Effective Application Repackaging Methods: Mastering MSI Vs. EXE File Formats

Disclaimer: This post includes affiliate links

If you click on a link and make a purchase, I may receive a commission at no extra cost to you.

Way forward for your installer

Strategies for Repackaging Applications: MSI and EXE Approaches

Depending on the situation, there are a number of actions you can take when it comes to repackaging an application:

• MSI: If the application comes as an MSI, the way forward to further customize and deploy the application would be to create transform files (MST)
• EXE: There are three possibilities on how to advance with an EXE installer. The most popular one is to repackage it via the snapshot method, but there are cases where the EXE installer actually contains an embedded MSI which is extracted and then installed, and the final case is where the application is so complex that it’s best to install it silently via a wrapper method

The MSI scenario is quite straightforward so we would go ahead and have a look over the EXE scenario.

The first step is to determine whether the EXE requires repackaging or if it contains an embedded MSI. There are several ways to determine whether an EXE installer contains an embedded MSI:

• Open Task Manager and check if the msiexec service appears in the list during the installation
• Check the Uninstall registry and see what uninstall command has appeared or if the key name resembles an MSI Product Code
• Use Process Monitor

Using Process Monitor to Detect embedded MSI in EXE

Process Monitor has grown in popularity among IT professionals for not only detecting whether an MSI is embedded in another MSI, but also for detecting additional system changes performed by applications, debugging applications, and so on.

To detect if an EXE contains an embedded MSI with Process Monitor, follow these steps:

- DownloadProcess Monitor: Visit the official website of Process Monitor (https://learn.microsoft.com/en-us/sysinternals/downloads/procmon ) and download the latest version of the tool.

- Launch Process Monitor: Extract the archive and start Process Monitor

- Configure filters: Before monitoring the installation process, it’s helpful to set up filters to narrow down the captured events and focus on the relevant activities. Click on the “Filter” menu, and then select “Filter…” to open the Filter dialog box.

- Configure filter rules: In the Filter dialog box, specify the conditions to filter the events. To detect if an EXE installer contains an embedded MSI, you can set up the following filters: In the “Display entries matching these conditions” select “Operation”, “is”, “Process Create” and then “include’. Click on Add.

- These filters will record events related to the EXE installer and any MSI files used during its execution.

- Begin capturing events: After configuring the filters, select “Start” from the “Capture” menu, or press the Ctrl + E shortcut to begin capturing events.

- Run the EXE installer: Launch the EXE installer you want to analyze. The Process Monitor will start capturing events in real-time.

- Analyze captured events: When the installation is finished, or when you want to stop capturing events, go to the “Capture” menu and select “Stop,” or press the Ctrl + E shortcut. In the main window of Process Monitor, a list of captured events will be displayed.

- Filter and analyze events: To analyze the captured events, use the various columns and filter options in the Process Monitor window. Look for file system operations involving MSI files (with the extension “.msi”) and registry operations involving MSI execution (ending with “.msiexec.exe”). These events indicate that an MSI is embedded within the EXE installer.

For example, if we install Tableau Reader and start the Process Monitor tool and follow the above steps, we will have the following operations captured:

We’re most interested in the Path and Detail columns. Looking at what TableauReader.exe does, it first extracts the installer data into a temporary directory in the %temp% directory, then installs the Visual C++ Redistributables 2013, followed by the Tableau Reader. However, if we look closely, we can see that the msiexec.exe service is called, indicating that the exe file is extracting the file in that %temp% location.

This is an example where you will need to create a transform file (MST) to further customize the Tableau Reader MSI installation, but also to use the dependencies to declare that Visual C++ Redistributable 2013 is needed in order for the application to function properly.

Also read: