@tottor :
Pour VMware :
A. Trivial :
tu démarres le setup, tu ne vas pas plus loin que la 1ère fenêtre, tu trouveras le msi dans le %temp%\{9CCFFF7D-DDA2-4123-B6D2-27A6FE6A4026}~setup\VMwareWorkstation.msi puis sous C:\Program Files (x86)\Common Files\VMware\InstallerCache\{9CCFFF7D-DDA2-4123-B6D2-27A6FE6A4026}.msi
Attention car l'exe d'install contient, en plus du msi, les 2 VC redist...
B. Sioux :
Sinon, un éditeur hexadécimal permet de trouver le .MSI contenu dans l'exe car tout MSI démarre par
A la suite, il y a 16 octets de valeur 0x00 :
//---------- VMware-workstation-17.6.0-24238078.exe ----------
Code : Tout sélectionner
001B292C D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 00 00 00 00 ÐÏ à¡± á
001B2940 00 00 00 00 3E 00 04 00 FE FF 0C 00 06 00 00 00 00 00 00 00 04 00 00 00 34 00 00 00 01 00 00 00 > þÿ 4
001B2960 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 FE FF FF FF 00 00 00 00 00 00 00 00 00 04 00 00 þÿÿÿ
Ne reste plus qu'à trouver la fin ou la longueur
Un peu plus haut dans l'exe, on trouve :
Code : Tout sélectionner
001B2600 52 57 4D 56 03 00 00 00 56 4D 77 61 72 65 57 6F 72 6B 73 74 61 74 69 6F 6E 2E 6D 73 69 00 00 00 RWMV VMwareWorkstation.msi
001B2620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B26A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B26C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B26E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2700 00 00 00 00 00 00 00 00 00 00 00 00 00 40 E6 0C 00 00 00 00 @æ
-- -- -- --
Tiens, que peut bien vouloir dire :
VMWaRe en "verlan"
?
et le
3... fichiers
?
Je dirais bien que la longueur c'est 00 40 E6 0C, soit 0CE64000 ("le plus petit devant"), soit 0x0CE64000=216 416 256 (en base 10) octets.
Si je démarre en 001B292C, avec une longueur de 0CE64000, je finis en 1B292C+0CE64000-1=0D01692B.
Allons voir :
Code : Tout sélectionner
0D0168E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0D016900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0D016920 00 00 00 00 00 00 00 00 00 00 00 00
Un peu plus haut, on trouve :
Code : Tout sélectionner
0D015F60 0A 13 0E 44 69 67 69 43 65 72 74 2C 20 49 6E 63 2E 31 3B 30 39 06 03 55 04 03 13 32 44 69 67 69 DigiCert, Inc.1;09 U 2Digi
0D015F80 43 65 72 74 20 54 72 75 73 74 65 64 20 47 34 20 52 53 41 34 30 39 36 20 53 48 41 32 35 36 20 54 Cert Trusted G4 RSA4096 SHA256 T
0D015FA0 69 6D 65 53 74 61 6D 70 imeStamp
le certificat du MSI
qui, comme on peut s'en douter est à la fin du MSI.
C.Q.F.D.
On continue dans la foulée...
//---------- vcredist_x86
Code : Tout sélectionner
0D01692C 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 MZ ÿÿ ¸
0D016940 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @
0D016960 00 00 00 00 00 00 00 00 18 01 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 º ´ Í!¸ LÍ!This p
0D016980 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 rogram cannot be run in DOS mode
Code : Tout sélectionner
001B2700 76 63 72 65 64 69 73 74 5F 78 38 36 vcredist_x86
001B2720 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .exe
001B2740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B27A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B27C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B27E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 25 D3 00 00 00 00 00 h%Ó
Code : Tout sélectionner
001B2820 76 63 72 65 64 69 73 74 5F 78 36 34 2E 65 78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 vcredist_x64.exe
001B2840 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2860 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2880 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B28A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B28C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B28E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2900 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
001B2920 00 00 00 00 E8 E4 82 01 00 00 00 00 èä‚
+ de détails :
https://winprotocoldoc.blob.core.window ... 210625.pdf
Un coup de 7-Zip sur l'exe permet de voir qu'il contient, bien, un MSI :
Les noms de fichiers commençant par un "!" sont des noms des tables MSI en leur ajoutant le "!" devant...