[File] [PATCH] Magdir/archive InstallShield Z archive Data *.Z + installer archive *.EX_
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Sat Nov 13 00:58:22 UTC 2021
Hello,
some days ago i send patch for InstallShield CAB found in
installation directories. Now i look also in more directories for
more/other InstallShield files.
When running running file command version 5.41 on such examples i
get an output like:
DATA.Z: InstallShield Z archive Data
GFX2.Z: InstallShield Z archive Data
SYSTEM.Z: InstallShield Z archive Data
ScrSaverAVI.z: InstallShield Z archive Data
ScrSaverSCR.z: InstallShield Z archive Data
_INST32I.EX_: data
_SETUP32.LIB: InstallShield Z archive Data
_inst16.ex_: data
golf_INST32I.EX_: data
Furthermore with --extension option only 3 character sequence ??? is
shown. With -i option only generic mime type application/octet-stream
is shown.
For comparison reason i run the file format identification utility
TrID ( See https://mark0.net/soft-trid-e.html). The Z and LIB
examples are also described correctly by TrID as "InstallShield Z
archive" by ark-z-InstallShield.trid.xml.
The examples described by file command as "data" are described
correctly by TrID as "Stirling Technologies InstallShield compressed"
by ishield.trid.xml (See appended z_lib-trid-v.txt.gz)
This list the used file name extensions and often with -v option
the related URL pointing to used file format information.
Luckily on referenced web site 2 open source tools "isextract" and
"InstallShield v3 extractor" are mentioned, that can handle such
InstallShield archives. The relevant information is found an
C++ sources installshieldarchivev3.cpp and isextract.cpp
So these informations are now expressed by comment lines inside
Magdir/archive like:
# URL: http://fileformats.archiveteam.org/wiki/InstallShield_Z
# Ref.: http://mark0.net/download/triddefs_xml.7z/
# defs/a/ark-z-InstallShield.trid.xml
# https://github.com
# wfr/unshieldv3/blob/master/installshieldarchivev3.cpp
# OmniBlade/isextract/blob/master/src/isextract.cpp
In current version the only magic line looks like:
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
Now after test for SIGNATURE (0x8C655D13) display a user
defined one instead generic mime type application/octet-stream.
TrID only mention 1 byte file name extension "Z", but on referenced
web site also 3 byte extension "LIB" is mentioned. So this now
becomes like:
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
!:mime application/x-installshield-z
!:ext z/lib
Afterwards according to sources now display next information like
number of files in archive and archive_size by lines like:
>12 uleshort x \b, %u file
>12 uleshort !1 \bs
>18 ulelong x \b, %u bytes
Apparently not all aspects of that proprietary file format are known
to developers. So many parts are only described as like ignore0[8],
ignore2[19], ignore3[4] and so on.
Now afterwards i display more technical information not interesting
for "normal "users by lines like:
>49 uleshort x \b, dir count %#x
>41 ulelong x \b, at %#x TableOfContent
>(41.l+0) uleshort x \b; 1st file count %u
>(41.l+2) uleshort x \b, chunk size %#x
>(41.l+4) uleshort x \b, length %u
With the help of the stored Table Of Content (TOC) address i was able
to inspect the table or at least the first entry. Unfortunately this
has no fixed size and has many "ignored" parts and i am no c++
expert. So i do not understand the TOC structure in detail. But at
least for case where dir count is one i was able to locate the first
filename entry (like courses.dat CTL3D32S.DLL DREVENGE.INI
KEMSaver.scr MSVCIRT.DLL). I hope that this i always true. This is
shown by lines like:
>49 uleshort 1
>>(41.l+2) uleshort x \b, with
>>>&(&0.s+37) string x "%s"
Luckily on documentation web site also a link to "InstallShield
installer archive" is mentioned. So these informations are added
after "Z" variant by comment lines like:
# URL: http://fileformats.archiveteam.org/
# wiki/InstallShield_installer_archive
# Ref.: http://mark0.net/download/triddefs_xml.7z
# defs/i/ishield.trid.xml
According to documentation this variant is now shown by string lines
starting like:
0 ubelong =0x2aab79d8 InstallShield installer archive
!:mime application/x-installshield-compress
!:ext ex_
Now after test for SIGNATURE (2a ab 79 d8) display a user
defined one instead generic mime type application/octet-stream.
TrID only mention 3 byte file name extension "??_", but on referenced
web site only "ex_" is mentioned. This is the only extension found in
my examples like: _INST16.EX_ _INST32I.EX_ golf_INST32I.EX_
jakkal_INST32I.EX_. Furthermore TrID calls this variant "Stirling
Technologies InstallShield compressed", but i choose name mentioned
on website, which gives in my opinion a more consistent naming
compared with others.
Some bytes later obviously archive member names like INSTALL.EXE
followed by names like _INS0432._MP _INS0576._MP _INS5176._MP are
stored. Before the strings apparently the length of the strings are
stored as 2 byte integer. Hoping that this is always true, i show
first archived file names by additional lines like:
>102 pstring/h x \b, with %s
>>&0 pstring/h x %s
After applying the above mentioned modifications by patch
file-5.41-archive-installshield-z_ex_.diff then all my InstallShield
Z archive are described with more details and the InstallShield EX_
examples are now also recognized. This now looks like:
DATA.Z: InstallShield Z archive Data,
532 files, 24530220 bytes, dir count 0x2a,
at 0x175da18 TableOfContent
GFX2.Z: InstallShield Z archive Data,
223 files, 53064 bytes, dir count 0x3,
at 0xa0cc TableOfContent;
1st file count 42, chunk size 0xb, length 0
SYSTEM.Z: InstallShield Z archive Data,
3 files, 292534 bytes, dir count 0x1,
at 0x47605 TableOfContent;
1st file count 3, chunk size 0x10, length 5
, with "MSVCIRT.DLL"
ScrSaverAVI.z: InstallShield Z archive Data,
15 files, 1635972 bytes, dir count 0x1,
at 0x18f36b TableOfContent
ScrSaverSCR.z: InstallShield Z archive Data,
1 file, 118283 bytes, dir count 0x1,
at 0x1cdc9 TableOfContent;
1st file count 1, chunk size 0xb, length 0
, with "KEMSaver.scr"
_INST32I.EX_: InstallShield installer archive, with
INSTALL.EXE _INS0576._MP
_SETUP32.LIB: InstallShield Z archive Data,
4 files, 52617 bytes, dir count 0x1,
at 0xcca5 TableOfContent;
1st file count 4, chunk size 0xb, length 0
, with "CTL3D32S.DLL"
_inst16.ex_: InstallShield installer archive, with
install.exe _ins0433._mp
golf_INST32I.EX_: InstallShield installer archive, with
install.exe _ins0432._mp
I hope my diff file can be applied in future version of file utility.
With best wishes
Jörg Jenderek
--
Jörg Jenderek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: z_lib-trid-v.txt.gz
Type: application/x-gzip
Size: 502 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20211113/3df6fd6b/attachment.bin>
-------------- next part --------------
--- file-5.41/magic/Magdir/archive.old 2021-08-30 09:10:26 +0000
+++ file-5.41/magic/Magdir/archive 2021-11-13 00:12:29 +0000
@@ -727,3 +727,68 @@
# InstallShield
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/InstallShield_Z
+# Reference: http://mark0.net/download/triddefs_xml.7z/
+# defs/a/ark-z-InstallShield.trid.xml
+# https://github.com
+# wfr/unshieldv3/blob/master/installshieldarchivev3.cpp
+# OmniBlade/isextract/blob/master/src/isextract.cpp
+# Note: verfied by `i3comp.exe LANGUAGE.Z -dt`
+# signature 0x8C655D13
0 string \x13\x5d\x65\x8c InstallShield Z archive Data
+#!:mime application/octet-stream
+!:mime application/x-installshield-z
+# like: DATA.Z GFX2.Z INI.Z LANGUAGE.Z pictures.z ScrSaverAVI.z SETUP.Z _SETUP32.LIB
+!:ext z/lib
+# ignore0[8]; like 3A010200...
+>4 ubelong !0x3a010200 \b, at 4 %#8.8x
+# file_count like: 1 3 15 20 32 100 223 432 532
+>12 uleshort x \b, %u file
+# plural s
+>12 uleshort !1 \bs
+# ignore1[4]
+# archive_size; like: 390 1014 53064 118283 335530 6934854 10322461
+>18 ulelong x \b, %u bytes
+# ignore2[19]
+# TOC
+# ignore3[4]
+# dir_count like: 1 2 3 4 5 13 32 42
+>49 uleshort x \b, dir count %#x
+# TOC_address like: 0x144 0x3b5 0xa0cc 0x51d57 0x190aec2
+>41 ulelong x \b, at %#x TableOfContent
+# 1st file_count like: 1 3 11 42
+>(41.l+0) uleshort x \b; 1st file count %u
+# 1st chunk_size
+>(41.l+2) uleshort x \b, chunk size %#x
+# nlen; length of 1st name
+>(41.l+4) uleshort x \b, length %u
+# only one dir count considered because it is "simple" enough
+>49 uleshort 1
+>>(41.l+2) uleshort x \b, with
+# hope that this always true; file name of 1st TOC entry like:
+# courses.dat CTL3D32S.DLL DREVENGE.INI KEMSaver.scr MSVCIRT.DLL
+>>>&(&0.s+37) string x "%s"
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/InstallShield_installer_archive
+# Reference: http://mark0.net/download/triddefs_xml.7z
+# defs/i/ishield.trid.xml
+# Note: called by TrID "Stirling Technologies InstallShield compressed"
+# not to be confused with InstallShield CAB, InstallShield Z, or MS-DOS compression
+0 ubelong =0x2aab79d8 InstallShield installer archive
+#!:mime application/octet-stream
+!:mime application/x-installshield-compress
+# like: _INST16.EX_ _INST32I.EX_ golf_INST32I.EX_ jakkal_INST32I.EX_
+!:ext ex_
+# UNKNOWN like: 00010000h
+>4 ubelong !0x00010000 \b, at 4 %#8.8x
+# copyright text like:
+# "Copyright (c) 1990-1995 Stirling Technologies, Inc. All Rights Reserve"
+>8 string !Copyright\040(c)\0401990-1995 \b, "%.70s"
+# probably file name length like: 10
+#>102 uleshort x \b, name length %x
+# probably 1st filename like: INSTALL.EXE install.exe
+>102 pstring/h x \b, with %s
+# probably 2nd like: _INS0432._MP _INS0576._MP _INS5176._MP _INS5576._MP _ins0432._mp
+>>&0 pstring/h x %s
+# UNKNOWN
+#>>>&0 ubequad x \b, FOLLOWED BY UNKNOWN %16.16llx
# Gather
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.41-archive-installshield-z_ex_.diff.sig
Type: application/octet-stream
Size: 1581 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20211113/3df6fd6b/attachment.obj>
More information about the File
mailing list