Exetools - New InstallShield script format?

Page 1 of 2

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - New InstallShield script format? (https://forum.exetools.com/showthread.php?t=6444)

MrHalo

01-17-2005 04:00

New InstallShield script format?

Hi,

I've tried to decompile an InstallShield installation script file (setup.inx) with isdcc and sid. Both attempts failed.

Is Installshield using a new script format in there latest products and are there tools to decompile those scripts?

MrHalo

Dmit	01-17-2005 15:01

AFAIR "isdcc" supports scripts for IS v5.5 and below (setup.ins). "sid" and "isd" supports v6+, but starting from v8 additional mangling is applied to the setup.inx. Try de-mangle it with the following code:

Code:

#include <stdio.h>

#include <fcntl.h>

#include <io.h>

#define XOR_VAL 0xF1

void main (void) {

int i, c;

unsigned char b;

// Set "stdin" and "stdout" to have binary mode

_setmode (_fileno (stdin), _O_BINARY);

_setmode (_fileno (stdout), _O_BINARY);

// Decrypt INX

for (i = 0; (c = getchar ()) != EOF; i++) {

c ^= XOR_VAL;

b = (unsigned char)((c >> 2) | (c << 6)) - (i % 71);

putchar (b);

}

}

and feed result to sid/isd

Kerlingen

01-17-2005 16:21

Thank you for the code Dmit.

But the code like you posted it here doesn't correctly work for me and perhaps for others neither. I compiled it with VC++ ("ISDHelper.exe") and tried it with some encrypted SETUP.INX files.

I tried the following commands:

"ISDHelper < SETUP.INX > NewSETUP.INX"
and
"Type SETUP.INX | ISDHelper > NewSetup.INX"

But both commands truncated the output file at different locations and didn't fully decrypt it. The same result with DMC. Then I used BC++ to compile (I had to rename "_setmode" to "setmode" and it worked fine.

What could be the reason for this?

wasq	01-25-2005 01:22

XOR_VAL must be 0x0E (or not(0xF1))

Dmit	01-25-2005 16:59

Quote:

Originally Posted by Kerlingen

I tried the following commands:

"ISDHelper < SETUP.INX > NewSETUP.INX"
and
"Type SETUP.INX | ISDHelper > NewSetup.INX"

Using "Type ..." may produce truncated result because "type" considered EOF if character with code 0x1A is encountered.

Quote:

Originally Posted by Kerlingen

Then I used BC++ to compile (I had to rename "_setmode" to "setmode" and it worked fine.
What could be the reason for this?

I have no idea. I've compiled code with "cl" from MS VC++ v6 and uses input/output redirection like in your first command. All works fine...

NimDa2k

01-26-2005 10:40

Installshield 6/7 script decompiler

1 Attachment(s)

You can Use Installshield 6/7 script decompiler for decompile InstallShield 6/7 Script :)

WhoCares

01-26-2005 12:17

for binary files, use feof() function, don't use EOF macro.

Dmit	01-26-2005 15:13

Quote:

Originally Posted by WhoCares

for binary files, use feof() function, don't use EOF macro.

What the reason for such recommendation? According to MSDN

Quote:

To indicate a read error or end-of-file condition, getc and getchar return EOF

I've used EOF for more that 10 years in multiple progs, and never encountered any problem.

Kerlingen

01-26-2005 17:01

@Dmit:
For me TYPE only truncates the output if it is directed to the console. As soon as it is redirected to any other file or any other program, it fully copies the filecontents. My BC++ compiled copy worked with the TYPE command just like the other way.

The VC++ and DMC copies truncated the file somewhere after 100kb or something (each one at the different position), so I guess (and tested) that there was at least one 0x1A before that file position.

@wasq:
For me it works with 0xF1 as XOR value. Using 0x0E gives me the wrong output.

sackpower

01-27-2005 03:39

@ wasq: 0xF1 is the right XOR value.

I started a small project and decrypted a setup.inx with ISDHelper,
then I worked on it with SID (Sexy InstallShield Decompiler) and
rebuild the original crypted setup.inx. All worked fine.

Here is my solution for rebuilding the crypted INX:

Code:

//Usage: ISDGoBack.exe <newsetup.inx> setup.inx



#include <stdio.h>

#include <fcntl.h>

#include <io.h>

#define XOR_VAL 0xF1



void main (void) 

{

        int i, c;

        unsigned char b;

        // Set "stdin" and "stdout" to have binary mode

        setmode (_fileno (stdin), _O_BINARY);

        setmode (_fileno (stdout), _O_BINARY);

        // Rebuild the crypted INX

        for (i = 0; (c = getchar ()) != EOF; i++)

        {

            int d, e;



            d = 0x00;



            do

            {

                e = d;

                e ^= XOR_VAL;

                b = (unsigned char)((e >> 2) | (e << 6)) - (i % 71);

                if (b == c)

                {

                    putchar (d);

                }

                else d++;

            } while (b != c && d <= 0xFF);

        }

}

I don't know if there is a better solution, but it works.

wasq	01-27-2005 18:09

@sackpower

sorry. the original IS decrypting algorithm in isscript.dll uses (not(char)) xor (not (0xF1)) and this is realy equal to char xor 0xF1. i forgot about the second not().

xtx	02-03-2005 12:36

@Dmit

Worked fine when compiled with VC++ 6.0 as a W32 Console App. Thanks, I thought they had done something totally new but all it good again.

@sackpower

Couldn't get yours to work for some reason :(

xtx

WhoCares

02-03-2005 17:43

Quote:

Originally Posted by Dmit

What the reason for such recommendation? According to MSDN

I've used EOF for more that 10 years in multiple progs, and never encountered any problem.

You are right. sorry :D

Janus68

02-07-2005 02:43

IMHO reading crypted *.inx into memory buffer, then xor this buffer, and write back xored buffer into second file would be better.

regards.

sackpower

02-07-2005 22:06

1 Attachment(s)

@xtx:

I'm using VC++ 7 (VS 2003) and for me everything works fine.

Maybe the attached sample project will help you (please change the path in the .bat file or use the current directory instruction: set APP_PATH=%CD%).

Sackpower

All times are GMT +8. The time now is 03:58.

Page 1 of 2

Show 40 post(s) from this thread on one page