Hi,
Introduction:
***************************
I am using the MSI API to extract MSI embedded files, I do this by iterating
through all of the records in the ‘_Streams’ table and dumping each to a
local directory on the disk, the following illustrate this:
01)MsiDatabaseOpenView(m_hMSI,
L"SELECT `Name`,`Data` FROM `_Streams`",
&hStreamsView)
02)MsiViewExecute(hStreamsView, NULL);
for each record in the _Streams table
03)MsiViewFetch(hStreamsView, &hStreamRecord)
04) MsiRecordGetString(hStreamRecord, 1,
pPackedFileName, &dwBufSize)
05)CreateFile
While there is still data in the stream
06)MsiRecordReadStream(hStreamRecord, 2,
(char*)pbtStream, &dwBufSize);
07)WriteFile
The problem:
****************************
Some MSI installation has the files embedded in a CAB file named as a GUIDs,
this CAB contain the installation files, the files are named as GUIDs
resembling the data held in the ‘File’ field of the ‘File’ table…
My Question:
****************************
Is it possible to use the MSI API to extract the ‘real’ file directly from
the MSI? Is there a method for extracting embedded files according to the
‘FileName’ column of the ‘File’ table?
My alternative is to manually dump the ‘_Streams’ table ( as I do today ),
then to identify the CAB file according to it’s signature ( I have to
identify the file according to it’s signature as the name of the CAB is a
GUID… ), extract it and to rename the extracted files according to the
File->FileName mapping provided by the ‘File’ table.
I AM SURE THERE IS AN ELEGANTH WAY TO DO THAT… What it is?
--
Nadav
http://www.ddevel.com