Take the 2-minute tour ×

Possible Duplicate:
Google Chrome-like downloader and installer

I wonder what chrome uses on windows to doownload and install itself, and how to create such install process for my application?

share|improve this question
How is this related to C++? –  Component 10 May 10 '12 at 10:58
add comment

marked as duplicate by AVD, Tad Donaghe, Jonathan Leffler, hjpotter92, Luksprog Sep 30 '12 at 6:50


2 Answers

Chrome's silent self-update strategy comes at a high price. It stores the .exe in a folder that any process can write to, C:\Users\hpassant\AppData\Local\Google\Chrome\Application\chrome.exe on my machine.

This bypasses the need for a UAC prompt that asks for elevation to write to c:\program files, the normal directory where executables are installed. So an update can be entirely silent. Which ought to make Chrome an attractive target for virus writers that can get code to execute on your machine but are otherwise normally powerless to mess with critical files to replicate themselves. They just need to patch or replace chrome.exe and can do so silently. The desktop shortcut points straight to this file so when the user starts Chrome again, it will run the affected executable.

No real idea why this isn't a wide-spread attack vector, other than that it is rather a large program and is in constant flux and probably has some countermeasures. And perhaps because UAC otherwise can shield the machine from an infected copy of the .exe, you could only do things like steal passwords and redirect the user to pr0n sites.

I don't particularly care for this loophole so I avoid Chrome, you might want to consider that your customer has the same concern about your program. Especially when it doesn't have the kind of countermeasures that Chrome might have. Users and IT staff typically like UAC, only programmers don't.

share|improve this answer
add comment

See Google Chrome-like downloader and installer

A quite complete list of solutions:

Or possibly create your own using the WiX Toolset, NSIS or Inno Setup. You would need to create a small downloader EXE that would download the full installation from your web server, and then launch it.

All of those are free solutions, except for AdvancedInstaller.

share|improve this answer
add comment
