Extract NSIS installations with 7-zip (4.40 beta and up)

[Comperio]

FYI:
7-zip (www.7-zip.org) just released 4.40 beta which has the ability to extract files from an NSIS installation.

The notes say that it exports "some" NSIS installations, so it must have something to do with the compression method used. (It seems to work OK with standard NSIS LZMA compression. Haven't tested any others.)

Here's the SourceForge page for it:

http://sourceforge.net/projects/sevenzip/

[ggf31416]

Re: Extract NSIS installations with 7-zip!

Originally posted by Comperio
FYI:
7-zip (www.7-zip.org) just released 4.40 beta which has the ability to extract files from an NSIS installation.

The notes say that it exports "some" NSIS installations, so it must have something to do with the compression method used. (It seems to work OK with standard NSIS LZMA compression. Haven't tested any others.)

Here's the SourceForge page for it:
http://sourceforge.net/projects/sevenzip/

According to my tests, 7-zip can extract installers with BCJ/LZMA, LZMA and Zlib compression. Extraction from bzip2 installers don't work.

[ggf31416]

From the 7-zip Open Discussion forum, "When does "7-Zip" support more formats ???"

http://sourceforge.net/forum/forum.php?thread_id=1329708&forum_id=45797

"By: Igor Pavlov - ipavlov
RE: NSIS Support
2006-05-02 00:57
NSIS uses modified Deflate (zlib). 7-Zip supports it.
NSIS uses modified BZip2. 7-Zip doesn't support it now."

[Yathosho]

7-Zip 4.4

What's new:
- 7-Zip now can unpack some installers created by NSIS

any details on what it does?

[Koopa]

It simply unpacks the files, wich are integrated in the installer.

It is not able to decompile your installer. 7Zip users have no access to your .nsi script.

[DrO]

what about the [NSIS].nsi entry? but from what someone who knows said, there's a few things which could be done to improve the script decompile. the main thing really is to allow you to access any files in the installer exe assuming it was built in one of the methods that it currently supports (seems that bzip2 installers aren't going to work at the moment ref)

-daz

[Koopa]

what about the [NSIS].nsi entry?

I guess it's not a valid script, or am I wrong?

You have to change parts in the [NSIS].nsi, otherwise it will not compile.

[Brummelchen]

double posting

http://forums.winamp.com/showthread.php?s=&threadid=245098

## already merged ##

[DrO]

that's what needs the tweaks so it would create a compilable [NSIS].nsi

Brummelchen: already noted by the ref i did in my last post, just ran out of time to merge the two threads together like it is now

-daz

[Brummelchen]

the extracted script is not ready to work - it only shows
an approximate script to get the idea behind.
i have in mind that nsis compiles the script for runtime use
and not for scripting base. works like aPatch or a codefusion
patch where the instructions are hold inside encoded.

[DrO]

all i'm going on is what kichik mentioned briefly when it was brought up that there was the [NSIS].nsi shown. i can't remember what was fully said but i'm sure he said that it's possible to improve what's decoded to get closer if not to be able to allow compiling of the script. i could be wrong so please don't hold me to it

-daz

[rxs2k5]

well as you people know innosetup have a special unpacker to unpack installation and nicer arrange the script.

7zip also does the same to zlib and lzma, where it actually made the nsi script so nicerly that using username and password can be shown so clearly. basically the unauthorised just need to use one set of access to enter the installer or just grab the files being extracted.

I just really hope nsis could become a better security on this one as I see many many people using it because it is a really good installer compiler and " The Way Of Art Script ".

Thanks for all at least bzip2 should do the job.For the time being.

[Brummelchen]

lzma is cracked in simple words

i made a test package for me with password in lzma and it
was clear to read either other methods were very clear.

i have my own solution now but using bzip2 is the only way
for the moment.

[Koopa]

i have my own solution now but using bzip2 is the only way

Yep, but LZMA compression creates smaller files.

I guess later 7z versions will be able to unpack bzip2 compressed installers too

[Joost Verburg]

If you put plain-text passwords in your script, they can be extracted anyway. The introduction of this 7-zip feature makes no difference.

The "decompiled" scripts are also completely useless for most purposes, it's a bit like viewing the assembly code of an application. Everything done by the preprocessor, all names, high-level logic etc. are gone. So it's not like someone could steal your complete script.