Can FileInfo Plugin display contents of UPX archives?

[Alya]

Can FileInfo Plugin display contents of UPX archives?

I got unupx.dll but it doesn't seem to do anything (FileInfoo seems to functions the same way with or without it).

[Sir_SiLvA]

Is the Path in the fileinfo.ini correct?
must be something like
1=%COMMANDER_PATH%\PlugIns\Lister\FileInfo\unupx.dll...

[Nigurrath]

anyway the answer is yes and can also dump the program using ctrl-S.. what is saves is a dumped version of the unpacked program.

[Alya]

Thanks
The path is correct. I managed to do the dump using ctrl-S but what I get is just another .exe file - I still cannot see the actual contents.

I have UPX Installer that contain various files in it. I want to see individual files and extract the ones I need (without going through the actual installation process).

How can I get FileInfo to display the files contained inside the UPX (and copy some of them)?

[Sir_SiLvA]

Surely its just another - UPX is a Exe-Packer.
If The Exe-File ist installer you should install
IETotal(http://www.totalcmd.net/plugring/IETotal.html) and try it...

[Alya]

I have InstallExplorer plugin
It only works with Wise, Vise, Inno Setup, Gentee
Installer, InstallShield, NullSoft Installer (ver>=1.1o),
SetupFactory, Eschalon, MSI/Windows Installer.

It doesn't do aspack or UPX. That's the reason I got FileInfo - I was under impression it can open aspack and UPX packed files. But it seems to only display file headers, not the contents of aspack or UPX archives.

Maybe there is some sort of keyboard shortcut that I don't know of? Is there any description/help manual for this plugin?

[Gral]

There is no "UPX archives"
There are only self-executable archives (RAR, ZIP, CAB and other) with SFX header packed with UPX.
When unpack archive with UPX or FileInfo plugin, SFX header is unpacked but "real" archive is untouched and added after SFX header.
Write details about file which you want unpack (link ?)

[Alya]

When unpack archive with UPX or FileInfo plugin, SFX header is unpacked but "real" archive is untouched and added after SFX header

Do you mean that's what happens when I do ctrl-S - the saved .exe file would have the UPX header unpacked and the rest would be a different type of archive?

I thought of that and tried opening those files with WinRar (as well as IETotal plugin) - it doesn't work, says "archive corrupt" or something like that. Doesn't even recognize it as archive. But I know that exe contains stuff inside it - when I ran the installer, it puts out multiple files.

Example of one such UPX installer is here (inside the zip):
http://www.elecard.com/ftp/pub/mpeg/decoder/mpgdec_dxva_2_1_4712_ev.zip

[Gral]

Do you mean that's what happens when I do ctrl-S - the saved .exe file would have the UPX header unpacked and the rest would be a different type of archive?

Yes, it's true for RAR, ZIP, CAB, but this file is "Ghost Installer" and i don't know how it works.
After unpack header and open (by Resource extractor plugin) there is file UNPACK.EXE in "Raw Data" directory. In fact this file is DLL and should be called UNPACK.DLL.
This file is surely used to unpack files from archive, but i don't know how.

[fg_2002fr]

Hello Alya!

if configuration in fileinfo.ini is well done when you're using fileinfo on a UPXed executable you obtain in "Image file header" : ( for Moonlight MPEG-2 Decoder Pack 2.1.4712 Evaluation.exe )

TECHNICAL FILE INFORMATION :
File Type Description : Portable Executable (PE)

Plugin 1 : Executing...
Plugin 1 : <UPX> File compressed with UPX
Plugin 1 : <UPX> UPX version: 12
Plugin 1 : <UPX> File type: win32/pe
Plugin 1 : <UPX> Compression method: NRV2D_LE32
Plugin 1 : <UPX> Compression level: 10
Plugin 1 : <UPX> Uncompressed length: 339968 bytes
Plugin 1 : <UPX> Compressed length: 116387 bytes
Plugin 1 : <UPX> Original file size: 297472 bytes
Plugin 1 : <UPX> Filter ID: 26h
Plugin 1 : <UPX> CTO (for filters 21h .. 29h): 06h
Plugin 1 : <UPX> Header checksum: From Header = 9Ah
Plugin 1 : <UPX> Header checksum: Calculated = 9Ah
Plugin 1 : <UPX> Compressed adler32: From Header = 70982069h
Plugin 1 : <UPX> Compressed adler32: Calculated = 70982069h
Plugin 1 : <UPX> Decompressing...
Plugin 1 : <UPX> Uncompressed adler32: From Header = 36DF0955h
Plugin 1 : <UPX> Uncompressed adler32: Calculated = 36DF0955h
Plugin 1 : <UPX> File has an original PE header (can be restored).
Plugin 1 : <UPX> Unfiltering...
Plugin 1 : <UPX> Rebuilding Image...
Plugin 1 : <UPX> Section: CODE 233984 bytes
Plugin 1 : <UPX> Section: DATA 7168 bytes
Plugin 1 : <UPX> Section: BSS 0 bytes
Plugin 1 : <UPX> Section: .idata 5632 bytes
Plugin 1 : <UPX> Section: .tls 0 bytes
Plugin 1 : <UPX> Section: .rdata 512 bytes
Plugin 1 : <UPX> Section: .reloc 0 bytes
Plugin 1 : <UPX> Section: .rsrc 49152 bytes
Plugin 1 : End of Work
Using Decompressed Image
...

and, like Nigurrath said, when you press 'CTRL-S' , the saved file is the complete uncompressed executable.

PS : version of unupx.dll I'm using is ver 1.5.0.27

[Alya]

Gral - thanks for info anyway

fg_2002fr
Yes, I'm seeing all those "Plugin 1 : <UPX> ..." messages too. And I get "decompressed" exe with ctrl-S.

But what I need is to see the actual files contained in that exe - and copy them out.

[franck8244]

2Alya
1st: Use FileInfo to uncompress the exe
2nd: use ResExtractor or IETotal to extract file in them

[Alya]

franck8244
Thank you. I already tried IETotal - see above

ResExtractor indeed opens the decompressed UPX and I can see some files inside it. But not all.

For example: I wanted to extract the actual codecs (the .ax files) that the Moonlight MPEG-2 Decoder Pack installs. Those .ax files are inside - but you don't see them when you open the Installer with ResExtractor. You see a bunch of other junk files but not the codecs themselves...