CODEWITHSUNDEEP
windows-installerportable-executable
fknx
fknx

Reputation: 1785

How to locate PE header of MSI files

The PE Format specification for image (.exe) and object files describes how to locate the start of the PE header.

However, I am trying to find the PE header of an MSI, and neither the approach for image nor the approach for object files seems to work. I am not even sure if an MSI has a PE header, but looking into the file with a hex editor indicates that it has one.

I've looked into the Windows Installer Reference but it does not seem to include detailed information about the structure of MSI files, so I guess it boils down to these questions:

Upvotes: 0

Views: 787

Answers (1)

Bob Arnson
Bob Arnson

Reputation: 21886

.msi files are not PE files. They're structured storage data files processed by the Windows Installer service (msiexec.exe). Rob Mensching has a couple of blog posts providing an insider view:

You're probably seeing embedded PE files.

Upvotes: 3

Related Questions