en-UShe-IL
You are here:   Blog
Register   |  Login

Blog Archive:

Maximize
* Can be used in order to search for older blogs Entries

Search in blogs


Blog Categories:

Maximize
* Can be used in order to search for blogs Entries by Categories

Blog Tags:

Maximize
* Can be used in order to search for blogs by keywords

TNWikiSummit


Awared MVP

 


Microsoft® Community Contributor 


Microsoft® Community Contributor


 Read this before you use the blog! Maximize

Recent Entries

Minimize
אוג19

Written by: ronen ariely
19/08/2022 16:23 RssIcon

Background

Windows system uses files with the extension .msi for installation. These files are commonly known as "MSI files". The MSI files are not self installed but used by a built-in utility (small application) named Windows Installer. Obviously such extension can be used by other applications and might even include Malicious content as well. This post only focuses on legit files. These files are packages like for example compressed files which are using the .zip extensions. The .msi packages contains files to be installed and installation instructions like installation locations and other properties. It may be used for Windows updates or third-party software installers. 

This post come as an answer to a question in the forum and it elaborates a bit more about .msi extension and how you can extract the files inside the package.

Misconceptions

❌ MSI files are similar to EXE files

In many posts online you will find the claim that MSI files are similar to EXE files, which cannot be more wrong. This claim is a bit like saying that zip files like exe file, since both can be executable files which "run" when we double click the file.

Windows operating system (OS) keeps a list of apps (called default programs) that are mapped to specific extensions. Each time we double click on a file or try to "run" it, then the OS use this list in order to run the related application. In other words, it is not the file which is running directly but the application which mapped to the file extension. The application run the file.

The extension .exe is the primary package for Windows programs. Each .exe file contains data that Windows uses to recognize, read, and run the program the file contains. It can include program's icon and its GUI graphics assets for example as part of the program.

The extension .msi is used for an installation package. This extension is mapped by default to a utility named Msiexec.exe. This utility will use the content of the package (file) in order to run the installation.

In most cases Windows programs (file with .exe extension) are not related to installation, but there is no limitation to use windows program to make an installation. It is very common for example to use a file name `setup.exe` for installation.

Note: The .exe extension is a short for `executable` but we can map other extensions to run by applications which will make these files executable.

Note: A Program is a set of instructions that are developed to work in single platform. An Application (app) is a program or a collection of programs and files used by the program aimed to perform a specific functionality. Applications can be divided into System software and Application software.

 

Windows Installer

As I mentioned above, the .msi extension is mapped by default to be executed by a small utility named Windows Installer (previously known as Microsoft Installer). Windows Installer is a System software component and Application interface (API) of Microsoft Windows used for the installation, maintenance, and removal of software. The Windows Installer file name is `msiexec.exe` and is usually located at `C:\Windows\System32`.

Before the introduction of Microsoft Store the Windows Installer was the main installation tool.

  

How to extract msi files

For the sake of the demo, you can download the Log Parser 2.2 from Microsoft site (this is the file which was related to the original question in the forum) from here: https://www.microsoft.com/en-us/download/details.aspx?id=24659

Option one: Using third party application

As mentioned above, the MSI files are (compressed) packages and there are applications like 7zip which know how to open such packages. 

Unfortunately, in most cases this will not produce a usable solution but will give us a way to get a glance under the scenes. The problem is that 7-Zip extracts all files to the root directory and does not preserve the real structure of the directories.

Option two: Using Windows Installer

(1) Open PowerShell

(2) Navigate to the location of the Windows Installer file 

> cd C:\Windows\System32

(3) let's confirm the file exists here

> dir Msiexec.*

Before the introduction of Microsoft Store the Windows Installer was the main installation tool.

Once we confirmed the location of the file, we can execute it directly using the path to the MSI file and the MSI file name.

> C:\Windows\System32\msiexec.exe /a "F:\LogParser.msi" /qb TARGETDIR="F:\qq"

/a - Administrative install
/q - Sets user interface level
b - Using level: Basic UI

Note: You can also use a shorter command which will work well if the msiexec.exe file path is registered in the OS parameters (It should be by default).

> msiexec /a LogParser.msi /qb TARGETDIR="F:\qq"

The content will be extracted into the path F:\qq in a new folder (if does not exists) named "program files"

and you see the content preserved the structure of the files/folders

 

More option using windows installer


Windows ® Installer. V 5.0.19041.1
 
msiexec /Option <Required Parameter> [Optional Parameter]
 
Install Options
    package | /i> <Product.msi>
        Installs or configures a product
    /a <Product.msi>
        Administrative install - Installs a product on the network
    /j<u|m> <Product.msi> [/t <Transform List>] [/g <Language ID>]
        Advertises a product - m to all users, u to current user
    uninstall | /x> <Product.msi | ProductCode>
        Uninstalls the product
Display Options
    /quiet
        Quiet mode, no user interaction
    /passive
        Unattended mode - progress bar only
    /q[n|b|r|f]
        Sets user interface level
        n - No UI
        b - Basic UI
        r - Reduced UI
        f - Full UI (default)
    /help
        Help information
Restart Options
    /norestart
        Do not restart after the installation is complete
    /promptrestart
        Prompts the user for restart if necessary
    /forcerestart
        Always restart the computer after installation
Logging Options
    /l[i|w|e|a|r|u|c|m|o|p|v|x|+|!|*] <LogFile>
        i - Status messages
        w - Nonfatal warnings
        e - All error messages
        a - Start up of actions
        r - Action-specific records
        u - User requests
        c - Initial UI parameters
        m - Out-of-memory or fatal exit information
        o - Out-of-disk-space messages
        p - Terminal properties
        v - Verbose output
        x - Extra debugging information
        + - Append to existing log file
        ! - Flush each line to the log
        * - Log all information, except for v and x options
    /log <LogFile>
        Equivalent of /l* <LogFile>
Update Options
    /update <Update1.msp>[;Update2.msp]
        Applies update(s)
    /uninstall <PatchCodeGuid>[;Update2.msp] /package <Product.msi | ProductCode>
        Remove update(s) for a product
Repair Options
    /f[p|e|c|m|s|o|d|a|u|v] <Product.msi | ProductCode>
        Repairs a product
        p - only if file is missing
        o - if file is missing or an older version is installed (default)
        e - if file is missing or an equal or older version is installed
        d - if file is missing or a different version is installed
        c - if file is missing or checksum does not match the calculated value
        a - forces all files to be reinstalled
        u - all required user-specific registry entries (default)
        m - all required computer-specific registry entries (default)
        s - all existing shortcuts (default)
        v - runs from source and recaches local package
Setting Public Properties
    [PROPERTY=PropertyValue]
 
Consult the Windows ® Installer SDK for additional documentation on the
command line syntax.
 
Copyright © Microsoft Corporation. All rights reserved.
Portions of this software are based in part on the work of the Independent JPEG Group.

 

More to read