Unity Completed Morningstar: Book of the Fallen [v1.1.2b] [Droid Productions]

4.60 star(s) 27 Votes

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
Hey Droid, I saw lots of hotfixes for a vulnerability in Unity affecting many games on my Steam news feed yesterday.

It seems to be an issue with the engine's security.

I bought your Love of Magic trilogy and Morningstar. Have your games been affected? :unsure:.
Steam has apparently already updated to fix it on their side, but I'll likely need to rebuild all my games today. There'll be an updated version of Morningstar and Love of Magic here soon; Wings of Empire's a little more complex, since it's literally in mid-update (on day 48 now, with Act II ending on day 39). I'll need to do some active cutting or patching to make that work.
 

Avaron1974

Resident Lesbian
Aug 22, 2018
28,087
97,010
1,021
Steam has apparently already updated to fix it on their side, but I'll likely need to rebuild all my games today. There'll be an updated version of Morningstar and Love of Magic here soon; Wings of Empire's a little more complex, since it's literally in mid-update (on day 48 now, with Act II ending on day 39). I'll need to do some active cutting or patching to make that work.
So Steam has already sorted the issue, our games on there should be fine then?

I mean, we don't need anything from you update wise?
 

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
So Steam has already sorted the issue, our games on there should be fine then?

I mean, we don't need anything from you update wise?
Unity is saying that "Steam is performing mitigation on their side", but what that means when you strip out the corpo-speak I don't know.

There are no signs that there are existing exploitations of the bug, but (allowing argument injection to hijack one game or app maliciously). Obviously, by the time you're downloading and running an exe from here (hopefully using or a similar tool), you're already at risk of an unknown application running code on your machine.

It's a bigger deal on mobile; if I'm reading it right, it would allow a thirdparty app to open up a known app (say, your banking app, if they were dumb enough to build that in Unity), with libraries that weren't intended for it. I'd guess the first place it WILL be hacked is crypto gaming, since there you have a combination of applications running on Unity and handling things an attacker really wants to get their hands on. Obviously I don't do anything like that.

In the end, it's just better practice to patch the hole now, before I forget, and before malware that exploit it come online. I'm not looking *forward* to spending my day building 5 games (LoM + MS + WoE) x 2 SKUs (Steam + non-steam) x 3 platforms (Win64, OSX, Linux). It'll be something like 180GBs worth of uploads, at this point :|
 
  • Wow
Reactions: PickerLewd

motseer

Forum Fanatic
Dec 17, 2021
4,823
12,403
637
Unity is saying that "Steam is performing mitigation on their side", but what that means when you strip out the corpo-speak I don't know.

There are no signs that there are existing exploitations of the bug, but (allowing argument injection to hijack one game or app maliciously). Obviously, by the time you're downloading and running an exe from here (hopefully using or a similar tool), you're already at risk of an unknown application running code on your machine.

It's a bigger deal on mobile; if I'm reading it right, it would allow a thirdparty app to open up a known app (say, your banking app, if they were dumb enough to build that in Unity), with libraries that weren't intended for it. I'd guess the first place it WILL be hacked is crypto gaming, since there you have a combination of applications running on Unity and handling things an attacker really wants to get their hands on. Obviously I don't do anything like that.

In the end, it's just better practice to patch the hole now, before I forget, and before malware that exploit it come online. I'm not looking *forward* to spending my day building 5 games (LoM + MS + WoE) x 2 SKUs (Steam + non-steam) x 3 platforms (Win64, OSX, Linux). It'll be something like 180GBs worth of uploads, at this point :|
Wow! This is the third time in the last year that a product or products that I have on Steam have been compromised in some way. Not only that, but it's only been slightly over a year ago that I got email notification to change my password because there was a possibility that had been compromised. I have not had any issues directly affect my account or my pc as of yet with any of these events, but it starts to make a guy wonder...
 

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
Wow! This is the third time in the last year that a product or products that I have on Steam have been compromised in some way. Not only that, but it's only been slightly over a year ago that I got email notification to change my password because there was a possibility that had been compromised. I have not had any issues directly affect my account or my pc as of yet with any of these events, but it starts to make a guy wonder...
Not a steam issue this time, it's purely Unity's fault :)

As far as anyone knows there are no exploits in the wild; this was detected by a security researcher and escalated to Unity before it went public. It does however have the potential to be exploited, so... better to patch it now. The steam updates should be reasonably painless, since it's just updating the EXE. F95zone is going to be annoying, since I need to upload the whole thing, but on the positive side it does mean you guys get some content that's so far only been sitting on the Steam build :)

lin_selfie_short_skirt5.png
 

QQP_Purple

Well-Known Member
Dec 11, 2020
1,487
1,738
207
It's a bigger deal on mobile; if I'm reading it right, it would allow a thirdparty app to open up a known app (say, your banking app, if they were dumb enough to build that in Unity), with libraries that weren't intended for it.
You would be surprised... I can't really talk about that though. What I can talk about is the fact that slot machines all run on Unity. At least all of ones from a particular brand I can't name. Sorry for being cryptic but like that's all I can reasonably say.
 
  • Like
Reactions: Droid Productions

Avaron1974

Resident Lesbian
Aug 22, 2018
28,087
97,010
1,021
Wow! This is the third time in the last year that a product or products that I have on Steam have been compromised in some way. Not only that, but it's only been slightly over a year ago that I got email notification to change my password because there was a possibility that had been compromised. I have not had any issues directly affect my account or my pc as of yet with any of these events, but it starts to make a guy wonder...
It's not Steam it's the engines devs use that end up with exploits.

Unity can be a bitch for it.
 
  • Like
Reactions: motseer

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
You would be surprised... I can't really talk about that though. What I can talk about is the fact that slot machines all run on Unity. At least all of ones from a particular brand I can't name. Sorry for being cryptic but like that's all I can reasonably say.
Yeah, I can see the problem in embedded systems like that that provide anything of real value. Especially where distribution is physical.
 

motseer

Forum Fanatic
Dec 17, 2021
4,823
12,403
637
It's not Steam it's the engines devs use that end up with exploits.

Unity can be a bitch for it.
Yeah, I understand it's a Unity issue in this case. But sometimes back doors lead to back alleys... Steam has had a couple of problems in the past, one of which I know started with an exploit to a product they hosted. I have no clue what the password leak was about. I just got an email suggesting it would be a good idea to change it. Can't help getting a bit nervous when things start to pile up. I'm not trying to pick on Steam here... just tossing in my 2 cents. About the only thing Steam does for me is provide a platform to contribute to devs like Droid or buy products like Fallout or Skyrim. I never play through it. In the cases of big games I use modified launcher programs and block Steam from running in the background. Smaller products like LoM, Morningstar and others I download and run without Steam as well.
 

QQP_Purple

Well-Known Member
Dec 11, 2020
1,487
1,738
207
Yeah, I understand it's a Unity issue in this case. But sometimes back doors lead to back alleys... Steam has had a couple of problems in the past, one of which I know started with an exploit to a product they hosted. I have no clue what the password leak was about. I just got an email suggesting it would be a good idea to change it. Can't help getting a bit nervous when things start to pile up. I'm not trying to pick on Steam here... just tossing in my 2 cents. About the only thing Steam does for me is provide a platform to contribute to devs like Droid or buy products like Fallout or Skyrim. I never play through it. In the cases of big games I use modified launcher programs and block Steam from running in the background. Smaller products like LoM, Morningstar and others I download and run without Steam as well.
Same here. Like, I will pay money to support a dev if I like the product. But when it comes to actually playing I just get a pirated version from a source I know is clean.
 
  • Like
Reactions: motseer

motseer

Forum Fanatic
Dec 17, 2021
4,823
12,403
637
... from a source I know is clean.
Heh..., mostly. Even sites like this one get penetrated once in a while. I think the zone does a pretty exceptional job of monitoring and prevention. They seem to catch any breeches very quickly. I think it's partially because of the feedback and the community tbh.
 

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
Heh..., mostly. Even sites like this one get penetrated once in a while. I think the zone does a pretty exceptional job of monitoring and prevention. They seem to catch any breeches very quickly. I think it's partially because of the feedback and the community tbh.
There HAS been a few cases of a 'local hero' uploading games to my game pages, which is usually sphincter-clenching; I've got no idea if there's malware in there, and I'm not allowed to take them down. The fact that they're very often just pure steam builds, without the steam SDK calls (for things like achievements) taken out, so they crash on start, doesn't do much to reassure me :|
 
  • Like
Reactions: motseer

motseer

Forum Fanatic
Dec 17, 2021
4,823
12,403
637
There HAS been a few cases of a 'local hero' uploading games to my game pages, which is usually sphincter-clenching; I've got no idea if there's malware in there, and I'm not allowed to take them down. The fact that they're very often just pure steam builds, without the steam SDK calls (for things like achievements) taken out, so they crash on start, doesn't do much to reassure me :|
That's one of many reasons we appreciate your continued involvement with this site. Those "in-the-know" wait for your updates. Thanks Droid!
 

Raoul9753

Newbie
Aug 22, 2020
43
36
173
Question: If I skip combats on my second playthrough, do I get negative effects from that? Will it change the story somehow?
I liked the combat system just fine, but for a second playthrough I am more focused on the story changes.
 

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
Question: If I skip combats on my second playthrough, do I get negative effects from that? Will it change the story somehow?
I liked the combat system just fine, but for a second playthrough I am more focused on the story changes.
Nothing bad happens; I'm a big fan of what I call "affordance", or the idea that people should be allowed to play the content they like, and skip the stuff they don't.

There's also a built in debug menu (Ctrl+J) if you find yourself short of cash, etc.
 

Droid Productions

[Love of Magic & Morningstar]
Donor
Game Developer
Dec 30, 2017
7,785
20,223
930
lin_selfie_short_skirt5.png

DOWNLOAD
Win64: - - MEGA - -
Linux: - - MEGA - -
Mac: - - MEGA - -


This update fixes the recently announced security issue with Unity games, switches all images to use lossless compression (which is why the size went up), and adds three new Facial events (two with Lin and one with Snowdrop) that you can access if you've completed their paths by triggering Game+ mode (loading the end of Game save, and continue playing from Day 115+).

It's also the last day of the Steam Autumn sale, so if you've always wanted to support the dev, now's a good time :)

 
4.60 star(s) 27 Votes