Merge pull request #26 from LittleBigRefresh/patchwork

Docs changes for Patchwork

Author: jvyden

.idea/AndroidProjectSystem.xml

@@ -10,57 +10,65 @@
             You should have been given a URL by the person operating the server you're trying to connect to.
             Copy this URL into the second field - the one named 'Server URL'.
         </p>
-        <p>
-            In the case of the official Bonsai instance, you will use the IP <code>http://lbp.lbpbonsai.com:2095/lbp</code>
-        </p>
+        <note>
+            In the case of the official Bonsai instance, you should use the IP <code>http://lbp.lbpbonsai.com:2095/lbp</code>
+        </note>
         <p>
             Next, hit the button that says 'AutoDiscover'.
             This will trigger Refresher to attempt to connect to the remote server to gather more details and extra patching instructions from it.
             AutoDiscover is required for some games, so you should always use it.
         </p>
         <p>
-            Most servers based on Bunkum, most notably Refresh, should support this protocol.
-            Other servers such as Project Lighthouse do not support this protocol.
+            If successful, Refresher will automatically fill in the appropriate settings from that server.
         </p>
+    </snippet>
+    
+    <snippet id="lobby-password">
         <p>
-            If successful, Refresher will open a pop-up presenting the information it gathered from the server.
-            Click 'Yes' to accept these settings, and Refresher will automatically do the rest when you patch.
+            If patching an LBP game, you can also set a lobby password to play multiplayer.
+            Current security patches require that multiplayer be effectively disabled by randomizing the encryption key.
         </p>
-
-        <img src="autodiscover-success.png" alt="A dialog box from Refresher, indicating that AutoDiscover has been performed successfully." />
-
-        <note id="use-autodiscover-note">
-            <p>If you are a developer of a custom server for any game, you can read up on our AutoDiscover protocol's documentation <a href="https://docs.littlebigrefresh.com/autodiscover-api">here</a>.</p>
-            <p>We recommend you support it, as it helps users ensure that they are following the correct procedures before they launch the game.</p>
-        </note>
+        
+        <p>
+            By setting your own key for multiplayer,
+            you can regain the ability to play with those who are using the same key!
+        </p>
+        
+        <warning>
+            <p>
+                ONLY SHARE THIS CODE WITH YOUR FRIENDS, OTHERWISE FACE SECURITY VULNERABILITIES.
+            </p>
+            <p>
+                Read more about LBP security <a href="https://docs.littlebigrefresh.com/lbp-security.html">here</a>.
+            </p>
+        </warning>
     </snippet>
 
     <snippet id="download-refresher">
         <p>
             To download Refresher, you must first visit the <a href="https://github.com/LittleBigRefresh/Refresher/releases/latest">Releases Page</a>.
         </p>
         <p>
-            Then, pick the option corresponding to the operating system that is running on your computer.
-            Refresher currently does not provide built binaries for macOS due to issues with code signing. To run
-            Refresher on macOS, you must build the project yourself via the dotnet toolset.
+            Then, pick the option corresponding to the OS running on your computer.
+            On macOS, you will have to run a terminal command to get Refresher to run correctly. Those instructions are listed on the GitHub release.
         </p>
         <img src="refresher-artifacts.png" alt="Refresher Artifacts"/>
         <p>
-            Once you have downloaded the built binaries for your operating system,
+            Once you have downloaded the built binaries for your computer,
             simply unzip the archive, and you should have an executable.
         </p>
     </snippet>
 
     <snippet id="supported-version-notice">
-        <note>
+        <warning>
             Refresh only officially supports the latest release of every LBP game.
             Please update your game to the latest release <b>before</b> following this guide, else you may run into unexpected errors.
-        </note>
+        </warning>
     </snippet>
 
     <snippet id="final-patching-message">
         <p>
-            When all is set and ready to go, register an account on <a href="https://lbp.littlebigrefresh.com/">our website</a>,
+            When all is set and ready to go, register an account on <a href="https://lbp.lbpbonsai.com/">our website</a>,
             and then open the game and start browsing levels to activate your account!
         </p>
     </snippet>
@@ -71,4 +79,18 @@
             For a UMD or Playstation Store copy, press triangle on the game in the XMB and select Update.
             For a dumped copy of the game, you can use <a href="https://old.reddit.com/r/PSP/wiki/updateiso/">this guide</a> to update your dump.</p>
     </snippet>
+    
+    <snippet id="reconfigure-patch">
+        <note>
+            This only applies to the LBP games, which all use Patchwork.
+            You cannot use this method to patch new games, but all games that you've patched beforehand should automatically update.
+        </note>
+        <p>
+            If you'd like to switch servers, you can easily do so! In Refresher, click 'Reconfigure Patch for PS3'.
+            You should see your previous settings.
+        </p>
+        <p>
+            Simply change the Server URL, or whatever else you'd like to change, and hit 'Patch!'. Refresher will update Patchwork's configuration for you.
+        </p>
+    </snippet>
 </topic>

Docs/images/patching/autodiscover-success.png

@@ -4,26 +4,23 @@
 <topic xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="https://resources.jetbrains.com/writerside/1.0/topic.v2.xsd"
        title="LittleBigPlanet &amp; Security" id="lbp-security">
-
-    <note>
-        <p>
-            This page is a bit of a placeholder since I'm rushing to get registrations back up.
-            Sorry if this is confusing.
-            - jvyden
-        </p>
-    </note>
-    
     <warning>
         <p>
             <b>TL;DR</b>: LBP is unsafe for both your save data, and the console it's running on when playing online.
             You should play behind a VPN and take frequent backups of both your LBP save
             and anything you else want to keep on the console you're playing on.
         </p>
         <p><b>
-            The best way to protect yourself against any attacks is to play offline.
+            Although there are some miscellaneous workarounds and patches,
+            the ultimate way to protect yourself against any attacks is to play offline.
         </b></p>
     </warning>
 
+    <note>
+        These warnings don't apply to <b>LittleBigPlanet PSP</b>, as it doesn't use scripting or multiplayer.
+        It <i>is</i>, however, <b><i>still applicable</i></b> to <b>LBP Vita</b> as it is a fork of LBP2's engine.
+    </note>
+    
     <chapter title="What is 'scripting'?" id="scripting">
         <p>
             As the scripting portion of LittleBigPlanet has been cracked open,
@@ -46,7 +43,7 @@
         <note>
             The community has also used scripts to develop innocent things, such as
             <a href="https://gamebanana.com/mods/536722">LBAC</a>, an anti-cheat,
-            or server patchers, or certain joke items/meta memes.
+            in-game server patchers, or certain joke items/meta memes.
         </note>
 
         <p>
@@ -100,34 +97,77 @@
                 Okay, I'll just play my friends with who I trust and deny anyone else.
             </i>'
 
-            Unfortunately, using <i>another</i> exploit, it's possible for attackers to join your session
+            Unfortunately, using <i>another</i> exploit, it's possible for attackers to fake an in-game invite and join your session
             without any consent on your end.
         </p>
+    </chapter>
+    
+    <chapter title="Your IP is exposed because of P2P" id="ip">
+        <p>
+            The <i>LittleBigPlanet</i> games use a multiplayer scheme called peer-to-peer (P2P).
+            This means each player connects directly to a host - another player.
+        </p>
+        
+        <note>
+            Some modern P2P variants, like Steam Networking, can mask your IP address and obscure it from attackers.
+            However, the PS3's aging software doesn’t support anything like this.
+        </note>
 
         <p>
-            I won't go into how this is possible for obvious reasons, but just know that in theory,
-            someone could join your game and immediately spawn something that corrupts your save, or something far worse.
+            Because each player needs to know the host's IP to play multiplayer with them,
+            your IP is shared with anyone who connects to you on RPCN or PSN.
         </p>
+        
+        <p>
+            An attacker could use your IP to perform a DDoS attack (or "boot" you offline),
+            or to discover your general location.
+            
+            In rare cases, they might also mess with services you've port forwarded,
+            though most home networks don't have ports forwarded unless you've done so yourself.
+        </p>
+        
+        <p>
+            To hide your IP and protect against these types of attacks, you can use a <b>VPN</b>
+            to route all traffic through a secure server.
+            
+            In the case of PS3, there is no explicit mechanism for VPNs, so you'll have to figure out how to proxy connections through your computer.
+        </p>
+        
+        <note>
+            An alternative to VPNs is tightening your firewall to disallow all incoming connections to your PS3.
+        </note>
     </chapter>
 
     <chapter title="Protecting Yourself" id="protections">
         <p>
-            There's not much that could be done about these exploits right now,
-            pending some work on making patches to all the games that blocks P2P scripts from being synced over multiplayer.
+            A workaround has been developed by <a href="https://github.com/Zaprit">Zaprit</a> called <b><a href="https://github.com/HugeSpaceship/Patchwork">Patchwork</a></b>
+            that newer versions of <a href="https://github.com/LittleBigRefresh/Refresher">S</a> will automatically deploy for you.
+        </p>
+        
+        <p>
+            Patchwork currently works by changing the encryption key used for P2P multiplayer,
+            effectively preventing connections from people who don't know the key.
         </p>
 
         <p>
-            You could theoretically make a firewall rule to block P2P multiplayer, making yourself NAT type 3,
-            but this protection could potentially fail, and it blocks you from playing with your friends.
+            The downside is that this still doesn't block scripts from being shared over P2P,
+            nor does it make it as easy to play with your friends.
+            By default, keys are randomized, and you'll have to share your own 'password' with friends to play with them.
         </p>
 
+        <note>
+            In real-world terms, this is like changing the locks on your safe instead of securing anything inside.
+            It'll still help, but if you get past the lock, either by breaking it or guessing the code,
+            you can still do whatever you want to what's inside.
+        </note>
+        
         <p>
-            Your best bet is to play offline while a patch is developed, or accept the risk and make frequent backups.
-            The silver lining is that these attacks haven't been performed yet, at least that I'm aware of. But that doesn't mean LBP is safe.
+            Servers like Bonsai and Beacon will block connections that don't use the latest versions of these patches,
+            effectively requiring you to use these patches before you can play.
         </p>
 
         <p>
-            Join our <a href="https://discord.gg/xN5yKdxmWG">Discord</a> and be the first to get notified when such a patch is developed.
+            Join our <a href="https://discord.gg/xN5yKdxmWG">Discord</a> and be the first to get notified when more patches are developed.
         </p>
     </chapter>
 </topic>

Docs/images/patching/refresher-ps3.png

@@ -2,7 +2,13 @@
 
 <include from="Library.topic" element-id="supported-version-notice"/>
 
-Refresher has native support for decrypting, encrypting and patching PS3 games. This guide aims to show you how to operate Refresher's PS3 patcher.
+Refresher has native support for decrypting, encrypting and patching PS3 games, including the LittleBigPlanet series.
+This guide shows you how to operate Refresher's PS3 patcher.
+
+<note>
+    For the LBP games, Refresher will instead use a new patching method called Patchwork to hook into the game to provide extra security patches.
+    It comes with the benefit that it is configurable without a full repatch, with the downside that it only works for select games. 
+</note>
 
 <include from="Library.topic" element-id="download-refresher"/>
 
@@ -20,7 +26,7 @@ Once you've gotten a modded firmware up and running, head on over to GitHub and
 
 Move the installer .pkg onto your PS3, and use your PS3's package manager to get the installer on your PS3, then run it to install webMAN-MOD onto your system.
 
-<note>webMAN-MOD Lite will not work to patch digital copies. Please ensure you are using the full version of webMAN-MOD.</note>
+<warning>webMAN-MOD Lite will <i>not</i> work to patch digital copies. Please ensure you are using the full version of webMAN-MOD.</warning>
 
 ## Step 2: Find your PS3's IP Address
 
@@ -33,10 +39,21 @@ Click the 'Connect' button, and Refresher should connect to your PS3. It may tak
 
 ## Step 3: Fill in the server URL
 
+Next, go to Refresher and click either 'Patch LBP1/2/3 for PS3' or 'Patch any PS3 game' depending on if you're patching an LBP game.
+The latter will not work for LBP as it does not include critical security fixes through Patchwork, so beware!
+
 <include from="Library.topic" element-id="fill-in-server-url"/>
 
+## Step 3.5: Lobby passwords
+
+<include from="Library.topic" element-id="lobby-password"/>
+
 ## Step 4: Patch!
 
-Now, click the patch button. It should decrypt the game, patch, then place a working EBOOT onto your PS3.
+Now, click the patch button. It should decrypt the game, patch, then place a new EBOOT and a copy of Patchwork onto your PS3!
+
+<include from="Library.topic" element-id="final-patching-message" />
+
+## Step 4.5: Reconfiguring the patch
 
-<include from="Library.topic" element-id="final-patching-message" />
+<include from="Library.topic" element-id="reconfigure-patch" />

Docs/topics/Library.topic

@@ -5,6 +5,16 @@
 Refresher has native support for decrypting and patching RPCS3 games. This guide aims to show you how to operate Refresher's RPCS3 patcher. 
 At the end of this, you will be able to select your server of choice inside the game patches menu of RPCS3.
 
+<warning>
+    <p>
+        Refresher is currently out of date and doesn't support patching LBP games with Patchwork.
+        Following this guide for LBP games won't work for the time being.
+    </p>
+    <p>
+    Join our <a href="https://discord.gg/xN5yKdxmWG">Discord</a> and be the first to get notified when RPCS3 support is fixed!
+    </p>
+</warning>
+
 <warning>
     <p>
         If you're intending to play on <b>Bonsai</b>, you do not need to follow this guide.