[GH-ISSUE #3693] [Feature] InstallShield reverse engineering: data1.cab/HDR, setup.inx, InstallScript and installation graph reconstruction #1405

New issue

Open

opened 2026-10-16 21:05:09 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:09 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3693

Problem Statement & Context

InstallShield (developed by Revenera / Flexera) is the premier enterprise software installation system for Windows, with a multi-decade footprint spanning enterprise software suites, drivers, CAD systems, and commercial utilities.

Investigating legacy or modern InstallShield packages (setup.exe, data1.cab, data1.hdr, setup.inx) presents significant technical hurdles:

Proprietary InstallShield CAB Containers (data1.cab / data1.hdr): Completely distinct from Microsoft Cabinet (MSCAB) format. Uses proprietary multi-volume headers, file group definitions, and custom compression schemes.
Compiled InstallScript Bytecode (setup.inx / setup.obs): InstallShield's proprietary procedural language compiled into VM bytecode executed by isrt.dll or _isdel.exe.
Setup Wrapper & Embedded Installers: Modern InstallShield packages often act as bootstrap wrappers embedding secondary MSI packages, prerequisites (.NET, VC++ redistributables), and custom actions.
File Groups & Component Rules: Hierarchical component trees governing target destination paths, operating system checks, and overwriting rules.
Registry & System Mutations: Script-driven and table-driven registry keys, COM self-registration (DllRegisterServer), and service installations.

REA needs a dedicated InstallShield engine capable of safely dissecting InstallShield archives, decompiling InstallScript bytecode, and modeling the installation actions statically.

Proposed Architecture

flowchart TD
    A["InstallShield Package (setup.exe / data1.cab / setup.inx)"] --> B["InstallShield Semantic Engine"]
    B --> C["InstallShield CAB / HDR Archive Parser"]
    B --> D["InstallScript Bytecode Decompiler"]
    B --> E["Installation Action & Component Reconstructor"]
    
    C --> C1["Signature Verification (ISCab header / Multi-volume data1.hdr)"]
    C --> C2["File Groups & Compressed File Extraction"]
    
    D --> D1["setup.inx / setup.obs Bytecode Disassembler"]
    D --> D2["Opcode Decoding & Symbol Recovery"]
    D --> D3["Control Flow Reconstruction (Functions, Events, DLL Calls)"]
    
    E --> E1["Embedded MSI & Prerequisite Extractions"]
    E --> E2["Target Directory Mapping & Registry Modifications"]
    
    C & D & E --> F["Declarative Installation Blueprint & Script Reconstruction"]

Technical Capabilities & Modules

InstallShield CAB Archive Extraction (data1.cab / data1.hdr):
- Identify InstallShield CAB versions (IS 5.x, 6.x, and modern multi-volume packages).
- Parse separate header file (data1.hdr) containing directory tables, component descriptions, and volume offsets.
- Extract compressed files without executing the installer.
InstallScript Bytecode Decompilation (setup.inx / setup.obs):
- Disassemble compiled InstallScript bytecode opcodes.
- Resolve standard API functions (CreateRegistrySet, RegDBSetKeyValueEx, CopyFile, LaunchAppAndWait, SdWelcome).
- Recover user functions, parameters, local variables, and string constants.
- Decompile control flow into human-readable InstallScript code.
Embedded MSI & Wrapper Inspection:
- Detect nested Microsoft Windows Installer (.msi) packages extracted during setup.
- Extract prerequisite setup packages (prq files) and condition evaluations.
Component & Feature Tree Resolution:
- Reconstruct feature selection hierarchy and component dependencies.
- Map file group destinations using standard InstallShield path variables (<TARGETDIR>, <WINSYSDIR>, <PROGRAMFILES>).
Installation Blueprint Generation:
- Synthesize a comprehensive report modeling all files created, registry modifications, spawned processes, and service configurations.

Acceptance Criteria

Automated detection of InstallShield packages and distinguishing them from standard MSCAB / Inno / NSIS.
Extraction of files from InstallShield CAB archives (data1.cab + data1.hdr).
Disassembly and decompilation of setup.inx InstallScript bytecode into readable scripts.
Extraction and identification of nested MSI packages and prerequisites.
Generation of a declarative installation blueprint detailing simulated filesystem and registry changes.

Complements #3621 (Unknown binary file-format inference)
Complements #3626 (Windows kernel driver reverse engineering: INF correlation)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3693 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context InstallShield (developed by Revenera / Flexera) is the premier enterprise software installation system for Windows, with a multi-decade footprint spanning enterprise software suites, drivers, CAD systems, and commercial utilities. Investigating legacy or modern InstallShield packages (`setup.exe`, `data1.cab`, `data1.hdr`, `setup.inx`) presents significant technical hurdles: 1. **Proprietary InstallShield CAB Containers (`data1.cab` / `data1.hdr`)**: Completely distinct from Microsoft Cabinet (`MSCAB`) format. Uses proprietary multi-volume headers, file group definitions, and custom compression schemes. 2. **Compiled InstallScript Bytecode (`setup.inx` / `setup.obs`)**: InstallShield's proprietary procedural language compiled into VM bytecode executed by `isrt.dll` or `_isdel.exe`. 3. **Setup Wrapper & Embedded Installers**: Modern InstallShield packages often act as bootstrap wrappers embedding secondary MSI packages, prerequisites (.NET, VC++ redistributables), and custom actions. 4. **File Groups & Component Rules**: Hierarchical component trees governing target destination paths, operating system checks, and overwriting rules. 5. **Registry & System Mutations**: Script-driven and table-driven registry keys, COM self-registration (`DllRegisterServer`), and service installations. REA needs a dedicated InstallShield engine capable of safely dissecting InstallShield archives, decompiling InstallScript bytecode, and modeling the installation actions statically. ### Proposed Architecture ```mermaid flowchart TD A["InstallShield Package (setup.exe / data1.cab / setup.inx)"] --> B["InstallShield Semantic Engine"] B --> C["InstallShield CAB / HDR Archive Parser"] B --> D["InstallScript Bytecode Decompiler"] B --> E["Installation Action & Component Reconstructor"] C --> C1["Signature Verification (ISCab header / Multi-volume data1.hdr)"] C --> C2["File Groups & Compressed File Extraction"] D --> D1["setup.inx / setup.obs Bytecode Disassembler"] D --> D2["Opcode Decoding & Symbol Recovery"] D --> D3["Control Flow Reconstruction (Functions, Events, DLL Calls)"] E --> E1["Embedded MSI & Prerequisite Extractions"] E --> E2["Target Directory Mapping & Registry Modifications"] C & D & E --> F["Declarative Installation Blueprint & Script Reconstruction"] ``` ### Technical Capabilities & Modules 1. **InstallShield CAB Archive Extraction (`data1.cab` / `data1.hdr`):** - Identify InstallShield CAB versions (IS 5.x, 6.x, and modern multi-volume packages). - Parse separate header file (`data1.hdr`) containing directory tables, component descriptions, and volume offsets. - Extract compressed files without executing the installer. 2. **InstallScript Bytecode Decompilation (`setup.inx` / `setup.obs`):** - Disassemble compiled InstallScript bytecode opcodes. - Resolve standard API functions (`CreateRegistrySet`, `RegDBSetKeyValueEx`, `CopyFile`, `LaunchAppAndWait`, `SdWelcome`). - Recover user functions, parameters, local variables, and string constants. - Decompile control flow into human-readable InstallScript code. 3. **Embedded MSI & Wrapper Inspection:** - Detect nested Microsoft Windows Installer (`.msi`) packages extracted during setup. - Extract prerequisite setup packages (`prq` files) and condition evaluations. 4. **Component & Feature Tree Resolution:** - Reconstruct feature selection hierarchy and component dependencies. - Map file group destinations using standard InstallShield path variables (`<TARGETDIR>`, `<WINSYSDIR>`, `<PROGRAMFILES>`). 5. **Installation Blueprint Generation:** - Synthesize a comprehensive report modeling all files created, registry modifications, spawned processes, and service configurations. ### Acceptance Criteria - [ ] Automated detection of InstallShield packages and distinguishing them from standard MSCAB / Inno / NSIS. - [ ] Extraction of files from InstallShield CAB archives (`data1.cab` + `data1.hdr`). - [ ] Disassembly and decompilation of `setup.inx` InstallScript bytecode into readable scripts. - [ ] Extraction and identification of nested MSI packages and prerequisites. - [ ] Generation of a declarative installation blueprint detailing simulated filesystem and registry changes. ### Related Issues & Dependencies - Complements #3621 (Unknown binary file-format inference) - Complements #3626 (Windows kernel driver reverse engineering: INF correlation)

bsakaguchi referenced this issue

2026-10-17 21:11:08 +00:00

[PR #1405] [MERGED] perf(hopper): stop repeating Hopper replies as raw_result #2861

bsakaguchi referenced this issue

2026-10-17 21:11:22 +00:00

[PR #1430] [MERGED] perf(native): record macOS command provenance once in its Evidence #2882

bsakaguchi referenced this issue

2026-10-31 00:38:18 +00:00

[GH-ISSUE #5337] [Bug] Ghidra Evidence repeats the full result in raw_result, halving the inventory that fits in one response #3246