Trying to read MSI SQL table RRS feed

  • Question

  • Hi,

    I'm trying to write a parser that will extract the files out of an MSI file.

    So far I extracted the files from the included CAB in the MSI BUT!

    I need to query the SQL tables of the MSI to know the file names and other parameters.

    I cannot use the WinAPI for that because I need the parser to be run on linux.

    I saw that one of the streams inside the MSI is the table:

    NameTableTypeColumnPropertyId_Validation_SummaryInformationSetDescriptionCategoryKeyColumnMaxValueNullableKeyTableMinValueNValueIdentifierName of tableName of columnY;NWhether the column is nullableYMinimum value allowedMaximum value allowedFor foreign key, Name of table to which data must linkColumn to which foreign key connectsText;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;CustomSource;Property;Cabinet;Shortcut;FormattedSDDLText;Integer;DoubleInteger;TimeDate;DefaultDirString categoryTextSet of values that are permittedDescription of columnAdminExecuteSequenceActionName of action to invoke, either in the engine or the handler DLL.ConditionOptional expression which skips the action if evaluates to expFalse.If the expression syntax is invalid, the engine will terminate, returning iesBadActionData.SequenceNumber that determines the sort order in which the actions are to be executed.  Leave blank to suppress action.AdminUISequenceAdvtExecuteSequenceAppSearchPropertyThe property associated with a SignatureSignature_Signature;RegLocator;IniLocator;DrLocator;CompLocatorThe Signature_ represents a unique file signature and is also the foreign key in the Signature,  RegLocator, IniLocator, CompLocator and the DrLocator tables.BinaryUnique key identifying the binary data.DataThe unformatted binary data.ComponentPrimary key used to identify a particular component record.ComponentIdGuidA string GUID unique to this component, version, and language.Directory_DirectoryRequired key of a Directory table record. This is actually a property name whose value contains the actual path, set either by the AppSearch action or with the default setting obtained from the Directory table.AttributesRemote execution option, one of irsEnumA conditional statement that will disable this component if the specified condition evaluates to the \\\'True\\\'

    As you can see it has no delimiters at all, the values of the tables are just concated. there are other streams that I don't know the meaning of.

    I presume that one of them is acted as an offset map of some sort to tell the installer how to parse the table.

    Can anyone guide me into how to parse it myself? or even to tell me what is the name of the stream of the offset map?


    Sunday, January 19, 2020 1:18 PM