v1.4.0

v1.4.0 — 2026-10-14

• Uninstall: it runs from the installed program and no longer leaves DynaRunFix-uninstall-<n>.exe in %TEMP% (also not after a
  cancelled UAC prompt; copies of earlier builds are removed). Shortcuts that no backup covers (an older version did not record
  them) are pointed back at DynaRun V3.exe instead of staying on the removed launcher; backups made on 64-bit Windows with the
  long or the 8.3 spelling of a folder are restored too.

• DynaRunFix never runs DynaRun with more rights than a normal start from the desktop. DynaRun does not need administrator
  rights. The launcher ignores the compatibility setting "Run as administrator" for DynaRun V3.exe; if the launcher itself is run
  as administrator, it first starts itself again with the desktop shell's token and ends, so DynaRun (and Locale Emulator) and the
  update check get what a double-click on the desktop gives: the normal, non-elevated token under UAC. If the shell's token is itself
  elevated (UAC off, built-in Administrator: the normal desktop is already full administrator), the launcher carries on with it and
  logs that; it refuses only when no shell token can be had at all, then showing a message and not starting DynaRun. A one-time
  notice (English / Traditional Chinese, can be switched off) is shown when the launcher was started as administrator and the token
  was non-elevated, or the compatibility setting was ignored. If an already running DynaRun was started with more rights than the
  launcher has, the launcher asks you to close it and start it again through DynaRunFix. Shortcuts the installer retargets no longer carry
  the "Run as administrator" flag. Do not run DynaRun V3.exe directly as administrator: it can stall at startup
  ("System Initializing. Please Wait. 115") and alter its per-user component registrations.

• No more COM registrations in the machine-wide registry. The installer no longer copies DynaRun's per-user COM
  registrations to HKLM (it is not needed now that DynaRun runs without elevation). Copies and records made by older
  versions are left as they are, and uninstalling keeps them (com-copied.txt, com-backup).

• Graph popup menu in the chosen language without administrator rights: the graph control (Gigasoft ProEssentials,
  Pesgo32e.ocx / PEGRP32E.dll) asks for its language resource PEGRC32D.dll by name; DynaRun's attempt to copy it into
  SysWOW64 fails without administrator rights, so the menu was English. dynafix.dll now answers that one request with the
  per-user copy from %APPDATA%\Dyna Pro Dynamometers\Dyna Run V3\Language\<language>\ (resource-only load, validated path,
  not when DynaRun is elevated); nothing is written to the system folder. DYNAFIX_PEGRC=0 switches it off.

• Installer, code-page manifest: to make Windows read the manifest, the installer briefly changes the exe's modification
  time and restores it (the exe's content is not changed). The original time is recorded first and put back at the next run
  if that ever fails. The manifest is not added when DynaRun's folder or exe can be changed by ordinary users (setup.log
  in the install folder says so); then DynaRun's path is not recorded in the machine-wide registry either. On Windows XP links (junctions) in that path cannot be detected.

• Security hardening:

  • The DynaRun setup (MSI) is copied to a folder that only administrators can write to and checked again there before it
    is run elevated.
  • Uninstall asks for administrator permission first; cancelling changes nothing. It deletes the manifest only if it is identical to
    the installer's own copy, keeps the record of the exe's original modification time if restoring it fails, and the elevated
    uninstall runs from the installed program in the install folder (no copy in %TEMP%). If DynaRun (or the launcher / Locale
    Emulator) is running, it asks to close it first, so no .old files or le folder are left behind; anything still
    locked is deleted at the next restart.
  • Updates: the check talks HTTPS only, and only to GitHub's hosts (every redirect is checked). The release and its SHA-256 are
    verified with GitHub again just before the install, and the downloaded installer is held open so it cannot be swapped between the
    check and the start. The question: Yes = install after DynaRun closes, No = skip this version, Cancel / the close button = ask again tomorrow.
  • DynaRunFix.exe /restart <pid> ends after 15 s instead of attaching to the old process.
  • Smaller items in the installer wizard (password wiped from memory, system libraries loaded by full path) and in
    tools/fetch-le.ps1 (SHA-256 for the licence files). Tests: tests\build-hardening-tests.cmd.
  • The taskbar pin technique for Windows 7 to 10 is credited to Gee Law (also used by Firefox); no Mozilla code is included.

• DYNAFIX_USBFIX=1 (opt-in, EXPERIMENTAL, off by default, not yet verified with real hardware):
  tries to keep DynaRun's window from freezing for good when a DPSetData call into dynapro.dll does not return.

  • DPSetData (mode 3) runs on a dynafix.dll helper thread while the window thread waits with a watchdog; if the call is still
    blocked after about 2 s and DPConnStatus() reports the connection down, DPSetData returns 0 and DynaRun's own reconnect logic
    is expected to take over; while the connection is reported up the call is left to run. Facts about dynapro.dll's calls were taken
    from API-boundary logging of DynaRun's own calls; DynaRun's reaction to a 0 result is expected, not verified.
  • No Dyna Pro file on disk is modified. dynafix.dll calls dynapro.dll's exported DPSetData / DPConnStatus and,
    while DynaRun runs and only with the switch set, redirects dynapro.dll's WaitForSingleObject import-table entry in
    memory (helper thread only) and wraps DPSetData. Only mode 3 calls go through the watchdog (callers queue); other modes are passed
    straight to the original. The helper's event waits are made to time out (WAIT_TIMEOUT, event handles only) so that an abandoned call
    can end later; the three values passed in p are copied back on normal completion. Assumptions: dynapro.dll tolerates the call being made from a helper thread, and p holds three values (what was observed in DynaRun's calls).
  • Trade-offs, stated honestly: DynaRun's window is unresponsive for about 2 s before it recovers; other calls into dynapro.dll
    (DPConnStatus, DPConnect) overlap with it while an abandoned DPSetData is stuck, and how dynapro.dll copes with that is
    not verified; the abandoned call may never return, in which case all further DPSetData calls return 0 until DynaRun is
    restarted, and a one-time notice suggests restarting it (after 300 or more dropped calls and 20 s).
  • dynafix.log gets DPSetData watchdog on (usbfix), N WaitForSingleObject import(s) patched, usbfix: ... and the abandoned call returned after N ms lines.

• Security and correctness fixes:

  • The launcher can no longer start DynaRun with more rights than a normal start (see the first item); the update check no longer runs elevated either.
  • Uninstall removes the current user's taskbar layout policy values as well, and keeps the recorded original
    modification time of DynaRun V3.exe when that restore is pending; restoring shortcuts no longer trusts per-user values when run
    elevated, paths read from other users' registry values are copied with bounds checks, and the elevated uninstall no longer
    runs from a predictable file in %TEMP%.
  • Downloads: HTTPS and the host are checked on every redirect hop (the update download may only be redirected to GitHub's own hosts), TLS 1.2 or later (Windows 7 needs KB3140245; the daily update check asks for TLS 1.2 as well), the size is capped at 300 MB, a download that ends early is not treated as complete.
    System libraries are loaded from the system folder only (System32).
  • A decrypted Dyna Pro Setup.msi is deleted from %TEMP%\DynaRunFix when the wizard is cancelled or fails.
  • First start: only option buttons that are clearly read as green (picked) are written; when dynafix.dll cannot read DynaRun's
    option buttons (or is unsure what it sees) it writes nothing and only logs it (before, it could write feature flags the user had not chosen).
  • dynafix.dll clears __COMPAT_LAYER for DynaRun's own process so a RunAsInvoker set by the launcher does not suppress
    the one-time UAC prompt of Dyna Pro's configuration helper; the graph language redirect is always a resource-only load and
    is refused if the elevation state cannot be determined.
  • dynafix.log no longer contains absolute addresses of other modules' import slots, only module and API names, and the launcher and the dll do not follow links (symbolic links, junctions) when opening it.
  • The manifest's version is 1.0.0.0; the installer's product version is 1.4.0.

• Other: the screen-size adjustment is logged as screen-size values adjusted (work area): AxB -> CxD; the Locale
  Emulator notice (THIRD-PARTY.txt) also links to forks of its source code, and build.cmd regenerates it when it is
  stale; msgspy (the window-message logger) is no longer built or shipped (source stays in tools/msgspy);
  removed the manual machine-wide COM registration script and its playbook (no longer needed: DynaRun always runs non-elevated).

• Installer, authenticity: the Dyna Pro download must stay on HTTPS and on dynapro.co.uk (checked on every redirect hop), uses TLS 1.2 or
  later (Windows 7 needs KB3140245), is capped at 300 MB and aborts on any certificate error, with a clear message. The license page shows the setup's full path, size, SHA-256 and the MSI's
  version / manufacturer for you to compare (display only). Releases now include SHA256SUMS.txt and a build provenance
  attestation (gh attestation verify <file> --repo timliudev/DynaRunFix); the workflow's third-party actions are pinned to commit SHAs.

• Documentation: screenshots of DynaRun's own windows were removed (short text descriptions instead); the README states
  precisely what DynaRunFix changes in memory, what the installer changes, which values it writes on the first start (exactly
  the user's own choices), and that dynafix.log may contain file paths and window titles.

---

SHA-256 of the files in this release (also attached as SHA256SUMS.txt).
Build provenance: gh attestation verify <file> --repo timliudev/DynaRunFix

900f13c9db051690983a1da70539621f191e82afa67634d08c8cdd62bbcd0d45  DynaRunFix-Setup.exe
a0c8ecb89c717dbaee76fb561f10a511f0896f6fd66cfb2f962b3287a94ff6bb  DynaRunFix-v1.4.0.zip