Extracting an MSI from an EXE (or "Reason #542 why ChangeBASE is awesome")

Howdy ya'll

 

I had a query a few weeks back on the process of grabbing an MSI from inside an Exe. It's MUCH better to import an MSI into ChangeBASE if you have one, so in the event that an EXE contains an MSI - ChangeBASE has made it a snap for you to mine this gem out.

 

The usual scenario is that you can check %temp% folder when launching the installer, however sometimes it's not that obvious from the initial dialogs if there is an MSI lurking somewhere. Sometimes you have to wait for ChangeBASE to tell you. So what if it tells you but you can't find it? Well I wanted to share the actual screens that help you through this fairly straightforward extraction (for anyone who's recently been to the dentist, I apologise for using the term extraction; it wasn't my choice).

 

First - How can I tell I have an MSI lurking? Note the green icon here; it's telling us to check the log:

 

Well let's crack open the log file:

 

And then reason #572 ChangeBASE is awesome, you can filter everything out in the log till just errors and warnings are present:

 

 

Well there it is folkes. An MSI was there all along; but how do we get it out I hear you ask....

 

Well.... for the eagle eyed of you; you may have noticed on the right click options above, there was "Extract Captured MSI(s)"; but don't take my word for it..

 

  

And yes, if there was more than one - hey presto you've got them all!

Anonymous