Exetools - New InstallShield script format?

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - New InstallShield script format? (https://forum.exetools.com/showthread.php?t=6444)

MrHalo

01-17-2005 04:00

New InstallShield script format?

Hi,

I've tried to decompile an InstallShield installation script file (setup.inx) with isdcc and sid. Both attempts failed.

Is Installshield using a new script format in there latest products and are there tools to decompile those scripts?

MrHalo

Dmit	01-17-2005 15:01

AFAIR "isdcc" supports scripts for IS v5.5 and below (setup.ins). "sid" and "isd" supports v6+, but starting from v8 additional mangling is applied to the setup.inx. Try de-mangle it with the following code:

Code:

#include <stdio.h>

#include <fcntl.h>

#include <io.h>

#define XOR_VAL 0xF1

void main (void) {

int i, c;

unsigned char b;

// Set "stdin" and "stdout" to have binary mode

_setmode (_fileno (stdin), _O_BINARY);

_setmode (_fileno (stdout), _O_BINARY);

// Decrypt INX

for (i = 0; (c = getchar ()) != EOF; i++) {

c ^= XOR_VAL;

b = (unsigned char)((c >> 2) | (c << 6)) - (i % 71);

putchar (b);

}

}

and feed result to sid/isd

Kerlingen

01-17-2005 16:21

Thank you for the code Dmit.

But the code like you posted it here doesn't correctly work for me and perhaps for others neither. I compiled it with VC++ ("ISDHelper.exe") and tried it with some encrypted SETUP.INX files.

I tried the following commands:

"ISDHelper < SETUP.INX > NewSETUP.INX"
and
"Type SETUP.INX | ISDHelper > NewSetup.INX"

But both commands truncated the output file at different locations and didn't fully decrypt it. The same result with DMC. Then I used BC++ to compile (I had to rename "_setmode" to "setmode" and it worked fine.

What could be the reason for this?

wasq	01-25-2005 01:22

XOR_VAL must be 0x0E (or not(0xF1))

Dmit	01-25-2005 16:59

Quote:

Originally Posted by Kerlingen

I tried the following commands:

"ISDHelper < SETUP.INX > NewSETUP.INX"
and
"Type SETUP.INX | ISDHelper > NewSetup.INX"

Using "Type ..." may produce truncated result because "type" considered EOF if character with code 0x1A is encountered.

Quote:

Originally Posted by Kerlingen

Then I used BC++ to compile (I had to rename "_setmode" to "setmode" and it worked fine.
What could be the reason for this?

I have no idea. I've compiled code with "cl" from MS VC++ v6 and uses input/output redirection like in your first command. All works fine...

NimDa2k

01-26-2005 10:40

Installshield 6/7 script decompiler

1 Attachment(s)

You can Use Installshield 6/7 script decompiler for decompile InstallShield 6/7 Script :)

WhoCares

01-26-2005 12:17

for binary files, use feof() function, don't use EOF macro.

Dmit	01-26-2005 15:13

Quote:

Originally Posted by WhoCares

for binary files, use feof() function, don't use EOF macro.

What the reason for such recommendation? According to MSDN

Quote:

To indicate a read error or end-of-file condition, getc and getchar return EOF

I've used EOF for more that 10 years in multiple progs, and never encountered any problem.

Kerlingen

01-26-2005 17:01

@Dmit:
For me TYPE only truncates the output if it is directed to the console. As soon as it is redirected to any other file or any other program, it fully copies the filecontents. My BC++ compiled copy worked with the TYPE command just like the other way.

The VC++ and DMC copies truncated the file somewhere after 100kb or something (each one at the different position), so I guess (and tested) that there was at least one 0x1A before that file position.

@wasq:
For me it works with 0xF1 as XOR value. Using 0x0E gives me the wrong output.

sackpower

01-27-2005 03:39

@ wasq: 0xF1 is the right XOR value.

I started a small project and decrypted a setup.inx with ISDHelper,
then I worked on it with SID (Sexy InstallShield Decompiler) and
rebuild the original crypted setup.inx. All worked fine.

Here is my solution for rebuilding the crypted INX:

Code:

//Usage: ISDGoBack.exe <newsetup.inx> setup.inx



#include <stdio.h>

#include <fcntl.h>

#include <io.h>

#define XOR_VAL 0xF1



void main (void) 

{

        int i, c;

        unsigned char b;

        // Set "stdin" and "stdout" to have binary mode

        setmode (_fileno (stdin), _O_BINARY);

        setmode (_fileno (stdout), _O_BINARY);

        // Rebuild the crypted INX

        for (i = 0; (c = getchar ()) != EOF; i++)

        {

            int d, e;



            d = 0x00;



            do

            {

                e = d;

                e ^= XOR_VAL;

                b = (unsigned char)((e >> 2) | (e << 6)) - (i % 71);

                if (b == c)

                {

                    putchar (d);

                }

                else d++;

            } while (b != c && d <= 0xFF);

        }

}

I don't know if there is a better solution, but it works.

wasq	01-27-2005 18:09

@sackpower

sorry. the original IS decrypting algorithm in isscript.dll uses (not(char)) xor (not (0xF1)) and this is realy equal to char xor 0xF1. i forgot about the second not().

xtx	02-03-2005 12:36

@Dmit

Worked fine when compiled with VC++ 6.0 as a W32 Console App. Thanks, I thought they had done something totally new but all it good again.

@sackpower

Couldn't get yours to work for some reason :(

xtx

WhoCares

02-03-2005 17:43

Quote:

Originally Posted by Dmit

What the reason for such recommendation? According to MSDN

I've used EOF for more that 10 years in multiple progs, and never encountered any problem.

You are right. sorry :D

Janus68

02-07-2005 02:43

IMHO reading crypted *.inx into memory buffer, then xor this buffer, and write back xored buffer into second file would be better.

regards.

sackpower

02-07-2005 22:06

1 Attachment(s)

@xtx:

I'm using VC++ 7 (VS 2003) and for me everything works fine.

Maybe the attached sample project will help you (please change the path in the .bat file or use the current directory instruction: set APP_PATH=%CD%).

Sackpower

The Day Walker!

01-05-2006 05:17

1 Attachment(s)

@ dmit

i tried decrypting a setup.inx file using ur c++ code. but i m not able 2 compile ur code

successfully,,,,, i used turbo c++, and getting errors.. during compilation,,,

may i have a compiled script for ur code....

my setup.inx file is attached

thanx

TDW {RES}

sackpower

01-09-2006 21:12

1 Attachment(s)

@ TDW

Here is your decrypted setup.inx file (look at newsetup.inx)

regards

sackpower

The Day Walker!

01-10-2006 02:08

@ power..

pal..will check it out... and c if it works.... or not...

thanx

TDW {RES}

xtx	01-10-2006 10:14

@ TDW

I have a compiled version based on the code below if you would like it just email me xteaze [at] excite [dot] com

xtx

Code:

//Usage: ISDGoBack.exe < new version setup.inx > old version setup.inx



#include <stdio.h>

#include <fcntl.h>

#include <io.h>

#define XOR_VAL 0xF1



void main (void) 

{

    int i, c;

    int d, e;

    unsigned char b;

    // Set "stdin" and "stdout" to have binary mode

    setmode (_fileno (stdin), _O_BINARY);

    setmode (_fileno (stdout), _O_BINARY);

    // Rebuild the crypted INX

    for (i = 0; (c = getchar ()) != EOF; i++)

    {

        c ^= XOR_VAL;

        b = (unsigned char)((c >> 2) | (c << 6)) - (i % 71);

        putchar (b);

    }

}

The Day Walker!

01-11-2006 02:09

thanx pal...

but is this code different from the 1 posted above,,, cause i downloadede the compiled

exe file that was attached previously.....

and just received the isdhelper also...

from another member..

thanx 4 helpin...

TDW {RES}

xtx	01-11-2006 06:45

@ TDW

No difference in the end results, only in the compiler and the fact that the code I posted became some merged version of dmit's and sackpower's code after I couldn't get either to compile right (totally my fault). Just thought that you were still having problems getting the code to compile. Also forgot that sackpower included an executable and code in response to my earlier posts after I had issues. That is what happens when I haven't touched on a topic for almost a year.

xtx

The Day Walker!

01-12-2006 04:32

its ok pal...

i got it working now... also completed my work... i was tryin 2 patch an msi file

for the game gun, i was creating a cd to dvd conversion stuff,,, so needed 2 patch msi.

but this games setup is a bit different from other games,,,, thats y...

thanx

TDW {RES}

All times are GMT +8. The time now is 11:03.