[GH-ISSUE #3688] [Feature] Inno Setup reverse engineering: embedded payloads, setup metadata, Pascal Script and install-action reconstruction #1401

New issue

Open

opened 2026-10-16 21:05:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:07 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3688

Problem Statement & Context

Inno Setup (developed by Jordan Russell / JRSoftware) is one of the most widely deployed Windows installer engines in the world, utilized for installing mission-critical developer tools (such as Visual Studio Code and Git for Windows), commercial desktop software, games (GOG distribution installers), and enterprise utilities.

When investigating an Inno Setup installer executable (setup.exe), executing the installer in a sandbox poses security risks and fails to provide declarative visibility into the complete setup logic. Security analysts and reverse engineers need to inspect:

Container & Slices: Embedded setup headers, multi-part disk slices, and compression algorithms (Zlib, Bzip2, LZMA, LZMA2).
Declarative Script Records: Metadata records corresponding to Inno Setup script sections: [Files], [Registry], [Run], [UninstallRun], [Dirs], [Icons], [INI], [Tasks], and [Components].
Compiled Pascal Script ([Code]): Inno Setup embeds compiled bytecode for RemObjects Pascal Script, enabling custom pre-install verification, DLL calls, HTTP downloads, and conditional logic.
Architecture & OS Requirements: Architecture filters (x86, x64, arm64), minimum Windows versions, administrator privileges (PrivilegesRequired), and password hashes / encryption markers.
Uninstaller Blueprint: Reconstruction of files and registry keys created and queued for cleanup upon uninstallation.

REA currently lacks support for Inno Setup container parsing and Pascal Script bytecode disassembly.

Proposed Architecture

flowchart TD
    A["Inno Setup Executable (setup.exe)"] --> B["Inno Setup Semantic Engine"]
    B --> C["Container & Header Deserializer"]
    B --> D["Declarative Action Reconstructor"]
    B --> E["Pascal Script Bytecode Decompiler"]
    
    C --> C1["Version Signature (Inno Setup 5.x / 6.x / 7.x)"]
    C --> C2["Decompression (LZMA/LZMA2/Bzip2/Zlib)"]
    C --> C3["Embedded Payload File Extraction"]
    
    D --> D1["[Files] & Destination Macros ({app}, {sys})"]
    D --> D2["[Registry] Keys, Values & Flags"]
    D --> D3["[Run] & [UninstallRun] Executables"]
    D --> D4["[Tasks] & [Components] Feature Tree"]
    
    E --> E1["Pascal Script Disassembly (RemObjects Bytecode)"]
    E --> E2["Custom DLL Call Imports (external 'kernel32.dll')"]
    E --> E3["Event Functions (InitializeSetup, CurStepChanged)"]
    
    C & D & E --> F["Declarative Installation Blueprint & Simulated Execution Report"]

Technical Capabilities & Modules

Header Identification & Version Detection:
- Parse setup header offset from PE overlay or PE resource tables.
- Identify Inno Setup signature strings (Inno Setup Setup Data (5.x.x), (6.x.x), (7.x.x)).
- Detect encryption flags, password hashes, and slice configurations.
Container Decompression & Payload Extraction:
- Decompress embedded payload streams utilizing Zlib, Bzip2, LZMA, and LZMA2 filters.
- Extract packed files with original timestamps, version info, and permission flags.
Declarative Section Reconstruction:
- Reconstruct table entries into readable declarative representations:
  - [Files]: Source files, destination directory macros ({app}, {sys}, {win}, {tmp}), flags (ignoreversion, restartreplace).
  - [Registry]: Root keys (HKCU, HKLM), value names, types (REG_SZ, REG_DWORD), and data.
  - [Run] / [UninstallRun]: Programs invoked post-installation, command-line parameters, and wait flags.
  - [Tasks] / [Components]: Conditional selection hierarchies.
Compiled Pascal Script Disassembly:
- Parse compiled RemObjects Pascal Script bytecode stored in the setup metadata.
- Disassemble opcodes into high-level Pascal control flow: conditional branching, loops, and local variable assignments.
- Extract imported external DLL function signatures (external 'user32.dll' stdcall).
- Decompile setup lifecycle callbacks: InitializeSetup, InitializeWizard, CurStepChanged, NextButtonClick.
Simulated Installation Impact Report:
- Synthesize a comprehensive diff predicting system changes (files created, registry modifications, spawned child processes) without running the executable.

Acceptance Criteria

Automated detection and version extraction for Inno Setup installers (versions 5.x, 6.x, and 7.x).
Safe, static extraction of all embedded payload files without code execution.
Accurate reconstruction of [Files], [Registry], and [Run] actions with directory macro expansion.
Disassembly and decompilation of compiled Pascal Script bytecode, including external DLL imports.
Generation of a declarative installation blueprint detailing simulated filesystem and registry changes.

Complements #3621 (Unknown binary file-format inference)
Complements #3626 (Windows kernel driver reverse engineering: INF correlation)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3688 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Inno Setup (developed by Jordan Russell / JRSoftware) is one of the most widely deployed Windows installer engines in the world, utilized for installing mission-critical developer tools (such as Visual Studio Code and Git for Windows), commercial desktop software, games (GOG distribution installers), and enterprise utilities. When investigating an Inno Setup installer executable (`setup.exe`), executing the installer in a sandbox poses security risks and fails to provide declarative visibility into the complete setup logic. Security analysts and reverse engineers need to inspect: 1. **Container & Slices**: Embedded setup headers, multi-part disk slices, and compression algorithms (Zlib, Bzip2, LZMA, LZMA2). 2. **Declarative Script Records**: Metadata records corresponding to Inno Setup script sections: `[Files]`, `[Registry]`, `[Run]`, `[UninstallRun]`, `[Dirs]`, `[Icons]`, `[INI]`, `[Tasks]`, and `[Components]`. 3. **Compiled Pascal Script (`[Code]`)**: Inno Setup embeds compiled bytecode for RemObjects Pascal Script, enabling custom pre-install verification, DLL calls, HTTP downloads, and conditional logic. 4. **Architecture & OS Requirements**: Architecture filters (`x86`, `x64`, `arm64`), minimum Windows versions, administrator privileges (`PrivilegesRequired`), and password hashes / encryption markers. 5. **Uninstaller Blueprint**: Reconstruction of files and registry keys created and queued for cleanup upon uninstallation. REA currently lacks support for Inno Setup container parsing and Pascal Script bytecode disassembly. ### Proposed Architecture ```mermaid flowchart TD A["Inno Setup Executable (setup.exe)"] --> B["Inno Setup Semantic Engine"] B --> C["Container & Header Deserializer"] B --> D["Declarative Action Reconstructor"] B --> E["Pascal Script Bytecode Decompiler"] C --> C1["Version Signature (Inno Setup 5.x / 6.x / 7.x)"] C --> C2["Decompression (LZMA/LZMA2/Bzip2/Zlib)"] C --> C3["Embedded Payload File Extraction"] D --> D1["[Files] & Destination Macros ({app}, {sys})"] D --> D2["[Registry] Keys, Values & Flags"] D --> D3["[Run] & [UninstallRun] Executables"] D --> D4["[Tasks] & [Components] Feature Tree"] E --> E1["Pascal Script Disassembly (RemObjects Bytecode)"] E --> E2["Custom DLL Call Imports (external 'kernel32.dll')"] E --> E3["Event Functions (InitializeSetup, CurStepChanged)"] C & D & E --> F["Declarative Installation Blueprint & Simulated Execution Report"] ``` ### Technical Capabilities & Modules 1. **Header Identification & Version Detection:** - Parse setup header offset from PE overlay or PE resource tables. - Identify Inno Setup signature strings (`Inno Setup Setup Data (5.x.x)`, `(6.x.x)`, `(7.x.x)`). - Detect encryption flags, password hashes, and slice configurations. 2. **Container Decompression & Payload Extraction:** - Decompress embedded payload streams utilizing Zlib, Bzip2, LZMA, and LZMA2 filters. - Extract packed files with original timestamps, version info, and permission flags. 3. **Declarative Section Reconstruction:** - Reconstruct table entries into readable declarative representations: - `[Files]`: Source files, destination directory macros (`{app}`, `{sys}`, `{win}`, `{tmp}`), flags (`ignoreversion`, `restartreplace`). - `[Registry]`: Root keys (`HKCU`, `HKLM`), value names, types (`REG_SZ`, `REG_DWORD`), and data. - `[Run]` / `[UninstallRun]`: Programs invoked post-installation, command-line parameters, and wait flags. - `[Tasks]` / `[Components]`: Conditional selection hierarchies. 4. **Compiled Pascal Script Disassembly:** - Parse compiled RemObjects Pascal Script bytecode stored in the setup metadata. - Disassemble opcodes into high-level Pascal control flow: conditional branching, loops, and local variable assignments. - Extract imported external DLL function signatures (`external 'user32.dll' stdcall`). - Decompile setup lifecycle callbacks: `InitializeSetup`, `InitializeWizard`, `CurStepChanged`, `NextButtonClick`. 5. **Simulated Installation Impact Report:** - Synthesize a comprehensive diff predicting system changes (files created, registry modifications, spawned child processes) without running the executable. ### Acceptance Criteria - [ ] Automated detection and version extraction for Inno Setup installers (versions 5.x, 6.x, and 7.x). - [ ] Safe, static extraction of all embedded payload files without code execution. - [ ] Accurate reconstruction of `[Files]`, `[Registry]`, and `[Run]` actions with directory macro expansion. - [ ] Disassembly and decompilation of compiled Pascal Script bytecode, including external DLL imports. - [ ] Generation of a declarative installation blueprint detailing simulated filesystem and registry changes. ### Related Issues & Dependencies - Complements #3621 (Unknown binary file-format inference) - Complements #3626 (Windows kernel driver reverse engineering: INF correlation)

bsakaguchi referenced this issue

2026-10-17 21:01:27 +00:00

[GH-ISSUE #2498] [Perf] Semantic member-mutation traversal takes 84 s and 1.2 GB on pdf.js's 462 KB openjpeg_nowasm_fallback.js #828

bsakaguchi referenced this issue

2026-10-17 21:10:58 +00:00

[PR #1390] [MERGED] fix(javascript): bound member-mutation paths through reassignment loops #2847

bsakaguchi referenced this issue

2026-10-17 21:11:12 +00:00

[PR #1414] [CLOSED] test(javascript): preserve member-alias fanout and loop regressions #2868

bsakaguchi referenced this issue

2026-10-17 21:11:28 +00:00

[PR #1444] [MERGED] fix(javascript): stop replaying earlier writes for each object property write #2891