search

armijnhemel / binaryanalysis-ng

Binary Analysis Next Generation (BANG)
GNU Affero General Public License v3.0
461 stars 66 forks source link

It is possible to add a parser to support msi packages? #373

Closed chimelab closed 3 months ago

chimelab commented 3 months ago

There's a PE parser, however, it doesn't support msi packages, e.g. https://download-installer.cdn.mozilla.net/pub/firefox/releases/124.0.1/win32/en-US/Firefox%20Installer.exe Currently, users have to use 7z to extract them before passing to BANG. It's not a convenient way, especially if msi files are in sub folders.

armijnhemel commented 3 months ago

The PE parser doesn't work well and improving it is on my TODO list. There are so many installers and unpackers for PE that it is impossible to add them all.

Likely I will first add support for this: https://github.com/twogood/unshield/ and then add others.

By the way, the installer you linked seems to be UPX compressed, not an MSI archive. After first decompressing it with upx and then 7z x I actually see:

$ file setup-stub.exe 
setup-stub.exe: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections

which is a different installer, namely https://sourceforge.net/projects/nsis/

chimelab commented 3 months ago

Thanks for looking in to it. Yes, it's UPX compressed. I mixed them up. Anyway, looking forward to any improvements.