Hello trid users,
some days ago i run trid on Windows SDK Setup Transform Scripts (*.mst).
Many are not recognized as "Windows SDK Setup Transform Script" by
mst.trid.xml. Instead these samples are described as "Windows Installer
Patch" by msp.trid.xml (See appended output/trid-new-v.txt).
For comparison reason i run other file identifying tools. The newest file(1)
command describes the unrecognized MST examples as "Microsoft Windows
Installer transform script" (See appended output/trid-new-v.txt).
There we see that these examples have a block size of 4096, whereas the
recognized examples have a block size of 512. That means that root directory
structure appears later. So after running tridscan at the fixed offset the
following pattern vanish:
<Bytes>52006F006F007400200045006E007400720079</Bytes>
<ASCII> R . o . o . t . . E . n . t . r . y</ASCII>
<Pos>1024</Pos>
But in global string section, these structure is still identified by line
like:
<String>R'O'O'T' 'E'N'T'R'Y</String>
On German page about Windows Installer on Wikipedia is mentioned that MST is
used for transforming. This i now expressed by reference URL line like:
<RefURL>
http://en.wikipedia.org/wiki/Windows_Installer</RefURL>
With the updated trid definitions all my inspected MST samples are
now described. (See appended output/trid-new-v.txt).
TrID definition, some examples and output are stored in archive mst.zip. I
hope that my new XML files can be used in future version of triddefs.
With best wishes
Jörg Jenderek
