[File] [PATCH] of Magdir/ole2compounddocs for Windows Installer companion: *.mst *.msm *.pcp

[Jörg Jenderek]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

some months ago i send patch to recognize Microsoft Windows
Installer Packages (*.msi). Some days ago i run file command
version 5.38 on Windows Installer companion samples with file name
extension mst, msm and pcp. For such examples with -e cdf option i
get an output like:

7z1804.msi:           OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer Package
Janus_GridEX2000.Msm: OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer Package
jre1031.MST:          OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft
lp-2050MSI_1025.mst:  OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft
openoffice.pcp:       OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer Package
richtext.msm:         OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer Package
ure.pcp:              OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer Package

For comparison reason i run other file identifying tools. TrID
(found on https://mark0.net/soft-trid-e.html ) describes many MST
examples as "Windows SDK Setup Transform Script".
Furthermore with --extension option wrong file name extension "msi"
is displayed for MSM and PCP examples.

With the observed knowledge i searched for a web page concerning
that additional Windows installer files. On Microsoft server i
found a page about identifying Windows Installer File Types. So i
add that page as reference inside Magdir/ole2compounddocs by
comment line like:
 # Reference:	https://devblogs.microsoft.com/
 # /setup/identifying-windows-installer-file-types/

According to that page for Transform scripts an own CLSID
{000C1082-0000-0000-C000-000000000046} is used, which looks similar
to id {000C1084-0000-0000-C000-000000000046} for MSI packages.

Because the clsid is a unique identifier, then in sub routine
ole2-directory inside Magdir/ole2compounddocs lines must be added
to check for specific id at offset 80 of directory stream and then
print file description. For MSI this lines looks like
 >>88 	ubequad	0xc000000000000046 : Microsoft
 ...
 >>>80 	ubequad	0x84100c0000000000 Windows Installer Package
So after that section add lines for MST samples which start with
lines like
 >>>80 	ubequad	0x82100c0000000000 Windows Installer transform script
Afterwards show user defined mime type and file name extension for
installer sub class by lines like
 !:mime	application/x-ms-mst
 !:ext	mst

According to reference for MSI, MSM and PCP the same clsid is used,
but i do not found an easy way to distinguish between these 3 sub
types. So i changed describing line into something like
 >>>80 	ubequad	0x84100c0000000000 Windows Installer Package,
                          Merge Module or Patch Creation Prop
To match also Merge Module and Patch Creation Properties sub types
the line for file name extension now becomes
 !:ext	msi/msm/pcp

After applying the above mentioned modifications by patch
file-5.38-ole2compounddocs-mst.diff then the above mentioned
Windows Installer and companion samples are now identified like:


7z1804.msi:           OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      Package, Merge Module or Patch Creation Prop
Janus_GridEX2000.Msm: OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      Package, Merge Module or Patch Creation Prop
jre1031.MST:          OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      transform script
lp-2050MSI_1025.mst:  OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      transform script
openoffice.pcp:       OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      Package, Merge Module or Patch Creation Prop
richtext.msm:         OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      Package, Merge Module or Patch Creation Prop
ure.pcp:              OLE 2 Compound Document, v3.62, SecID 0x1 :
		      Microsoft Windows Installer
		      Package, Merge Module or Patch Creation Prop

I hope that my diff file can be applied in future version of file
utility.

With best wishes
Jörg Jenderek
- --
Jörg Jenderek

-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXp71vAAKCRCv8rHJQhrU
1i/SAJ9gGNU1e8G6OpvJR7Q1Dz92KaO4GwCeLX9gq00xao36uUugf8HDKy1gjXc=
=SZa1
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.38/magic/Magdir/ole2compounddocs.old	2019-08-02 19:08:18 +0000
+++ file-5.38/magic/Magdir/ole2compounddocs	2020-04-21 13:21:02 +0000
@@ -226,6 +226,11 @@
 # URL:	http://fileformats.archiveteam.org/wiki/Windows_Installer
->>>80 	ubequad		0x84100c0000000000	Windows Installer Package
+#	https://en.wikipedia.org/wiki/Windows_Installer
+# 227: Warning: description `Windows Installer Package, Merge Module or Patch Creation Prope' truncated
+#>>>80 	ubequad		0x84100c0000000000	Windows Installer Package, Merge Module or Patch Creation Properties
+>>>80 	ubequad		0x84100c0000000000	Windows Installer Package, Merge Module or Patch Creation Prop
 !:mime	application/x-msi
 #!:mime	application/x-ms-win-installer
-!:ext	msi
+# msm for Merge Module	https://en.wikipedia.org/wiki/Merge_Module
+# pcp for Patch Creation Properties
+!:ext	msi/msm/pcp
 >>>80 	ubequad		0x86100c0000000000	Windows Installer Patch
@@ -236,2 +241,11 @@
 #
+# Reference:	https://devblogs.microsoft.com/setup/identifying-windows-installer-file-types/
+# From:		Joerg Jenderek
+# Note:		called by TrID "Windows SDK Setup Transform Script"
+>>>80 	ubequad		0x82100c0000000000	Windows Installer transform script
+# ??
+#!:mime	application/x-wine-extension-mst
+!:mime	application/x-ms-mst
+!:ext	mst
+#
 # URL:	http://fileformats.archiveteam.org/wiki/DOC
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.38-ole2compounddocs-mst.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20200421/2442eabb/attachment.obj>