FModel Should Come Bundled With Its Required Dependencies

[BoffinBrain]

My first attempt to run FModel was rather painful, and it all seemed to stem from the program being unable to run without downloading further dependencies from Github and possibly other remote sites.

Upon first running FModel, I got the error "Unable to load 'oo2core_9_win64.dll' or one of its dependencies". I assumed this to be some issue with my own Windows config and set out to manually download this file, putting it into the stated directory. After doing that, it complained about more missing DLLs such as zlib. My only clue was the additional error about it being unable to check for updates. Naturally, I use my firewall to block every unknown application from accessing the internet. Upon temporarily giving it access and monitoring its activity, it downloaded everything it needed and then started working.

Related discussion: #420 Despite the post now simply stating "Download and install Microsoft Visual C++ Redistributable", digging into the edit history shows that downloading dependencies like oo2core_9_win64.dll from remote sources has been a problem before.

I think there are a few things that can be improved here:

1. In the wiki's Getting Started page, there is no troubleshooting step for this error. It should be explicitly stated that the program needs internet access to download these files.
2. The program should give a helpful error message, that it tried and failed to download additional dependencies.
3. Just... Bundle the DLLs in the actual release ZIP file? A program like this shouldn't need internet access unless checking for updates. This seems like common sense, from a security and preservation perspective.
   • What if those dependencies are unavailable in the future or the sites hosting them go down? Your archived releases are useless without them.
   • What about supply chain attacks? Now a clean copy of FModel could unknowingly download malware in the future.
   • If there are licensing reasons why this can't be done, consider adding dependency download links in the wiki.

PS. While I'm here, it looks like more than half of the links in the main wiki page are broken (they link to the page you're on).

[4sval]

FModel can run just fine without these DLLs if the game you're loading doesn't need them. You could have simply clicked OK; the errors would still pop up at launch, but the program would work.

There's a bit of history here. Oodle can't be bundled due to licensing issues, and initially, it was the only DLL FModel would download on demand. This meant the error wouldn't appear until it was absolutely necessary. Now, with mapping files (most of which are compressed), FModel downloads Oodle at launch for everyone and does the same for Zlib. It's a one-time download.

The referenced discussion has been most of the time accurate since 2020 because there's a catch, this error can also happen if you have the DLL at the correct place.

To answer your points

• In big 2025, is it really too much to ask for internet access on the first run?
• These errors are already logged; the displayed generic error could arguably be improved.
• If these dependencies become unavailable, we'll find them elsewhere. Archived releases are still perfectly usable.
• We limit the risk of supply chain attacks by downloading these files just once, during the first run. Oodle is downloaded from a reliable public Warframe endpoint that's been consistent for years, and Zlib comes from @NotOfficer's repo. Manually downloading these files, like you did, actually poses a higher risk of downloading malware.
• Ultimately, we can't protect users from supply chain attacks more than this, as we have to download these files from somewhere. Adding download links in the wiki would only duplicate the problem but linking the code like I just did, with steps, could serve as a backup solution.

[BoffinBrain]

Thanks for the info. As I imagined, it's a long and complex series of issues. Forgive me if the following responses seem a bit crass, but I'm just trying to provide as much feedback as possible as someone who's never used F-Model before, but has used other similar tools.

You could have simply clicked OK; the errors would still pop up at launch, but the program would work.

I guess it depends on your definition of 'work'. In my case as a first-time user, trying to unpack a UE5 game, I got the errors, clicked OK on them, and found FModel's UI was empty. Without a corresponding troubleshooting step on the wiki, I interpreted this as "not working".

Oodle can't be bundled due to licensing issues

Out of curiosity, what's the license and who holds it?

In big 2025, is it really too much to ask for internet access on the first run?

I'd say yes (security principle of least privilege, air-gapped dev boxes), but crucially, the program didn't ask for internet access, which was the major cause of confusion.

• If these dependencies become unavailable, we'll find them elsewhere

Assuming the project is still being maintained long into the future. We all know what happens to games and other software when support ends. Even if the dependencies can't all be bundled (which is the ideal solution), having them all listed on the Wiki can allow this info, along with the linked resources, to be archived and more easily recovered by someone in the future. I'm sure you're familiar with the work that GOG, Archive.org and other groups put into preserving video games. This is very similar.

• We limit the risk of supply chain attacks by downloading these files just once, during the first run

If the program doesn't need the bleeding-edge version of a dependency, the ideal procedure would be to keep track of the specific stable releases of each dependency and test them before letting them go downstream. Several software houses I've worked for in the past take these things pretty seriously.

• Manually downloading these files, like you did, actually poses a higher risk of downloading malware.

Yep, I didn't enjoy having to do that but I felt like I had no choice. I checked the SHA-1 hashes of oo2core_9_win64.dll from several different sources to make sure they were consistent, and ran it through VirusTotal. I did the same for every single file FModel downloaded into the .data folder.

• Adding download links in the wiki would only duplicate the problem

If FModel programmatically determines what to download based on the type of package it opens, then that metadata could be turned into an auto-generated table for your wiki! Perfect.