The (probably final) update of DML 2.X is released!

This is a very small update. As mentioned before, DML 2.X is now in maintenance mode,no major updates are planned, as development efforts shift towards DML 3.X.

31/07/2025 | v2.6

(This is the latest changelog. Full history: https://p36software.net/downloads/dml2/changelog.txt , numbers in parentheses refer to GitHub issues)

New Features:

  • You can now start a preset directly by passing its name as a command-line argument to the DML executable. This allows creating desktop shortcuts that launch specific presets. (#29 – thanks to @StephenChamberlain)
  • The new version notification system now works under Mono. (#37)

Bug Fixes:

  • Fixed potential security vulnerabilities in the version notification system.

Other:

  • Removed support email; use info@p36software.net for all contact. (#39)
  • Removed Tank Rider links. (#38 – see GitHub for details)
  • General improvements to help texts.

As always, let’s break it down:

Start a preset directly by passing its name as a command-line argument to the DML executable. This allows creating desktop shortcuts that launch specific presets. (#29 – thanks to @StephenChamberlain)

Since v2.2, I’ve wanted a way to leverage DML 2.X features to allow shortcuts (or batch files) that start a preset right away, bypassung the DML GUI.
Originally, the idea was for DML to generate a .lnk file on your desktop, but I shelved that due to several issues:

  • The method for creating shortcuts in Windows varies across versions.
  • DML aims to be portable, so moving the folder would break any generated shortcuts.
  • Windows and Linux shortcuts aren’t handled the same way (which wasn’t a concern in v2.2 but became relevant later).

So the idea was forgotten,until one day, Stephen Chamberlain reached out and helped implement a partial version of this feature.

Thanks to Stephen, you can now start a preset by passing its name as a command-line option. It has a few caveats (explained below), and you’ll still need to create your own shortcut/batch/shell script manually, but it works!

Make sure to configure and test the preset in DML 2.X beforehand.
At minimum, the source port and IWAD must be saved in the preset. Otherwise, DML will fall back to the last-used ones, which might not be correct.
Keep also in mind that preset names with spaces are not supported (rename them using underscores) and are case-sensitive.

Example:
If your preset is named Psychophobia UnofficialPatch, rename it to Psychophobia_UnofficialPatch.

Ensure all required mods are included and correctly ordered, and that both the source port and IWAD are saved in the preset. Test it within DML 2.X, tweak as needed, then close DML.

Example usage:

On Windows:

DML_v2.6.exe Psychophobia_UnofficialPatch

On Linux/macOS:

mono DML_v2.6.exe Psychophobia_UnofficialPatch

Once you’ve confirmed the command works, you can create a shortcut or shell script to launch your favorite modpack instantly.

New version notification system now works under Mono. (#37)

In v2.5, there were separate builds for Windows and Linux/macOS (called “Windows version” and “Mono version”), built from slightly different branches.
This was due to issues running the full version of DML under Mono, specifically due to the form icon and version notification system.

This wasn’t a big deal for users, since both builds shared core features, but from a development standpoint, maintaining two nearly identical codebases was inefficient.

With v2.6, the branches have been unified. The version notification system now also works under Mono!

Funny enough, the issue only occurred when using the Windows version of Mono for testing, it worked fine on Linux Mono. The real blocker was the form icon, which I’ve resolved by loading icons at runtime instead of relying on Visual Studio’s form designer.

Fixed potential security vulnerabilities in the version notification system.

This gets a bit technical. TL;DR: I had implemented the feature without all the appropriate safety and introduced a potential attack vector, which has now been fixed.

The biggest flaw: I wasn’t validating the download URL before passing it to Process.Start().
That meant if someone had compromised my server, they could’ve made the “Open download page” button do something harmful, like redirecting to a malicious website or launching (already installed) software on the user machine.

From my testing (done with a local server), I wasn’t able to start software with parameters or download and execute software in a single command, but I was able to launch the software already installed on the user machine (eg. the calculator app) or make the browser open any site url, including file, that would result in the browser downloading the file. So it was still dangerous nonetheless, so to prevent this kind of issue I’ve put in place the following measures:

  • Validate that the string is a proper URL.
  • Ensure the URL uses the https protocol.
  • Confirm the URL host is p36software.net.

If any of these checks fail, the update process is halted and treated as a failed connection.

As an extra layer of protection, hovering over the “Download” button now displays a tooltip with the destination URL.

Still, always double-check where you download DML from.

  • Removed support email; use info@p36software.net for all contact. (#39)
  • Removed Tank Rider links. (#38 - see GitHub for details)
  • General improvements to help texts.

I updated the welcome and about dialogs, as well as the README file. They should now be clearer and more readable.

And that’s pretty much it!

Even if you’re not interested in the new features, I strongly recommend upgrading due to the security fixes. (Also avaiable on github)


Download Doom Mod Loader v2.6 - ModDB

See the README or download page for instructions specific to non-Windows OS.