如何定位MSI文件的PE头
图像的 PE 格式规范 (.exe）和目标文件描述了如何定位PE头的开头。
但是，我试图找到 MSI 的 PE 标头，但图像方法和目标文件方法似乎都不起作用。我什至不确定 MSI 是否有 PE 标头，但使用十六进制编辑器查看该文件表明它有一个。
我研究了 Windows 安装程序参考 但它似乎没有包含有关 MSI 文件结构的详细信息，所以我猜它可以归结为以下问题：
- MSI 文件是否包含与上述类似的 PE 标头？
- 如何定位PE头？
- 是否有类似于上面链接的 MSI 文件规范？
The PE Format specification for image (.exe) and object files describes how to locate the start of the PE header.
However, I am trying to find the PE header of an MSI, and neither the approach for image nor the approach for object files seems to work. I am not even sure if an MSI has a PE header, but looking into the file with a hex editor indicates that it has one.
I've looked into the Windows Installer Reference but it does not seem to include detailed information about the structure of MSI files, so I guess it boils down to these questions:
- Do MSI files include a PE header similar to the one described above?
- How to locate the PE header?
- Is there a specification for MSI files similar to the one linked above?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
.msi 文件不是 PE 文件。它们是由 Windows Installer 服务 (msiexec.exe) 处理的结构化存储数据文件。 Rob Mensching 有几篇博客文章提供了内部观点：
您可能会看到嵌入的 PE 文件。
.msi files are not PE files. They're structured storage data files processed by the Windows Installer service (msiexec.exe). Rob Mensching has a couple of blog posts providing an insider view:
You're probably seeing embedded PE files.