Password protected Files while Extracting

[Cuttlas]

I tried to extract this setup (which is created by Inno setup) using Inno Extractor 7.3:

https://dl2.soft98.ir/soft/j-k-l/K-L...rar?1711629087

but when I try to extract a file, It will prompt me for a password!!!

The setup files such as the wizard images and iss file can be extracted but the files that should be installed can not be extracted and need a password!!!

I do not need to retrieve the password.

I just need to know how to make such an inner password-protected setup.

thank you brothers.

[KaktoR]

Try this

[Setup]: Password
Description:
Specifies a password you want to prompt the user for at the beginning of the installation.

When using a password, you might consider setting Encryption to yes as well, otherwise files will be stored as plain text and it would not be exceedingly difficult for someone to gain access to them through reverse engineering.

The password itself is not stored as clear text; it's stored as a 160-bit SHA-1 hash, salted with a 64-bit random number. (Note: When encryption is enabled, this stored hash is not used for the encryption key; a different hash with a different salt is generated for that.)

[Cuttlas]

Originally Posted by KaktoR

Try this

[Setup]: Password
Description:
Specifies a password you want to prompt the user for at the beginning of the installation.

When using a password, you might consider setting Encryption to yes as well, otherwise files will be stored as plain text and it would not be exceedingly difficult for someone to gain access to them through reverse engineering.

The password itself is not stored as clear text; it's stored as a 160-bit SHA-1 hash, salted with a 64-bit random number. (Note: When encryption is enabled, this stored hash is not used for the encryption key; a different hash with a different salt is generated for that.)

thank you bro, but it will ask for the password while installing, I need to encrypt files with the password just to avoid extracting via extra tools. I do not need to ask password from the user during normal installation. how to bypass it?

[shazzla]

Imho innosetup cant do this.
Instead of it,create an .arc archive with pw and extract it via innosetup. Just like a game-repack...

[Cuttlas]

Originally Posted by shazzla

Imho innosetup cant do this.
Instead of it,create an .arc archive with pw and extract it via innosetup. Just like a game-repack...

it seems K-Lite Codec Pack Mega have done it using inno setup without .arc

[Cesar82]

Originally Posted by Cuttlas

it seems K-Lite Codec Pack Mega have done it using inno setup without .arc

The installer uses Inno Setup's own encryption using the ISCrypt.dll library (Just add it to the Inno Setup folder and define "Encryption=yes" in the [Setup] section of the script
"Password=123").
I don't know if it is possible to unpack an installer that uses this encryption library, however the K-kite Codec Pack installer does not ask the user to enter the password.
The Password is internally in the executable code and is inserted into WizardForm.PasswordEdit when calling the "CurPageChanged" function.

I tested the installer executable "K-Lite_Codec_Pack_1820_Mega.exe" here and discovered that its password is:

fJYYzCYYSj2VWssUVrWW5oskvCs1Yzzf2zzSWWWVs5IvzYI2IWnsnzzI0nC052vd

I tested other older versions such as 17.25 Mega, 17.66 Mega and the same password works.

[Cuttlas]

could you please tell me how did you test and how did you retrieve the password?

[BLACKFIRE69]

Originally Posted by Cuttlas

could you please tell me how did you test and how did you retrieve the password?

here,

.

[Cuttlas]

@BLACKFIRE69, thank you bro for your script. Nice job,

but how to get: CIR = '2vdJwYqCkY5jWVGs5UerJW3oqk5CM1GznfrzESjWtVm5evLY0 2RWYsvzUIPnP0mm'?

how did you obtain [CompiledCode.bin]? I'm currently using Inno Extarctor and it does not provide me a code bin, it is empty!

[Cesar82]

I arrived at code like this:

function CX(lpKey: String): String;
var
  I, Y: Integer;
  S1, S2: String;
begin
  S1 := lpKey;
  for I := 0 to 17 do
  begin
    for Y := 16 to 47 do
    begin
      S2 := S2 + S1[(I + Y) mod 63 + 1] + lpKey[(I + Y) * 2 mod 63 + 1];
    end;
    S1 := S2;
    S2 := '';
  end;
  Result := S1;
end;

function InitializeSetup(): Boolean;
begin
  SaveStringToFile('Password.txt', CX('2vdJwYqCkY5jWVGs5UerJW3oqk5CM1GznfrzESjWtVm5evLY02RWYsvzUIPnP0mm'), False);
  Result := False;
end;

To obtain the code from CompiledCode.bin, "Inno Setup Decompiler 1.5" was used

P.S: "Inno Setup Decompiler 1.5" is also included in the Inno Setup repack that I shared in the DiskSpan GUI thread.

@BLACKFIRE69, could you tell us which software you used to extract the code from CompiledCode.bin?

[Behnam2018]

Hello, I want to find the password of this file

[Joe Forster/STA]

Originally Posted by Cuttlas

how did you obtain [CompiledCode.bin]? I'm currently using Inno Extarctor and it does not provide me a code bin, it is empty!

You can extract it with the following command line:

innounp -x -m K-Lite_Codec_Pack_1820_Mega.exe embedded\CompiledCode.bin

Open this in Inno Setup Decompiler and export the disassembled code into Pascal source. You will find the "CIR" variable (unscrambled password, the installer is not protected by it, you need to scramble it first) as the result of the "BX()" function and the password scrambler function is called "CX()".

(This is fun! )