Page 1 of 1

Unpacking new CAB files (aka IPD aka PA30), used by .MSU

Posted: 2018-02-17, 15:42 UTC
by HAL 9000
Microsoft in Windows Vista introduced new CAB format extension, introducing binary diff, somethin like rsync.

It is called intra-package delta (IPD)

https://reverseengineering.stackexchange.com/questions/6228/how-do-the-internals-of-a-windows-update-security-patch-work

It *seems* that unless cross-patform support is required (like TotaCmd/Android) there is already Windows DLLs to unack those files.

See the following topic, especially last messages.
https://msfn.org/board/topic/171184-microsoft-ipd-intra-package-delta-compression-tool/?page=2

https://www.raxsoft.com/raxccm/software.php - here is binary implementation of IPD unpacking, sadly there is e-mail but no sources, one could read to easily grasp MS API calls sequence for unpacking.

Posted: 2018-02-17, 16:22 UTC
by Horst.Epp
In Windows 10 there is no problem to open such files with TC
even without any plugin.
Just Ctrl-Page-Down

Posted: 2018-02-17, 17:02 UTC
by Dalai
Since it's an AutoIt script, it can be decompiled with Exe2Aut. Doing this reveals that the script uses mspatcha.exe which seems to come from Windows SDK dated back to the XP days. The script also unpacks mspatcha.dll which is part of every Windows installation, which might make things easier (only if the functions exported by this DLL are properly documented).

Packer plugin programmers come forward and accept the challenge ;).

@Horst.Epp:
You can enter the MSUs and the CABs inside them alright. Inside the CAB you'll see files numbered from 0 to some number (depending on the patch), but that's about it. Neither are there pretty file names nor can the numbered files be entered like an archive. The latter two are the core of HAL's post.

Regards
Dalai

Posted: 2018-02-17, 17:29 UTC
by umbra
Well,
7-zip does not support it yet either (and it was requested years ago). So I wouldn't expect Total7zip plugin to solve it any time soon. And I haven't seen any serious new or updated packer plugin lately.