Well, I'm having one application. It is using InstallShield installer, but it is possible to make it to install just using MSI single file. This single file can be caught in Temp folder during installation, nothing special here.
So, when you are trying to install it (both ways - either from the standard package or from tmp msi file) it is asking for the serial number. And here the mystery begins.
In the case of IS it can be either a special dll or the inx file (the format I'm digging right now). In the case of MSI it could also probably be a dll hidden somewhere...
So, it is asking for the serial, checks it somehow and I can't understand how!
Tmp folder conains just ONE txt file with some GUID. The GUID is NOT present in the registry
As far as I was able to understand, there is also no some special dll. I was attaching to the process in the debugger and was watching "call stack" for each and every thread it has - NOTHING. So, I'm totally confused.
Any suggestions?


BTW, does anyone know any GOOD literature about MSI format. I used ORCA to play with it but I'd like to understand what I'm doing. Please, do not direct me to the MS MSI SDK - I don't like it

Sometimes tools like filemon can be good to find any possible "secret DLLs" like this, in a simple but yet efficient way? It should be able to show you all files that are touched by the installer, which in turn might give you valuable clues for starting points.

Yes! Absolutely! I'm stupid. Right you are. Everything became obvious.
Application creates the dll upon request - MSI creates it from the data in MSI file. Writes binary data into it. Launches the dll. Dll checks for the serial and then app unloads the dll and deletes it! As simple as that.
dELTA, thanks again.

BTW, the question about the GOOD literature concerning MSI is still here...

Hi,
There is a plugin for total commander which lets you browse and extract files inside MSI files..

hxxp://clubtotal.free.fr/modules.php?name=Downloads&d_op=getit&lid=160

OK, a set of MSI functions to retreive a file from the database.
Thanks. At least, now I have some sort of the beginning point.

FYI, WinRAR can open a lot of different files, including .msi files and many others most people don't know about.

mmk, you are right only partially. WinRAR is able to extract the files from the MOST msi-files. Some of them it cannot open. So I wrote a utility. So far I'm giving it without the sources but if anyone needs it I'll put them here. The utility should be used with ORCA. Using ORCA one determines the file name and then feeds it to my utility.

any place to find orca?

got it in the fravia's time but lost it since a while.

thanks!

ORCA is a part of the Platform SDK.
Soon I'll put it on wasm.ru

ok.i'll wait then