App Inventor 2 without compromising security (I think!)

[knelmes]

Hello!

 

I've been trying to get App Inventor to work on and off for over a year without having to allow command prompt (THAT'S not going to happen!) and I think I've finally got it, by running the aiStarter program as a service under the system account and the emulator under the student's account.

 

Files

 

First off, we've got to get some files collected. I've attached a file to this post with the ones I've created myself but some others are under copyright so I'll just point you in the right direction.

 

• emah.exe - Short for Emulator Autohotkey. Exe and source are in the zip. Just copies the android environment and starts the emulator.
  
• service.reg - Adds info to the service after it's created.
  
• setup.bat - Sets everything up.
  
• AppInventor_Setup_Installer_v_2_2 - App Inventor Setup, download from App Inventor site.
  
• Appinventor-emulator-data - From the Extras folder in the App Inventor install folder but with the companion app updated, otherwise it'll ask for an update every time. Run App Inventor once and update it then copy it.
  
• sdcard.img - Gets created in .appinventor folder in profile (or sometimes in root of c:?)
  
• instsrv.exe
  
• srvany.exe - These 2 files are from the Windows Server 2003 Resource Kit - Download from Download Windows Server 2003 Resource Kit Tools from Official Microsoft Download Center and then copy the 2 files from the install folder.
  

 

Put all the files together in a folder. You should then just be able to run setup.bat to get everything installed.

 

The Setup

 

Here's the setup.bat, which can be added to SCCM easily:

 

start /wait AppInventor_Setup_Installer_v_2_2.exe /S
del /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\aiStarter.lnk"
del /Q "C:\Program Files\AppInventor\commands-for-Appinventor\run-emulator.bat"
xcopy /Y instsrv.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y srvany.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y emah.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y Appinventor-emulator-data "C:\Program Files\AppInventor\commands-for-Appinventor\extras\"
xcopy /Y sdcard.img "C:\Program Files\AppInventor\commands-for-Appinventor\extras\"
"C:\Program Files\AppInventor\commands-for-Appinventor\Instsrv.exe" AppInventorStarter "C:\Program Files\AppInventor\commands-for-Appinventor\Srvany.exe"
regedit /s service.reg
net start AppInventorStarter

echo. 2>"%Windir%\Detection - ICT - App Inventor 2.txt"

 

I'll go through this line by line to explain how I did this.

 

start /wait AppInventor_Setup_Installer_v_2_2.exe /S

This installs App Inventor silently with all defaults.

del /Q "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\aiStarter.lnk"

This deletes the shortcut put in the all users startup. No idea why someone thought that'd be a good idea anyway...

del /Q "C:\Program Files\AppInventor\commands-for-Appinventor\run-emulator.bat"

This deletes the batch file that starts the emulator. Because I'm running the aiStarter program as a service under the system account, if this file is present it will start the emulator in the service as well, making it invisible.

xcopy /Y instsrv.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y srvany.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y emah.exe "C:\Program Files\AppInventor\commands-for-Appinventor\"
xcopy /Y Appinventor-emulator-data "C:\Program Files\AppInventor\commands-for-Appinventor\extras\"
xcopy /Y sdcard.img "C:\Program Files\AppInventor\commands-for-Appinventor\extras\"

This block copies the files listed. Descriptions of what these files do is above.

"C:\Program Files\AppInventor\commands-for-Appinventor\Instsrv.exe" AppInventorStarter "C:\Program Files\AppInventor\commands-for-Appinventor\Srvany.exe"

This installs the service.

regedit /s service.reg

This tells the generic service just installed to start aiStarter when the service is started.

net start AppInventorStarter

This starts the service.

 

After the setup, you'll need to add shortcut to emah.exe to your start menu using whatever method you usually do that.

 

What Students Do

 

Start Android Emulator from the start menu

Open Chrome (IE isn’t supported, we have Chrome on all the ICT computers but it can only access a small amount of sites)

Go to http://ai2.appinventor.mit.edu, create Google account or use existing one to sign in

Create an app

On the Connect menu, choose Emulator and let it connect

Any changes made should be reflected in the emulator almost immediately

 

Conclusion

 

Sorry if I've not explained something properly or made some assumptions about other people's setups. I really just wanted to get this written down while it was still fresh in my mind and hope it will help someone else.

 

I'm pretty sure this is secure, certainly more secure than enabling the command prompt.

App Inventor 2.zip

[Marshall_IT]

Thanks, I'll try this over the next few weeks... It'll be really helpful!

[synaesthesia]

Ditto, something we're looking at - that looks like it might help us out considerably!

[TheScarfedOne]

Ive not had a problem running it normally? And our system has been accused of being pretty restricted...

[knelmes]

Can your students access command prompt? The aiStarter program seems to need this to check for what devices are connected.

[TheScarfedOne]

No they cant, but as the shortcut just launches this its own running window - there is nothing that can be done with it

[Mustang]

Any reason you disable the command prompt?? There are plenty of free command prompt replacements that will run when the main one is locked down, also if the students aren't admins what are you trying to protect?

 

As for running things as the system account, i was always taught this was a big no. If something gets hold of the aiStarter program or someone replaces it with a command prompt or something else then they have full system access.

[pingleict]

Hi. Interesting and potentially very helpful. Do you use IE on your network with Group Policy. Have you found Chrome's Admx's mess up IE's Group policy. Someone has warned us about this. Any thoughts?

We found we couldn't get the ADMX's to apply to Chrome but we haven't gone too far with it yet.

We are in the situation where we would rather not use Chrome but are being told we must etc for App Inventor2.

[gtg93]

I realise this is an old thread - but works great, thanks!

[macdaddy]

This worked perfectly for us. We used SCCM 2012 to push out to a lab of 25 desktops.

 

Many thanks to Kris! The App Inventor 2.zip file was empty, after PM'ing Kris he quickly sent the file.

 

Again many thanks saved us a lot of time!

[silver_uk]

Anyone had problems with students saving whilst at school but not from home?

 

Trying to narrow down the issue - Could be anything...

[knelmes]

Could they be using different accounts?

 

To be honest our students have only just started using it en masse so I don't know how much use from home it's getting.

 

We've also had to set up Google Apps for Education to get them all Google accounts to log in - because now if they try to create their own they get asked for a mobile number.

[pastymaster]

Old thread revival I know but I wanted to post a thank you to knelmes. That original post helped massively!

[dnlees]

Hi, Would it be possible to have and emah.exe file that uses "Program Files (x86)" instead of just "Program Files"....?

 

thanks...

[knelmes]

Try the file attached to this post. I've not tested it though.

emahx64.zip

[spacehopper]

this has been working great for us last year.. thank you knelmes!

 

but, I have just come to set it up on the new image (which is 64bit rather than 32bit) and the service wont start properly..

 

have fiddled around and changed a few things to programfiles (x86) but no joy..

 

The Image is currently in Audit mode too whilst i finalise the setup.. could this be the cause?

 

if not.. has anyone else had this and how did you solve it?

[knelmes]

I will work on a 64bit version 'soon', probably before September as we might be needing 64bit Windows on the ICT PCs then, but it's not something I've looked in to yet, with the exception of changing the paths in emah.exe for dnlees last week.

[spacehopper]

looks like i've figured my issue out..

 

the application parameter in the registry needed changing from program files to program files (x86)

 

have also used the emahx64 you posted on the previous page..

 

will just have to tidy everything up now and it should be good to go..

[jxh]

I ended up using this

AXE's MIT AppInventor Launcher - Updated - Blogs - EduGeek.net

Worked really well for me