对安装程序进行逆向工程
有人有这方面的经验吗？
具体来说，我想了解运行 MSI 时是否正在写入任何注册表项以及哪些文件位于何处。
我正在考虑使用 ProcMon 来查看运行时 msiexec 进程正在做什么通过它，但只是想我会在这里运行一下，看看是否有人有更好的方法。
Has anyone got any experience in doing this?
Specifically, I'd like to find out if any registry keys are being written and what files are going where when I run an MSI.
I was thinking of using ProcMon to see what the msiexec process is doing while I run through it but just thought I'd run it by here to see if anyone has a better method.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
有点生疏，但这里有一些（也许）有用的指示。
您可以使用一个名为 Orca 的工具编辑 MSI 文件。
还有 Wise for Windows，现在被称为其他名称，我不确定您能通过试用版做什么，它确实具有编辑 MSI 文件的功能。
我原本打算单独推荐 FileMon 和 RegMon，但我刚刚看到它们实际上已经合并到 ProcMon 中，这表明我是多么落后于时代:)
Bit rusty, but here's a few (maybe) helpful pointers.
There is a tool called Orca that you can use to edit MSI files.
There was also Wise for Windows, which is now called something else, and I'm not sure what you'll be able to do with the trial, it definitely had the ability to edit MSI files.
I was going to suggest FileMon and RegMon on their own, but I just saw they've actually been merged into ProcMon, shows how behind the times I am :)
理想情况下，设置作者仅使用注册表和 COM 表，因此可以很容易地使用 Orca 查看正在执行的操作。然而，许多安装作者制作的安装数量少于idea安装数量。在这些情况下，我使用 InstallWatch 在前后对注册表进行快照以产生差异。
InstallWatch Pro
您会看到运行在机器，但你要学会过滤那些有经验的人。 （例如，安装没有更改加密种子或 MRU 和 ShellBags）
Ideally, the setup author used only the Registry and COM tables so it's very easy to just look with Orca what's being done. However many setup authors produce less then idea installs. In those cases I use InstallWatch to snapshot the registry before and after to generate a difference.
InstallWatch Pro
You'll see other line noise from processes running on the machine but you learn to filter those with experience. ( E.g. the install didn't change the crypto seed or the MRU's and ShellBags )