deark icon indicating copy to clipboard operation
deark copied to clipboard

Extract Ghost Installer archive

Open q4a opened this issue 1 year ago • 1 comments

Hi. I would like to extract Ghost Installer archive. Here is file (2 mirrors of the same file): https://archive.org/download/PerimeterDemo/perimeterdemo.exe https://www.moddb.com/games/the-perimeter/downloads/perimeter-demo (it's demo of the game).

I was able to extract it in Windows with open source app UniExtract2 and here is extraction part, but it's written in AutoIt: https://github.com/Bioruebe/UniExtract2/blob/9719ac988421e48276420e2f33e09087cfbacf8d/UniExtract.au3#L2568

Is it possible to add Ghost Installer support to deark?

PS I builded deark from source and test it on my Linux PC, but it can extract only *.ico and *.manifest, while I was expecting some *.cab.

$ ./deark -a perimeterdemo.exe 
Module: exe
Format: PE32
Writing output.000.ico
Writing output.001.ico
Writing output.002.ico
Writing output.003.ico
Writing output.004.manifest

q4a avatar Jan 26 '25 13:01 q4a

Thanks for the suggestion, but it's probably not something I'll work on anytime soon. Self-extracting installers are some of the more difficult formats to research, unless there is a specification, which there never is. And I would want to know something about how common Ghost Installer is.

I see that your sample file could have all its bytes XORed with 0x8D (which is something that Deark can do), and then scanned for things that look like embedded CAB files (which is not). I've been considering adding scanning features for some more formats like CAB, so that's something I might do.

jsummers avatar Feb 13 '25 17:02 jsummers