[BUG Innounp-mod] Unable to unpack encrypted setups

[Markus]

The Innounp-mod package is not able to decrypt setup *.exe files which were protected by a password.

This happens both with the standalone innounp.exe (application crash) and with the Observer module innounp.so (nothing happens when trying to view/copy/...)

I looked at the source code and found the two code fragments which needs to be patched in order to allow decryption. They patches are attached in diff format:

Code Select Expand

--- ArcFour.pas.old 2018-12-25 10:26:04.946166300 +0100
+++ ArcFour.pas.new 2020-12-19 18:09:52.307024800 +0100
@@ -62,7 +62,8 @@
procedure ArcFourCrypt(var Context: TArcFourContext; const InBuffer;
   var OutBuffer; Length: Cardinal);
var
-  i, tmp: byte;
+  i: Cardinal;
+  tmp: byte;
   InBuf, OutBuf: ^byte;
begin
   InBuf := @InBuffer;


Code Select Expand

--- Observer.pas.old 2020-04-13 10:14:54.222916600 +0200
+++ Observer.pas.new 2020-12-19 18:09:55.203788000 +0100
@@ -261,7 +261,8 @@
     {$IFDEF LOG} Log('- Detination filename: %s', [string(Params.DestPath)]); {$ENDIF}
     Inno := TInnoSetupFileEx(Handle);
     Inno.SetCallbacks(Params.Callbacks);
-    Inno.Password := {$IFDEF UNICODE} string {$ENDIF} (AnsiString(Params.Password));
+    if (Params.Password <> '') then
+        Inno.Password := {$IFDEF UNICODE} string {$ENDIF} (AnsiString(Params.Password));
     if (Params.ItemIndex < 0) or (Params.ItemIndex >= Inno.FileCount) then begin
       {$IFDEF LOG} Log('- No more files'); {$ENDIF}
       Result := SER_ERROR_READ;


[pepak]

The Innounp-mod package is not able to decrypt setup *.exe files which were protected by a password.

That is not entirely unexpected - as I wrote in the readme, I don't have a single protected installer to try it on.

I looked at the source code and found the two code fragments which needs to be patched in order to allow decryption. They patches are attached in diff format:

Thanks. However, what would help the most, would be a demonstration installer which I could use for tests.

Code Select Expand

--- ArcFour.pas.old 2018-12-25 10:26:04.946166300 +0100
+++ ArcFour.pas.new 2020-12-19 18:09:52.307024800 +0100
@@ -62,7 +62,8 @@
procedure ArcFourCrypt(var Context: TArcFourContext; const InBuffer;
   var OutBuffer; Length: Cardinal);
var
-  i, tmp: byte;
+  i: Cardinal;
+  tmp: byte;
   InBuf, OutBuf: ^byte;
begin
   InBuf := @InBuffer;


This is definitely a thing to fix.

Code Select Expand

--- Observer.pas.old 2020-04-13 10:14:54.222916600 +0200
+++ Observer.pas.new 2020-12-19 18:09:55.203788000 +0100
@@ -261,7 +261,8 @@
     {$IFDEF LOG} Log('- Detination filename: %s', [string(Params.DestPath)]); {$ENDIF}
     Inno := TInnoSetupFileEx(Handle);
     Inno.SetCallbacks(Params.Callbacks);
-    Inno.Password := {$IFDEF UNICODE} string {$ENDIF} (AnsiString(Params.Password));
+    if (Params.Password <> '') then
+        Inno.Password := {$IFDEF UNICODE} string {$ENDIF} (AnsiString(Params.Password));
     if (Params.ItemIndex < 0) or (Params.ItemIndex >= Inno.FileCount) then begin
       {$IFDEF LOG} Log('- No more files'); {$ENDIF}
       Result := SER_ERROR_READ;


I don't think this has any influence at all. The result is exactly the same in both versions.

[Markus2]

The InnoSetup application includes an example in C:\Program Files (x86)\Inno Setup 6\Examples\. The only thing you need to change is to enable encryption (disabled by default):

Code Select Expand


--- AllPagesExample.iss.old   2020-12-19 22:13:15.844179600 +0100
+++ AllPagesExample.iss.new   2020-12-19 22:12:46.413226600 +0100
@@ -18,6 +18,7 @@
LicenseFile=license.txt
#define Password 'password'
Password={#Password}
+Encryption=yes
InfoBeforeFile=readme.txt
UserInfoPage=yes
PrivilegesRequired=lowest


The Observer.pas patch is not exactly the same. The unpacking routine will ask for the password one time when opening the setup and every time when reading a file. But Observer will only provide the password to innounp.so when opening the setup, not when reading files. This patch assures that the already stored password is not overwritten by an empty one.

[pepak]

Thank you. I will test it today and everything is fine, I will release yet another version.

[pepak]

Tested, works. A fixed version will be released later today.