InstallShield archive format version 3

[KOLANICH]

meta:
  id: install_shield_archive_v3
  title: InstallShield archive format version 3
  application:
    - InstallShield (very old versions)
  file-extension:
    - Z
  xref:
    justsolve:
      - InstallShield_Z 
    wikidata: Q1193296

doc: |
  A very old format used by InstallShield installers usually from 199x.
  This version uses the compression implemented in https://github.com/madler/zlib/tree/master/contrib/blast

doc-ref:
  - https://docs.revenera.com/eol/installshield.htm
  - https://www.sac.sk/download/pack/icomp95.zip # i3comp
  - https://github.com/DeclanHoare/stix  # pascal, Linux
  - https://kannegieser.net/veit/quelle/stix_src.arj  # pascal
  - https://github.com/putara/isdecomp # !!!
  - https://github.com/lephilousophe/idecomp
  - https://github.com/wfr/unshieldv3
  - https://github.com/OmniBlade/isextract
  - https://github.com/agrif/unshield # rust
  - https://github.com/OpenRA/OpenRA/blob/bleed/OpenRA.Mods.Common/FileSystem/InstallShieldPackage.cs

[dgelessus]

Am currently looking into this format.

Another relevant link: https://github.com/OpenRA/OpenRA/blob/b3b10729cda46763767598e337f4d208d65706ee/OpenRA.Mods.Common/FileSystem/InstallShieldPackage.cs

[dgelessus]

An older implementation in Pascal: http://kannegieser.net/veit/quelle/stix_src.arj

Source code is mostly in German - not a problem for me 🙂 It also has some support for working with self-extracting InstallShield installers. The structures described in the code don't really match the installers I'm working with, so either the code is for an older InstallShield version, or InstallShield 3 had multiple variants of SFX installers. At least the encryption scheme for file names has stayed the same apparently, so that part is quite useful.