contains out-of-date files from Halo CE 1.0.0.609 (current version is 1.0.10.621).
• The SPV3 installer will need to be configured to copy over vanilla files.
  1. These files may need to be identified as missing in the SPV3 folder so currently present files aren't overwritten.
     -- Files which are present in the SPV3 folder might be newer than those found in the Halo CE installer. Avoid overwriting new files with older ones.
  2. The SPV3 installer may need to package the 1.0.10 update to source up-to-date Halo CE files.
     -- Again, files in the 1.0.1.0 update will need to be compared to the contents of the SPV3 folder to prevent overwriting up-to-date, but modified files (e.g. haloce.exe 1.0.10.621 + LAA patch)

This would circumvent the redistribution clause of Gearbox's Halo Custom Edition EULA while also cutting down on file count, but at what cost?

Additional Required Files for SPV3 packaging:
Halo Custom Edition 1.0.10.621 Update Package
—"haloce-patch-1.0.10.exe"

C:\Program Files\WindowsApps\ cannot be accessed without NT Service\TrustedInstaller or System authorization.

However, the apps' directories can be accessed with lesser authorization if accessed via their full path e.g. C:\Program Files\WindowsApps\Mutable\Microsoft.Chelan_1.1389.0.0_x64__8wekyb3d8bbwe.
The problem with this is the path changes with every update to the application.

We can get the exact path without caring about the app version by searching the subkeys of HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages for StartsWith("Microsoft.Chelan"). Read the contents of the String "PackageRootFolder".

From UWP install locations (modifiable and non-modifiable) - Topic on Talk:Halo: The Master Chief Collection - PCGamingWiki:

Modifiable

• "?:\\Program Files\\ModifiableWindowsApps\\HaloMCC"\\
• "?:\\ModifiableWindowsApps\\HaloMCC\\"

Non-modifiable

• "?:\\Program Files\\WindowsApps\\Microsoft.Chelan_*.*.*.*_x64_8wekyb3d8bbwe\\"
• "?:\\Program Files\\WindowsApps\\Mutable\\Microsoft.Chelan_*.*.*.*_x64_8wekyb3d8bbwe\\"
• "?:\\WindowsApps\\Microsoft.Chelan_*.*.*.*_x64_8wekyb3d8bbwe\\"
• REG_SZ PackageRootFolder of "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Chelan_*.*.*.*_x64_8wekyb3d8bbwe\\"

See Mutable Folder documentation.

This makes a bit more sense and would allow CheckProfileIntegrity() to be accessed elsewhere.

• #177
• ???

https://twitter.com/VoidsShadow/status/1450000709890424834

Hear the lament of one who must maintain a single-file, self-extracting installer that has a 64-bit-only feature and must run on both 32-bit and 64-bit platforms.

https://twitter.com/VoidsShadow/status/1450401081809416198

I couldn't find a way to create an 'Any CPU' app with net5.0+ tools despite implications in its source code and documentation, so I'll have to split 64-bit-only features to a separate application or library that is stored in and later extracted from a 32-bit SPV3 Installer.

😠

https://github.com/HaloSPV3/HXE/runs/3451724892

C:\Users\runneradmin\AppData\Local\Microsoft\dotnet\sdk\6.0.100-preview.7.21379.14\Microsoft.Common.CurrentVersion.targets(4343,5): error : MSB4803: The task "FormatUrl" is not supported on the .NET Core version of MSBuild. Please use the .NET Framework version of MSBuild. See https://aka.ms/msbuild/MSB4803 for further details. [D:\a\HXE\HXE\src\HXE.csproj]

We use the DotNet CLI to compile a .NET Framework 4.6.2 project which is a valid usage as indicated by local builds.
So, we can only assume that the CI environment is using the wrong libraries because it lacks the libraries it needs to for Net4.6.2 build tasks.

The DotNet SDK does have an equivalent to the FormatUrl task, but it's a Class rather than a Task. Also, we would need to somehow wrap this class as a task for backwards compatibility with GitVersion which does not appear to support this mixed environment.

https://docs.microsoft.com/en-us/dotnet/api/system.net.http.httpclient.-ctor?view=net-5.0#remarks

HttpClient is intended to be instantiated once and re-used throughout the life of an application. Instantiating an HttpClient class for every request will exhaust the number of sockets available under heavy loads. This will result in SocketException errors. Below is an example using HttpClient correctly.

public class GoodController : ApiController  
{  
    private static readonly HttpClient HttpClient;  

    static GoodController()  
    {  
        HttpClient = new HttpClient();  
    }  
}

If a reset is needed, use HttpClient.Dispose. This will dispose of child items such as HttpClientHandler.
However, it will NOT dispose of idle network sockets.

I may implement the class in this example if I'm feeling lazy.
https://stackoverflow.com/a/43169927/14894786

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: HXE/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

Step up your Open Source Security Game with WhiteSource here

The gamma settings aren't actually setting themselves to their saved value unless you visit the Video Settings menu after launching the game. Visiting the menu causes the gamma to correctly adjust to its set value simply by opening it. If you don't visit this menu prior to entering a mission, the Gamma settings never adjust.

Alternatively, the Gamma value in the Video Settings menu is not synced with the Gamma value in the Loader Settings and the two values have different fields of scope as to when their own saved values affect the game.

If haloce.exe cannot be found in the working directory, set our file's parent directory as the working directory.

Add a flag to overwrite this behavior.

This should help the contextual %path% mishaps ("place SPV3 in the correct folder", "*.dll no found", etc.)

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: HXE/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

Step up your Open Source Security Game with WhiteSource here

Two issues:

• Despite the resolution being decreased by {20,20}, the window is still set to {600,480}.
• I got the borderless hack to apply, but the style was restored to bordered a moment later.

Split from HaloSPV3/HCE#146

• Disable camera/reticule auto-centering in vehicles (Chimera 1.0's fixed auto-centering speed is preferable)
• Disable camera shaking
• Prevent descoping when taking damage

Resolved by a2e2f29

See GitTools/GitVersion#2627

If the plugin isn't provided valid credentials to push packages to NPM, it will throw an exception even if the plugin isn't utilized.

Then prompt to retry deployment.

• #179
• #180

[hxe] .github/workflows/release.yml (Lines 82-86)

    #- name: Test x86 compatibility
    #  run: |
    #    dotnet run --project src/ -r win-x86 -- --config

Open in IDE · Open on GitHub

^{Created from VS Code using CodeStream}

CVE-2021-23425 - Medium Severity Vulnerability

Vulnerable Library - trim-off-newlines-1.0.1.tgz

Similar to String#trim() but removes only newlines

Library home page: https://registry.npmjs.org/trim-off-newlines/-/trim-off-newlines-1.0.1.tgz

Path to dependency file: HXE/package.json

Path to vulnerable library: HXE/node_modules/trim-off-newlines/package.json

Dependency Hierarchy:

• semantic-release-17.4.5.tgz (Root Library)
  • commit-analyzer-8.0.1.tgz
    • conventional-commits-parser-3.2.1.tgz
      • ❌ trim-off-newlines-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

Publish Date: 2021-08-18

URL: CVE-2021-23425

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

This is rather complicated to accomplish programmatically, with or without using semantic-release.

I'll come back to this in a few months...maybe.

Though not particularly useful yet, this will be very important for transferring large amounts of data such as map updates.

docs:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Compression

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update actions/setup-dotnet action to v4.0.1
• chore(deps): update actions/setup-node action to v4.0.3
• chore(deps): update dependency microsoft.windows.compatibility to v8.0.7
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

We received conflicting reports of this issue.

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: HXE/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-28

Fix Resolution: jquery - 1.9.0

Step up your Open Source Security Game with WhiteSource here

Part of Project HaloSPV3/HCE#44

The intention is to drive MCC sales.

• Steam for Windows
• Steam for Linux (Dropped)
• Windows Store

Windows Store, Xbox

1. (sub-optimal solution) On Windows 10, check if the MS-HaloMCC(?) protocol has a registered application. Due to file/folder permissions, we are unable to scan its folder to verify CEA was installed, but this protocol means MCC itself is definitely installed.

• What is the real protocol?

OR

1. Ask for permission to invade privacy. Comply to GDPR.
2. Log in via Xbox Live
3. Scan Library or Played Games. Pitfall: if we can't detect games they own, but haven't played yet, then...I guess it's not our problem until they complain to us.

Steam

1. Have the user search for the MCC folder \steamapps\common\Halo The Master Chief Collection
2. In the background, hash some files to verify authenticity (might break if those files are updated, but this can help ensure it was purchased). .\steam_api64.dll is an okay candidate because it changes infrequently.
3. Infer the path Halo1.dll file steamapps\common\Halo The Master Chief Collection\halo1\halo1.dll and check if the file exists.
4. (optional) check the file size. If it's 20-50 MB, then it's probably legit. Hashing will require frequent upkeep, but file size range is more manageable.

OR

1. Ask for permission to invade privacy. Comply to GDPR.
2. Log in via Steam's implementation of OpenID,
3. Scan Library for MCC
4. Then scan for CEA DLC

References

• Steam
  • Steam Web API
  • OpenID Library
• Xbox
  • Xbox .NET API - Microsoft Docs
  • XSAPI overview - Microsoft Docs
  • Xbox Live Developer Tools
  • Third Party X API
  • Third Party OpenXBL | An Xbox Live API

The SHA will be stored in XML alongside download links.
This way, the file's hash will already be downloaded before the DLC itself is downloaded.

• Registry data has been mapped by HaloSPV3/HCE#90.
• Executable detection is incomplete.
• Executable wrapping is incomplete.
• Per-game kernel config is incomplete.
• Per-game game configuration is incomplete.

Executables
haloce.exe == Custom Edition (no performance/quality presets in GPU drivers)
halo.exe == Trial, Retail Editions (presets and compatibility rules in GPU drivers)

Directories
!!! Recommend the user change this if installing!
C:\Program Files (x86)\Microsoft Games\Halo Custom Edition
C:\Program Files (x86)\Microsoft Games\Halo
C:\Program Files (x86)\Microsoft Games\Halo Trial

Registry

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Games]

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Games\Halo]
"Zone"="http://www.zone.com/asp/script/default.asp?Game=Halo&password=Password"
"DistID"=dword:0000035c
"Version"="1.10"
"Launched"="1"
"PID"="00000-000-0000000-00000"
"DigitalProductID"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"EXE Path"="J:\\Games\\Halo Retail"
"CDPath"="H:\\Downloads\\Games\\Halo1\\Installers and Official Files\\"
"VersionType"="RetailVersion"
"InstalledGroup"="1"
"LangID"=dword:00000009
"PendingVersion"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Games\Halo CE]
"Version"="1.10"
"DistID"=dword:0000035c
"Launched"="1"
"PID"="00000-000-0000000-00000"
"DigitalProductID"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"EXE Path"="J:\\Games\\Halo Custom Edition"
"CDPath"="H:\\Downloads\\Games\\Halo1\\Installers and Official Files\\"
"VersionType"="TrialVersion"
"InstalledGroup"="1"
"LangID"=dword:00000009
"PendingVersion"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Games\Halo HEK]
"Launched"="1"
"PID"=""
"DigitalProductID"=hex:
"EXE Path"="J:\\Games\\Halo Custom Edition"
"CDPath"="H:\\Downloads\\Games\\Halo1\\Installers and Official Files\\"
"VersionType"="TrialVersion"
"InstalledGroup"="1"
"LangID"=dword:00000009

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Microsoft Games\Halo Trial]
"Version"="1"
"Launched"="1"
"PID"=""
"DigitalProductID"=hex:
"EXE Path"="J:\\Games\\Halo Trial"
"CDPath"="H:\\Downloads\\Games\\Halo1\\Installers and Official Files\\"
"VersionType"="TrialVersion"
"InstalledGroup"="1"
"LangID"=dword:00000009

We can read the values of the registry subkeys "PID" and "DigitalProductID" if we want to verify the product was activated with a product activation key.

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: HXE/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: HXE/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: b11d09ef257e368ecf6bea05c01ebb50787679d2

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with WhiteSource here

Scenario:
The user has limited free space on C:\ and so tries to install on a different volume. Even if that volume has plenty of free space, SPV3 cannot be installed unless there is enough free space to temporarily extract to %temp% on C:.

Solution A:

Copy compressed packages individually. After extracting to the user's target path, discard the temporary files to make room for the next one.
This still relies on the C:\ drive's free space.

Solution B:

Load the compressed package files to memory, then copy them to target drive.

• Should the packages be decompressed to a location in memory before writing to disk? This requires up to 4GB of free memory for the operation to succeed. Users with very limited memory (<=8GB ) will have difficulties with this.
• Should the packages be copied to the destination before decompressing? This requires more free space on the destination drive.

Solution C:

Invoke Disk Cleanup (cleanmgr.exe) as admin to clear...ALL?

• Alternatively, invoke third-party wrapper, BuiltByBel's Cleanmgr+. Some of cleanmgr.exe's features were moved to a different app/service in Win10. This wrapper provides a modern UI that combines all of cleanmgr.exe's features in one place.