1

I have an installer/self-extracting archive. The executable file has an embedded ZIP archive into it (like many other installers). The ZIP archive is encrypted with a password.

The installer DOES NOT ask for a password in order to install, it just proceeds with the installation. The installer has an embedded encrypted archive in it, but if started by double-clicking the installer, no password is requested from the user.

Upon trying to "open" it with 7-Zip as an archive, bypassing the executable part of the file and just trying to open the ZIP archive part, it asks for a password. This question is NOT about bypassing or cracking the encryption, but about finding out an already available password/encryption key. Since the password/encryption key is embedded inside the executable, this encryption serves the purpose of obfuscation for the archived files and not for actual confidentiality.

How can I find that password? Since the installer is local and doesn't need an internet connection, the password must be in the .exe file and somehow passed as an argument to the ZIP decryption module.

Here are some similar examples of self-extracting without the user having to input the password themselves; my goal is to extract that password:

For reference and continuity:

3

1 Answer 1

3

Well, you need to analyze the installer for the password. This usually involves decompiling. Static analysis is a good place to start. You may find the password stored as a string in the installer or the logic of the password through static analysis. Otherwise, you will need to perform dynamic analysis and try to capture the password by debugging specific regions of memory as the installer operates as the installer passes the password to the encrypted file.

This is a very general answer because you provided no context to the type of installer you are working with.

1
  • The installer was created with NSIS. Can you suggest some tools for the decompilation, static and dynamic analyses, etc.? Commented Jun 18, 2023 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.