search

mgeeky / msidump

MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.
https://mgeeky.tech/msi-shenanigans-part-1/
194 stars 18 forks source link

Add more Custom Action Types #3

Open zemthos opened 1 year ago

zemthos commented 1 year ago

https://github.com/mgeeky/msidump/blob/40833694ebba0188f4f6e0d0bf5fd89a223775be/msidump.py#L239

There are more useful types to include in CustomActionTypes.

According to https://learn.microsoft.com/en-us/windows/win32/msi/summary-list-of-all-custom-action-types, at least the Custom Action Type 37 and 38 are important.