Using AutoIT to deploy patches

[wfuehrer]

Hi!

I added some code to implement a KB000000 and MS00-000 link in your patchlist editor. So you have quick access to the online resources from microsoft to read the full articles and you can easy download the missing patchfiles if you get a new patchlist.csv or start with an empty project.

On section ; Create other GUI Elements ~ line 96 add:

$GUI_Label_Qnumber_url = GUICtrlCreateLabel   ("KB-Link", 280, 420, 75,  20, $SS_SUNKEN+$SS_CENTER)
GuiCtrlSetFont(-1, 9, 400, 4)
GuiCtrlSetColor(-1, 0x0000ff)
GuiCtrlSetCursor(-1, 0)
GuiCtrlSetTip(-1, 'http://support.microsoft.com/default.aspx?scid=kb;en-us;xxxxxx')

and

$GUI_Label_Bulletin_url = GUICtrlCreateLabel   ("MS-Link", 280, 440, 75,  20, $SS_SUNKEN+$SS_CENTER)
GuiCtrlSetFont(-1, 9, 400, 4)
GuiCtrlSetColor(-1, 0x0000ff)
GuiCtrlSetCursor(-1, 0)
GuiCtrlSetTip(-1, 'http://www.microsoft.com/technet/security/bulletin/MSxx-xxx.mspx')

On section ; Display the GUI and wait for user input ~ line 167 under the While 1 add:

GuiCtrlSetTip($GUI_Label_Qnumber_url, 'http://support.microsoft.com/default.aspx?scid=kb;en-us;' & GUICtrlRead($GUI_Input_QNumber))
    GuiCtrlSetTip($GUI_Label_Bulletin_url, 'http://www.microsoft.com/technet/security/bulletin/' & GUICtrlRead($GUI_Input_Bulletin) & '.mspx')

and lower under the ; Buttons section ~ line 220 add:

Case $GUI_Msg = $GUI_Label_Qnumber_url
        _StartURL('http://support.microsoft.com/default.aspx?scid=kb;en-us;' & GUICtrlRead($GUI_Input_QNumber))
    Case $GUI_Msg = $GUI_Label_Bulletin_url
        _StartURL('http://www.microsoft.com/technet/security/bulletin/' & GUICtrlRead($GUI_Input_Bulletin) & '.mspx')

At the bottom of PatchListEditor.au3 add the often used/published function:

Func _StartURL($s_StartPath)
    If @OSType = 'WIN32_NT' Then
        $s_StartStr = @ComSpec & ' /c start "" '
    Else
        $s_StartStr = @ComSpec & ' /c start '
    EndIf
    Run($s_StartStr & $s_StartPath, '', @SW_HIDE)
EndFunc

That's it ...

At the moment i'm splitting the mssecure.xml with some code to generate a bulletin overview text with all necessary parameters for the patchlist.

CU

Wolfgang

Edited June 5, 2005 by wfuehrer

[wfuehrer]

Hi!

I need some help.

ALL patches appear with their install dialogs and want to reboot (if necessary) in spite of using "/passive /quiet /norestart" options.

Wolfgang

[SvenP]

Hi!

I added some code to implement a KB000000 and MS00-000 link in your patchlist editor. So you have quick access to the online resources from microsoft to read the full articles and you can easy download the missing patchfiles if you get a new patchlist.csv or start with an empty project.

....

That's it ...

At the moment i'm splitting the mssecure.xml with some code to generate a bulletin overview text with all necessary parameters for the patchlist.

CU

Wolfgang

<{POST_SNAPBACK}>

Hello Wolfgang,

Great job. I will include it in the next version of the editor.

I had also started with the XML file some time ago. But I didn't have the time finishing it. Attached is a code-snippet that filters out some components from mssecure.xml

Regards,

-Sven

parsexml.au3

[SvenP]

Hi!

I need some help.

ALL patches appear with their install dialogs and want to reboot (if necessary) in spite of using "/passive /quiet /norestart" options. 

Wolfgang

<{POST_SNAPBACK}>

Wolfgang,

Did it work before? Or have you updated to a newer AutoIt3 version?

The best way to debug this, is by using a patchlist.csv containing only one line (like the test file I included in the ZIP). I guess it goes wrong somewhere around the Runwait statement.

Secondly: you did include a space between the name of the executable and the silent parameters?

Regards,

-Sven

[wfuehrer]

Hi!

Space is there - of corse ...

My way is not so professioanl but small steps reach the target too

First i split the categories to single files -> split_mssecure.au3

Then i split the bulletins to single files -> split_bulletins.au3

To only extract one bulletin i worte -> extract_bulletin.au3

Next step is to modify the bulletin.xml to get line i can test in an easy way -> bulletin_info.au3

Now i have to read each interesting "->" line and can parse the categories for informations. The files categorie is a little bit nested (First filename - then the patched fileID). So i first i have to mention last filename by parsing lines and remember it when reaching the fileID. I hope to have time at weekend to finish this.

The final cut will be merging this modules to one programm ...

CU

Wolfgang

split_mssecure.au3

split_bulletins.au3

extract_bulletin.au3

bulletin_info.au3

Compile the scripts and put them together with mssecure.xml .

Edited June 8, 2005 by wfuehrer

[wfuehrer]

Hi!

After inserting a debug message window i think i found the bug. The path variable is not executed/completed correctly.

I modified the parameter parsing from

Case $CommParam = "s" or $CommParam = "source"
$NumParams = $NumParams + 1
; Next parameter is location of patches
$PatchDir = $CmdLine[$NumParams]

to

Case $CommParam = "s" or $CommParam = "source" 
$NumParams = $NumParams + 1
; Next parameter is location of patches
$PatchDir = $PatchDir & "\" & $CmdLine[$NumParams]

$PatchDir is defined as @ScriptDir before. So you get the whole path.

BTW: I can't use the -d option. When i use it the notpad.exe opens and the whole process stopps ...

[wfuehrer]

Hi!

Here is my working stuff without any patchfiles. You can download them by yourself - use the KB-Link to find them - and store in "patches\winxp". The filenames in the patchlist.csv will match with the downloaded filenames.

With this enviroment you can full patch a Windows XP till MS05-020. SP2 and .Net have to be downloaded manually for using the batchfiles. Office 2003 patches are not included - they will follow later.

The mssecure.exe and PatchList.exe are compiled with 3.1.1.44 (no password). My changes begin with <wfg> and end with </wf>.

Look at the FileList.txt for the necessary contends and remarks.

@SvenP: The "insert row" button inserts above the last entry (uses the marked row number). So it's impossible to add a line at the bottom when new patches are included. Can you change it? At the moment my "reboot" line ist last for ever - so i can insert new patches at the right position.

Thanks for your work ...

Wolfgang

mspatch.zip

Edited June 10, 2005 by wfuehrer

[John-Paul]

Hi!

Here is my working stuff without any patchfiles. You can download them by yourself - use the KB-Link to find them - and store in "patches\winxp". The filenames in the patchlist.csv will match with the downloaded filenames.

With this enviroment you can full patch a Windows XP till MS05-020. SP2 and .Net have to be downloaded manually for using the batchfiles. Office 2003 patches are not included - they will follow later.

The mssecure.exe and PatchList.exe are compiled with 3.1.1.44 (no password). My changes begin with <wfg> and end with </wf>.

Look at the FileList.txt for the necessary contends and remarks.

@SvenP: The "insert row" button inserts above the last entry (uses the marked row number). So it's impossible to add a line at the bottom when new patches are included. Can you change it? At the moment my "reboot" line ist last for ever - so i can insert new patches at the right position.

Thanks for your work ...

Wolfgang

mspatch.zip

<{POST_SNAPBACK}>

I have just implemented the wonderful tips that Wolfgang has provided and I have just compiled the PatchListEditor.au3 file using Beta v3.1.1.46 and get an error.

Not being a real programmer I am unsure where this is coming from, searched in groups but nothing specific and takes a long time to find so hope someone can help.

The error that pops up is...

Line 0 (File "........"):

Local $p = DllStructCreate ($struct)

Local $p = ^ ERROR

Error: Unknown function name.

The MSPATCH.aU3 compiles and works so not sure why this is happening and I have tried to compile serveral times with other versions and all the same rersult.

Help most appriciated.

jp

Edited June 13, 2005 by John-Paul

[SvenP]

Hi!

Here is my working stuff without any patchfiles. You can download them by yourself - use the KB-Link to find them - and store in "patches\winxp". The filenames in the patchlist.csv will match with the downloaded filenames.

...

mspatch.zip

<{POST_SNAPBACK}>

Hello Wolfgang,

Thanks for your contributions. I was so busy with reprogramming AutoIt (changes in COM and adding ActiveX support), that I completely forgot this topic.

As soon as I'm ready I'll take my time for MSPatch and check out all those new shiny things you added :-)

Regards,

-Sven

[John-Paul]

Hello Wolfgang,

Thanks for your contributions.  I was so busy with reprogramming AutoIt (changes in COM and adding ActiveX support), that I completely forgot this topic.

As soon as I'm ready I'll take my time for MSPatch and check out all those new shiny things you added :-)

Regards,

-Sven

<{POST_SNAPBACK}>

Thought I would add the file so someone can look at it. It's RAR compression hope you have it.

I have added a couple of creative tweaks so hope you don't mind SvenP.

1: Added a Release Date Field, so I can see how old or current a patch maybe and thus look it up on the net else these's so many numbers I don't know whats what.

2. Added an Exit button at the bottom on the GUI so I don't have to keep going to the menu.

3. Tidied up the buttom alignments so they look nice, Well I just like doing that sort of thing.

All snips of extras have dates deside them or above them.

Hope we can fix the bug I have with it though as I would like to compile it. As per my original post.

jp

PatchListEditor.rar

[wfuehrer]

Hi!

I will look at your things later the week - tomorrow is patch day and i have mutch work in our domain ....

Now i will show you some very raw work to get information about a patch by parsing the mssecure.xml .

First use "split_mssecure.exe", then "split_bulletins.exe" to build the folder strukture and the necessary file-splits.

Then you can start "bulletin_info.exe" to get a text file with the completed information from the other categories.

Now you can see all changes made to files with version number, added or testet registry keys, download locations and many more for each affected system and/or service pack level.

Nothing is deleted till this point - only added. So you can prove the output.

Lines beginning with ==> contain the extra catogorie informations - sometimes nested.

Next step will be a friendly format ... and some polish to the code

All compiled without password and with version 3.1.1.44.

CU

Wolfgang

bulletin_info_files.zip

Put the files together with mssecure.xml in one folder

[John-Paul]

Added a little fix to PatchListEditor today.

Noticed that when I moved my mouse away from the GUI and clicked on another object without a file loaded it would crash.

So added the following.

Original code at line 235

CODE:

$NewListViewSelection = ControlListView ( WinGetTitle(""), "", $GUI_listview_Contents, "GetSelected" ,0 )

If $NewListViewSelection >= 0 and $NewListViewSelection <> $gCurrentListViewSelection then

DoListViewChange($NewListViewSelection)

$gCurrentListViewSelection=$NewListViewSelection

EndIf

Alternate new code.

CODE:

; We check first to see that there is a file loaded before the check process is performed.

If $gStrPatchListName="" Then

; only checking to see if we have a file loaded

Else

If $NewListViewSelection >= 0 and $NewListViewSelection <> $gCurrentListViewSelection Then

DoListViewChange($NewListViewSelection)

$gCurrentListViewSelection=$NewListViewSelection

EndIf

EndIf

This seems to allow me to now move around the desktop without a file loaded and without crashing.

Hope its usefull.

jp

[wfuehrer]

Hi!

Added some code in "PatchListEditor.au3" to load "PactList.csv" automatically if availiable.

Insert Code between <wf> and </wf> - it starts near line 165:

; Display the GUI and wait for user input
GuiSetState()

;<wf>
if FileExists("Patchlist.csv") Then
  DoFileOpen("Patchlist.csv")
EndIf
;</wf>

While 1
        
  $GUI_Msg = GuiGetMsg()
  Select
 ; Menu Items
  Case $GUI_Msg = $GUI_EVENT_CLOSE or $GUI_Msg = $GUI_FileExit
  If $gbPatchListModified Then; Check if user has a patchlist open that was not saved
    If DoFileAskToSave() <> $IDCANCEL then ExitLoop
    Else
      ExitLoop
    EndIf
  Case $GUI_Msg = $GUI_FileNew
    DoFileNew()
  Case $GUI_Msg = $GUI_FileOpen
   ;<wf>
    DoFileOpen("")
   ;</wf>
  Case $GUI_Msg = $GUI_FileSave
  DoFileSave()
  ....

Now the function "DoFileOpen" has a parameter.

You have to change the function, too. It starts near line 310:

;<wf>
Func DoFileOpen($string);added $string parameter
;</wf>
If $gbPatchListModified Then; Check if user has a patchlist open that was not saved
If DoFileAskToSave() = $IDCANCEL then Return
EndIf
;<wf>
if $string = "" Then
 ;Show Open Dialog
  $strTmpFileName=FileOpenDialog("Open Patchlist",$gStrDefaultOpenDir,"PatchList files (*.csv)")
  Else
  $strTmpFileName=$string
  EndIf
;</wf>
#cs; old code
;Show Open Dialog
$strTmpFileName=FileOpenDialog("Open Patchlist",$gStrDefaultOpenDir,"PatchList files (*.csv)")
#ce
If not @error and $strTmpFileName <> "" then
If FileExists($strTmpFileName) then
....

That's it.

Now a double klick on the editor loads the "Patchlist.csv" it availiable.

CU

Wolfgang

[wfuehrer]

Hi!

Here are the updated Patchlist.csv for Win XP SP2 and Win 2003 SP1 post hotfixes.

Workflow is tested on workstations and servers.

Sometimes the MSXML 4.0 Patch shows an error ... i'm working on it.

CU

Wolfgang

[wfuehrer]

Hi!

Update Rollup 1 for Windows 2000 SP4 is out.

See http://support.microsoft.com/kb/891861

The Update includes all Security patches from SP4 till 30.04.2005 and add several other improvements.

So you can ease the workstation patching for Win 2000.

We will test the update in our server enviroment - i will publish the results here. There were problems after some patches...

CU

Wolfgang

[John-Paul]

Hi!

Update Rollup 1 for Windows 2000 SP4 is out.

See http://support.microsoft.com/kb/891861

The Update includes all Security patches from SP4 till 30.04.2005 and add several other improvements.

So you can ease the workstation patching for Win 2000.

We will test the update in our server enviroment - i will publish the results here. There were problems after some patches...

CU

Wolfgang

<{POST_SNAPBACK}>

Following on from your alternate CSV files for XP and 2000 as well as the automatic load of the mapatch.csv file I added another tweak that will help.

Actually all gratiude goes to those in the forum as I there was great help in getting this.

As for line code sequence it may not be accurate to the original file with the alterations however I'm sure you will pick up on where to place them.

The addon is a menu item to list all CSV files and by using this method its quicker to load the files than to use the Open File menu.

CODE:

;<jpm> Create CSV's Menu

$GUI_CSVsMenu = GUICtrlCreateMenu ("&CSV Files")

;<jpm>

CODE:

GUICtrlSetState($GUI_Button_SortByDate, $GUI_DISABLE) ; added 28/Jun/2005

CODE:

; File menu source courtesy of ezzetabi

; Ref: #88126

Local $aFList = '', $sFiles, $hCSV = FileFindFirstFile('*.CSV')

While 1

$sFiles = FileFindNextFile($hCSV)

If @error Then

FileClose($hCSV)

ExitLoop

EndIf

$aFList = $aFList & @LF & $sFiles

WEnd

$aFList = StringTrimLeft($aFList, 1)

$aFList = StringSplit($aFList, @LF)

_ArraySort($aFList,0,1); first position (number of items) must stay there

For $c = 1 To $aFList[0]

$aFList[$c] = GUICtrlCreateMenuItem($aFList[$c], $GUI_CSVsMenu)

Next

;</ezzetabi>

CODE:

Case Else

;Thanks to <Zedna> for this snippit

;ref #88304

For $c = 1 To $aFList[0]

If $GUI_Msg = $aFList[$c] Then

$menuitem = GUICtrlRead($aFList[$c],1)

;MsgBox(0, "Name of selected file", $menuitem[0])

DoFileOpen($menuitem[0])

EndIf

Next

;<Zedna>

EndSelect

Thats it, now you should have a menu item called CSV Files and it will list in alphabetical order those found in the current directory.

Enjoy.

[PeteW]

First of all, thanks to SvenP for starting this of - very useful!

I've a couple of points to add re: PatchListEditor

1) I noticed that criteria based on certain FileGetVersion() tests were not working as expected. This isn't a bug, but is due to string comparisons involving < and > e.g. "9" is not less than "10" (as you might first expect).

I posted a _StringCompareVersions() UDF and placed this in MSPatchFunctions.au3

http://www.autoitscript.com/forum/index.php?showtopic=13448

2) I then found I couldn't use _StringCompareVersions() in the criteria field!

SvenP explained why in http://www.autoitscript.com/forum/index.ph...opic=7607&st=15

"SlimShady's _Execute() function runs OUTSIDE the context of the current script. So it doesn't know about UDF's or local variables defined."

However, AutoIT beta 3.1.1.56's Eval() seems to work fine with all functions - built-in and UDF.

To reduce the number of amendments, I simply changed SpecialEval():

Func SpecialEval($LineofCode)
    Local $RetVal = ""
    If $LineofCode = "" Then Return "0"; Empty lines are always false
    
    $HSM = "HKLM\Software\Microsoft"; I use this as a shortening 'macro-like' replacement in the CSV file,
;  SpecialEval not working with UDFs. In 3.1.1.56 built-in Eval() seems to work OK with all functions, including UDFs.
    $RetVal = Eval($LineofCode)
    Return $RetVal
;...
EndFunc

3) With _StringCompareVersions() working, criteria can be simplified with an _OldFileVerExists() function, also added to MSPatchFunctions.au3.

This is generally used in the 'Patch is required' field - e.g. for the recent KB901214, instead of using:

_StringCompareVersions(@SystemDir & "\icm32.dll","5.1.2600.2709")=-1 And FileGetVersion(@SystemDir & "\icm32.dll")<>"0.0.0.0"

I now use:

_OldFileVerExists(@SystemDir & "\icm32.dll","5.1.2600.2709")

The function returns "1" (patch is required) only if the file exists and is older than the specified Version.

Func _OldFileVerExists($s_Filename, $s_Version)
; Simplify (& shorten) the Criteria - uses my _StringCompareVersions() UDF
;   We usually install an update only if the current file: (a) exists and (b) is older than the version you're installing.
    If (FileGetVersion($s_Filename) <> "0.0.0.0") And (_StringCompareVersions(FileGetVersion($s_Filename), $s_Version) = -1) Then
        Return 1
    Else
        Return 0
    EndIf
    
EndFunc  ;==>_OldFileVerExists

Cosmetic changes:

4) When it loses focus, PatchListEditor displays the 1st line - I want it to keep the current line displayed.

Amended John-Paul's 'alternate new code' post of 14/06/05, by adding:

'If @error Then $NewListViewSelection = $gCurrentListViewSelection'

;...
; We check first to see that there is a file loaded before the check process is performed.
    
    $NewListViewSelection = ControlListView(WinGetTitle(""), "", $GUI_ListView_Contents, "GetSelected", 0)
; If PatchListEditor is no longer in focus, $NewListViewSelection=0 & @error=1. In this case, don't change the current selection.
    If @error Then $NewListViewSelection = $gCurrentListViewSelection
    
    If $gStrPatchListName = "" Then
    ; only checking to see if we have a file loaded
; ...etc.

5) Having added Wolfgang's code in to auto-load a .CSV, noted it doesn't auto-display the 1st line. In the 'GLOBAL VARIABLES' section:

Dim $gCurrentListViewSelection = -1; Row number selected in Listview. -1 ensures the 1st line (0) is displayed.

Hope this helps!

Cheers,

Pete.

[rmorrow]

I noticed that there are no references to Qcheck in this script. Qcheck should be used to avoid file conflicts after installing MS hotfixes. It only has to be run once after all hotfixes have been installed, and the output can be captured and logged.

[wfuehrer]

Hi!

Windows XP and above doesn't need Qcheck any more ... i read something on MS technet ...

I will hope to have some time next week to implemet all the posted Ideas.

I hope it will be ok for Svenp when i post the enhanced package. Some more modifications will be done to the mspatch.exe - i need a new parameter for my unattended installations.

Wolfgang

[davezub]

I have a heavily modified version of the script (before the csv editor - nice tool) for our company, and I have not tested it for a while - to busy on other projects. Now I'm back on the script again, and noticed with the latest beta the eval function does not seem to work the way I think it should. Please keep in mind the way I think it should is probably wrong - LOL.

Func NewEval($String)

$HSM="HKLM\Software\Microsoft"
msgbox(0,"New Version",$String)
$testmenow = Eval($String)
msgbox(0,"New Version",$Testmenow)
Return Eval($String)

IF eval("1=1") = 1 then
     Msgbox(0,"test","test")
EndIf   

This does not return true??????

$String is correct and = RegRead($HSM &"reg key stuff","InsInstalled")=1

$TestmeNow is Blank

The registry key exists, and should return true? Sorry if I'm not clear, I know just enough to be dangerous.

Edited August 10, 2005 by davezub