Skip to content

+ IExpress and MSU; CAB LZX/MSZIP across frames - #509

Merged
Hawkynt merged 10 commits into
mainfrom
feat/cab-sfx
Oct 28, 2026
Merged

Hawkynt merged 10 commits into
mainfrom
feat/cab-sfx

Conversation

@Hawkynt

@Hawkynt Hawkynt commented Oct 23, 2026 •

Copy link
Copy Markdown
Owner

Covers the installer rows "CAB self-extractor (IExpress / MSCF SFX)" and "Windows Update package (MSU)".

  • # CAB: LZX blocks (and matches) that span the 32 KiB CFDATA frames are carried across frames; MSZIP blocks keep the previous blocks' 32 KiB of history ([MS-MCI] 2.2). Both broke on real cabinets.
  • + IExpress: PE with RT_RCDATA "CABINET" → files of that cabinet plus iexpress.ini (TITLE, RUNPROGRAM, …). New PeResourceLocator finds a resource without reading resource data. Detected before the generic SFX / PE-resource fallbacks. (Cabinets appended as an overlay keep using the existing SFX path.)
  • + MSU: .msu → its cabinet (or WIM) through our Cab/WIM readers.

Verification: an iexpress.exe-built package (LZX:21) matches expand.exe file for file (embedded fixture); a Microsoft Update Catalog .msu (KB2999226, MSZIP) matches 7-Zip part for part (local, CWB_MSU_FIXTURES; the Microsoft package is not redistributed, its 7-Zip listing is committed). Filtered IExpress/Msu/Cab/Lzx/Chm/MsZip/Deflate tests: 1813 passed.

Integration update: depends on #537 for shared Intel HEX payload validation exposed by the required Linux suite. The dependency is integrated for CI and must land first; after it merges, the remaining diff is this PR's format change. The refreshed solution build and focused format, firmware, README and architecture checks pass.

Hawkynt and others added 10 commits October 23, 2026 14:56
Real cabinets did not decode. LZX: a block may run past the 32 KiB frame a CFDATA record
holds, and a match may straddle the frame end; the decoder cut the block (and the match) at
the frame and then read the next frame as a new block header ("Invalid LZX block type: 0" on
the cabinet iexpress.exe writes). It now carries the block and the cut-off match into the
next call. MSZIP: every block may refer 32 KiB back into the previous blocks' output
([MS-MCI] 2.2); blocks were inflated in isolation ("distance 2047: only 983 bytes of
history" on a Windows Update cabinet). Deflate gains a preset-history entry point for it.

Evidence: the LZX:21 cabinet in an iexpress.exe package and the MSZIP cabinets of a
Microsoft Update Catalog .msu now match expand.exe / 7-Zip byte for byte (tests in the
following commits). Sourcing: rung 3, [MS-MCI] and the LZX framing as cabinets use it.
iexpress.exe / wextract packages keep their payload as a cabinet in RT_RCDATA "CABINET", so
neither the PE-overlay SFX probe nor the cabinet reader found it and the file was shown as
plain PE resources. The new descriptor finds the resource without reading any resource data
(PeResourceLocator), lists and extracts the cabinet through the Cab reader and reports the
package text resources (TITLE, RUNPROGRAM, ...) in iexpress.ini. Detection runs before the
generic SFX and PE-resource fallbacks.

Oracle: a package built by Windows' own iexpress.exe (LZX:21 cabinet); every file matches
what expand.exe extracts from the CABINET resource. Sourcing: rung 3 (PE/COFF resource
directory, [MS-CAB]); nothing converted.
A .msu is a cabinet (recent ones may be WIM containers) with the update cabinet, its
applicability XML, a properties text and the WSUS scan cabinet. The descriptor claims .msu and
hands the container, recognised by its magic, to the Cab or WIM reader. Catalogue rows for
the CAB self-extractor and MSU now point at IExpress and Msu.

Oracle: windows6.0-kb2999226-x86.msu from the Microsoft Update Catalog matches what 7-Zip
extracts part for part (the package is not redistributed; its 7-Zip listing is committed and
the test runs where CWB_MSU_FIXTURES points at it). Sourcing: rung 3.
Retain IExpress and VMDK reference resources together, keep main artwork and regenerate Core and Archives API documentation for the cabinet stream and installer changes.

Verified: Release solution build, 1,799 focused codec/installer/documentation/provenance tests passed with 8 tool-dependent skips, documentation generation completed without errors.
Adding a second named payload to Intel HEX could silently discard a file because the shared image builder kept only the first payload in filesystem enumeration order. Reject multiple non-metadata payloads, including an empty first payload, before any output is written. Tests verify creation refusal and byte-preserving add refusal.

Verified all three regressions fail before the fix and pass after it, 93 focused tests, 34280 required tests with 1582 skips and no failures, and three package documentation checks.
Bring the firmware payload validation fix onto current main after partitioned-disk support merged. Verified solution build, 299 focused tests and all three package documentation checks; the preceding required suite passed 34280 tests.
IExpress and NSIS detection and fixture entries overlap after NSIS landed. Preserve structural detection and both fixture sets, retain the current NSIS support row and regenerate the archive summary. Verified solution build, 2166 focused tests covering installer detection and compression, and Core and Archive documentation generation.
Integrate the independently tested payload-loss fix from PR #537 so the required Linux suite can validate the cabinet installer changes against the corrected shared baseline. Verified solution build and 162 focused installer, firmware, documentation and architecture tests.
@Hawkynt
Hawkynt merged commit e875550 into main Oct 28, 2026
5 of 7 checks passed
@Hawkynt
Hawkynt deleted the feat/cab-sfx branch October 28, 2026 07:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant