[v1.05 HF] Found something interesting

[GimpyMgirk]

GOG people are having a little problem it seems and I am seeing the same thing. So I thought I would chime in and bring it to your attention Chris. After I read the topic I looked at the game, despite my excitement of it being released on GOG, to see if I could find the same or similar problems. I did. =(

Found in the Xenonauts "Community/forum" at GOG.

and I quote:

1-When launching the game, the game runs 43 scripts each time the game launcher is simply turned on. While I do not know what tools the game is created with. This is unusual behavior for a game, I have hundreds of games that do not do this. Makes me rather paranoid about what these scripts are doing. It seems that the launcher splash screen also tries to connect to the internet, which it should not be attempting without my permission(ex. a toggle switch to allow on/off?).

2-During game play, the player sends a team to a crash site. The game once again behaves strangely by what looks like an internet call out it should not be making. But it looks like it runs a script to call to itself over an http link regarding the specifications of the terrain and size of the players team. Why does the game do this? It should not be.

3-During game play again, the game seems to place strange files on the root of the system directory.

Example:

D:\t15.5

This is sloppy programming, any temporary files being created and removed should be within the games own file tree or in another location. NOT A SYSTEM ROOT DIRECTORY! This could possibly lead to a system file being changed and/or damaged that could impair your entire machine. This is a video game, not a system crucial application! The game should not be doing this.

After 32 years of gaming and hundreds of games in my library. I do not remember seeing such behavior in a game. While I do not think it is necessarily malicious, it does concern me that these problem make my anti virus warnings get tripped every time I want to play this game. Before anyone mentions I should turn off my AV or "ignore" these annoyances, that will be considered trolling and doesn't solve/fix these concerns.

END QUOTE

On my end.

This is the Windows version from GOG by the way v1.05HF. I am using Avast anti-virus that detects this stuff. I know for a 100% fact my machine is clean and it isn't the AV either. I know this having recently built this machine. It is an offline PC. The only thing on it at the moment is games from GOG(which don't have DRM). That is how I am seeing the mentioned behaviors. Which should not be happening. This behavior is often seen from malware. Running several scans does not find anything on my machine. However, it still mimics malware behavior.

Scanned with Malwarebytes and Avast AV. <-- for reference.

#1:

When clicking the icon to get the launcher, I see those scripts. Usually the Avast script scan is for online only scripts. Such as with a web browser. Never seen that from an offline program before and I have used Avast for years.

Dunno, what these are doing. Maybe trying to connect out to the internet? The launcher screen shows an RSS and a "retry" thing, trying to call out for icons, art? I think this should be changed as I don't appreciate anything making calling outs without my permission. I shouldn't have to adjust my firewall for this either. Kinda like painting a house and getting paid to do it but telling my customer to deal with it when I missed a large spot.

#2:

The in-game alien ship crash encounters. I see a http link. It is rather long.

For reference, partial http link-

h ttp://127.0.0.1/_utm.gif etc, etc, describing the games terrain or something. Googled this and came up with:

http://en.wikipedia.org/wiki/Localhost

Which describes something in the game creation process that got left in the game?

This most likely can be removed I think, yeah?

#3:

I see that alpha-numeric thing mentioned. After I press "Play" from the game launcher it brings me to the main game splash screen. Now this is where I am seeing that random alpha-numeric string in my Anti-Virus, getting triggered. It looks like it is only at this splash screen so far as I can tell. Also, when I hit the windows key on the keyboard to lower the game(forgot the word, tab it to the taskbar from full screen) FROM the splash screen, I then click it again to restore it from the taskbar and the game then spits out another 3 files to scan that are that randomly generated string.

Now I do not know what these strings are exactly or how they correlate with the games splash screen. But this behavior mimics malware. It is always in the root of the directory(for example C:\t3e6.19 but random each time) and is definitely repeatable.

Apart from being obviously dangerous for dropping (and removing? hidden? as I cannot see them when I look in that area after they are scanned) files from this area, is the fact that it is a system crucial area that if certain files get changed or damaged can brick someone's entire machine. That is not being paranoid at all, as that person from GOG mentions a little.

The only thing I could think of for an explanation, was that the splash screen has some animation going on behind those three male general characters in the control room(Exit, new game, load game, options area). That each time the splash comes up, there seem to be 3 files that are generated and removed(I think removed? perhaps hidden?). Why? I do not know. Why the root directory on a computer? That makes me nervous...like, a lot. Even if my explanation is correct, this behavior is very strange AND should NOT be aimed at the root directory.

Please feel free to email me if need be, but the information provided is pretty much all I have found so far regarding this topic. While I am not angry about this. I figure I should comment here in the hopes of these problems getting a fix. Or if nothin else, making people aware of this after reading about it from the other forum.

[Big Z]

I can't answer with any particular detail, but the underlying code of Xenonauts is legendary around here for jankiness and improvisational nature. It's built on a drastically sub-optimal engine that they only realized wasn't up to the task until it was too late in development. Whatever concessions and bizarre tricks made to get the game running are going to stay there; it's far too late, if not bordering on impossible for anyone, ever, to overhaul the core game code at this point.

tl;dr - Xenonauts is barely held together with duct-tape and the wishes of innocent children, this is likely the cause of the strange programming choices you're seeing.

[Chris]

Afaik the launcher only tries to connect to the internet because it has an RSS feed in it, which is innocent enough.

The game also has a stat tracking module in it that collects anonymised information on the missions played (aliens killed, weapons used etc) and uploads it to Google Analytics. There used to be a tickbox on the launcher to disable this. However, it caused stability issues in some instances so we removed the tickbox and disabled it.

Unfortunately, we discovered a couple of days back it doesn't seem to have been disabled properly. We have a fix done for it already, it'll be in the next build. As to what's going on with the root directory stuff, I don't know. We don't have the engine source code so we've no idea what it is doing.

[GimpyMgirk]

Afaik the launcher only tries to connect to the internet because it has an RSS feed in it, which is innocent enough.

The game also has a stat tracking module in it that collects anonymised information on the missions played (aliens killed, weapons used etc) and uploads it to Google Analytics. There used to be a tickbox on the launcher to disable this. However, it caused stability issues in some instances so we removed the tickbox and disabled it.

Unfortunately, we discovered a couple of days back it doesn't seem to have been disabled properly. We have a fix done for it already, it'll be in the next build. As to what's going on with the root directory stuff, I don't know. We don't have the engine source code so we've no idea what it is doing.

I am not talking about the game's engine. I was looking at the game itself after several hours of playing. I obviously don't expect you to have the game engine source code. But you CAN change the game's splash screen to not have animation and see if that is the cause of this strange behavior. Those 3 random files only appear at the splash(new game, exit area) and are either hiding or being removed/moved else where. Seriously, even if the game's engine is not a good one, games are not supposed to have virus like behaviors. Yours is behaving like one. I do not care if no one noticed this before that other person. I bought the game and then read the forum afterward to be made aware of this problem. I didn't have to look to hard to find the problem that can be reproduced every time the splash is opened.

If you want to know how to reproduce the behavior. Either go get a version of Avast or have the game in a window mode(which is also broken...) and open up your root directory(C:\ or D:\ or which ever yours is) if you are using windows. Have files set to not be hidden. And open the game from the launcher. I am not certain if the files are to quick to be seen with the naked eye. But any program like an AV with a normal real time file scanner should show you the last file scanned at the very least to prove what I am telling you is not good behavior.

You are selling a product. I am a paying customer. Not even looking into this matter is not a good way to enrich the quality of your product when paying customers are telling you of a problem that could damage our equipment.

Asking several of the leading anti virus groups on their forums to look over the game would be a good idea too. Avast offers an upload option if you ask around or ask a moderator. Don't use them? AVG, and Avira should have something similar.

I am a little frustrated as the I bought the game after waiting like everyone else for years to play it. Shocked to see it on GOG was an instant purchase of this long awaited title. After having it on a newly built machine and seeing the prospect of an infection is, well, frustrating. I would appreciate a little more interest in this particular matter.

I also ask anyone else using Avast or any other AV which shows real time scans of files to look for this behavior. After pressing play from the launcher and into the splash screen with the 3 generals in the games front menu options "exit, start new, load". Every time you tab out to the OS screen and restore the game to the splash, you reproduce those 3 randomly named files.

Please, comment. I really would appreciate the feedback from other users as well.

[Chris]

I don't wish to be rude, but there's absolutely no evidence I can see this is causing any harm to your computer. If the coders did not have anything to do I would certainly ask them to look into it, but that is not the case.

The coders on the team are working on porting the game or fixing issues that are affecting the enjoyment of the game for literally thousands of people. Remember that everyone else is paying customers too - I do value your opinion, but I have to value the opinions of others just as much as yours.

Bugs that affect everyone's enjoyment therefore take priority over bugs that only bother one person, and it is more than likely we will not be able to fix this issue even if we can identify it. It does not seem like a good use of limited developer time. If it is the animations (and you're just guessing at that), they are rendered via the engine and we can't change the way it works without source code access.

If you feel this issue means you can't play the game and you feel misled, I think you should seek a refund from GOG. I understand your position and I'm fine with them giving you a refund in that case (feel free to link them to this post if they want evidence of it).

[GimpyMgirk]

Being reasonable. You are and thank you. I think you maybe correct about my options. But I do not think I am being paranoid(I am saying it, not you).

I tend to have strong opinions and thoughts, but when I see such strange program behavior in the field of PC repair, I naturally want to resolve such problems. That is what I am good at.

I have to concede I am speculating the animation of the menu screen. But this is the localized source of the problem. This truly is a simple re-producible occurrence.

As to my concern regarding this matter, I really cannot state if it is a bad thing or not. But in short as I mentioned before, that is the problem with malware.

I shall consider a refund. But after years waiting for this game title. I may just wipe the drive and put the game on a lesser quality one just for your game. Yeah, I want it that much >_>

I hope you can bring this topic up to some of your programmers to even look at my posts and hope, if nothing else, it truly is benign. As obviously I want the success of your game to be a good experience and not shadowed by something bad in a future tense because of what a few people are seeing.

Thanks for your time and being polite despite my frustrated nature.

[Solver]

I have, for what it is worth, not been able to observe any files in my root folder during the main menu being up.

[Caaygun]

I'm not getting this file creation behaviour either. Maybe it's my ancient trusty WinXP.