Mark0's Forum
Software => TrID File Identifier => Topic started by: jenderek on April 22, 2020, 03:19:59 PM
-
Hello trid users,
some days ago i run trid on Windows SDK Setup Transform Scripts (*.mst).
Many are not recognized as "Windows SDK Setup Transform Script" by
mst.trid.xml. Instead these samples are described as "Windows Installer
Patch" by msp.trid.xml (See appended output/trid-new-v.txt).
For comparison reason i run other file identifying tools. The newest file(1)
command describes the unrecognized MST examples as "Microsoft Windows
Installer transform script" (See appended output/trid-new-v.txt).
There we see that these examples have a block size of 4096, whereas the
recognized examples have a block size of 512. That means that root directory
structure appears later. So after running tridscan at the fixed offset the
following pattern vanish:
<Bytes>52006F006F007400200045006E007400720079</Bytes>
<ASCII> R . o . o . t . . E . n . t . r . y</ASCII>
<Pos>1024</Pos>
But in global string section, these structure is still identified by line
like:
<String>R'O'O'T' 'E'N'T'R'Y</String>
On German page about Windows Installer on Wikipedia is mentioned that MST is
used for transforming. This i now expressed by reference URL line like:
<RefURL>http://en.wikipedia.org/wiki/Windows_Installer</RefURL>
With the updated trid definitions all my inspected MST samples are
now described. (See appended output/trid-new-v.txt).
TrID definition, some examples and output are stored in archive mst.zip. I
hope that my new XML files can be used in future version of triddefs.
With best wishes
Jörg Jenderek
-
Hi!
In the ZIP file you only included a msi.trid.xml, that's identical to the one already in the library.
-
Hello,
Sorry i have included the wrong msi.trid.xml in my former post. Now i have
included the correct mst.trid.xml in appended archive mst.zip
With best wishes
Jörg Jenderek
-
Perfect, thanks!