[File] [PATCH] of Magdir/windows for InnoSetup messages *.msg

Jörg Jenderek joerg.jen.der.ek at gmx.net
Mon Aug 31 14:33:04 UTC 2020

Hash: SHA1

some days ago i handled OS/2 help message *.msg.

Just for interest i look on my disc for other files with that file
name extensions. Some are described as "data" by file command
version 5.39.
For such found samples in the directory exist 2 other files with same
main name, but with file name extensions exe and dat.
The executables are identified as "PE32 executable (GUI) Intel 80386"
and the other type with dat extension is identified as "InnoSetup
Log". So i know that such MSG samples are part of Inno Setup software

For comparison reason i run the file format identification utility
TrID ( See https://mark0.net/soft-trid-e.html).  This describes
such samples as Inno Setup Messages. It also list the used file
name extension msg and with -v option the related URL pointing to
used file format information.

So i look at Jordan Russell Software website jrsoftware.org for
information about such MSG files. Some information is found at item
"SignedUninstaller" inside Inno Setup Documentation. This is now
expressed inside Magdir/windows by additional comment line like:
 # jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller
More information about that message file format can be found in
source files of InnoSetup. This is expressed by additional comment
line like:
 # https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas

Characteristic for such message files is a typical ASCII phrase at
the beginning. That is expressed by first magic line like
 0	string	Inno\ Setup\ Messages\ (
That first structure is null padded til 0x40 boundary. That is used
as second test line like:
 >0x38	quad		0		InnoSetup messages
Afterwards the file name extension and a user defined mime type is
shown by lines like:
 !:mime	application/x-innosetup-msg
 !:ext	msg

After start magic a point separated version string like 5.1.1
5.1.11 5.5.0 5.5.3 6.0.0 is stored , followed by a terminating
right parentheses. That is shown by by lines like:

 >>0x15		string	x		\b, version %.5s
 >>>0x1a	ubyte	!0x29		\b%c

If the phrase (u) after version string occurs, then message texts are
encoded as UTF-16. Otherwise the messages are stored as ASCII text.
First message starts as offset 0x50. So first message text is shown
by lines like:
 >>0x40		ulelong		x
 >>>0x1c	search/2	(u)		(UTF-16),
 >>>>0x50 	lestring16	x		%s
 >>>0x1c	default		x		(ASCII),
 >>>>0x50 string		x		%s

After applying the above mentioned modifications by patch
file-5.39-windows-msg.diff then i get an  output like:
unins000-fileanalyzer.msg: InnoSetup messages,
			   version 5.1.11,
			   207 messages (ASCII),
			   &About Setup...
unins000-foxit.msg:        InnoSetup messages,
			   version 5.1.11,
			   207 messages (UTF-16),
			   &About Setup...
unins000-gimp.msg:         InnoSetup messages,
			   version 6.0.0,
			   243 messages (UTF-16),
			   Installation abbrechen
unins000-sumo.msg:         InnoSetup messages,
			   version 5.5.3,
			   221 messages (ASCII),
			   &About Setup...
unins000.dat:              InnoSetup Log 64-bit GIMP,
			   version 0x418, 13151151 bytes,
			   COMPUTER1\joerg234 ,
			   C:\Program Files\GIMP 2
unins000.exe:              PE32 executable (GUI) Intel 80386,
			   for MS Windows
unins001.dat:              InnoSetup Log GIMP Help 2.8.2,
			   version 0x418, 1031680 bytes,
			   COMPUTER1\joerg234 ,
			   C:\Program Files\GIMP 2
unins001.exe:              PE32 executable (GUI) Intel 80386,
			   for MS Windows
unins001.msg:              InnoSetup messages,
			   version 6.0.0,
			   240 messages (UTF-16),
			   Installation abbrechen

I hope my diff file can be applied in future version of
file utility.

With best wishes
Jörg Jenderek
- --
Jörg Jenderek

Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

-------------- next part --------------
--- file-5.39/magic/Magdir/windows.old	2020-05-31 10:34:41 +0000
+++ file-5.39/magic/Magdir/windows	2020-08-31 14:04:51 +0000
@@ -918,6 +918,35 @@
 # directory like C:\Program Files\GIMP 2
 >>>>&0	lestring16	x				\b, %-.42s
+# URL:      https://jrsoftware.org/ishelp/index.php?topic=setup_signeduninstaller
+# Reference:https://github.com/jrsoftware/issrc/blob/main/Projects/Struct.pas
+# From:     Joerg Jenderek
+0	string	Inno\ Setup\ Messages\ (
+# null padded til 0x40 boundary
+>0x38	quad		0				InnoSetup messages
+!:mime	application/x-innosetup-msg
+# unins000.msg, unins001.msg, ...
+!:ext	msg
+# version like 5.1.1 5.1.11 5.5.0 5.5.3 6.0.0
+>>0x15	string		x				\b, version %.5s
+# look for 6th char of version string or terminating right parentheses
+>>>0x1a	ubyte		!0x29				\b%c
+# NumMessages
+>>0x40	ulelong		x				\b, %u messages
+# TotalSize: Cardinal;
+#>>0x44	ulelong		x				\b, TotalSize %u
+# NotTotalSize: Cardinal;
+#>>0x48	ulelong		x				\b, NotTotalSize %u
+# CRCMessages: Longint;
+#>>0x4C	ulelong		x				\b, CRC 0x%x
+>>0x40	ulelong		x
+# (u) after version means unicoded messages
+>>>0x1c	search/2	(u)				(UTF-16),
+>>>>0x50 lestring16	x				%s
+# ASCII coded message
+>>>0x1c	default		x				(ASCII),
+>>>>0x50 string		x				%s
 # Windows Imaging (WIM) Image
 # Update: Joerg Jenderek at Mar 2019
 # URL: https://en.wikipedia.org/wiki/Windows_Imaging_Format
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.39-windows-msg.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20200831/3707b859/attachment.obj>

More information about the File mailing list