5

I'm trying to extract the files from the Google Chrome offline installer as a reverse engineering exercise

So I tried extracting the data inside the installer PE. I tried pestudio which showed me two large embedded resources, however, pestudio had no option to dump them. Extracting the PE with 7-zip shows a file with the name ~102.

However, 7zip cannot make out anything out of the ~102 file. Viewing this file with a hex editor shows that it is a tar archive with around 20 bytes of additional info prepended to it. Removing these 20 bytes does not make it extractable, however.

How can I extract the files from the binary?

I'm a complete noob in reverse engineering, so please correct my mistakes instead of downvoting my question. I'd also be grateful if someone can tell me of a tool which can extract such data from PE executables (instead of my very questionable use of 7-zip for this purpose which also fails for a large number of executables).

|improve this question
  • Could you tell, what you want to achieve with this? Or is it just for trainings? – ST3 Aug 8 '14 at 10:46
  • Is there a particular reason you don't just look at the code which extracts the file in the installer to figure it out if this is intended to be a RE exercise? – broadway Aug 9 '14 at 10:48
  • ST3, blroadway, A lot of people (myself included) simply do not like installers. We prefer to extract the files of a program manually. This used to be easy with Chrome, but Google doesn’t like users having control over their own systems, so they obfuscated the installer to make it a little harder to install Chrome without running the installer. – Synetech Mar 14 '16 at 18:17
  • 1
    Unfortunately, Google has become quite the fascist over the years and they modified the installer to force the infamously notorious Google Update on users. They simply will not allow people to use Chrome without also letting Google dig the treacherous and intrusive roots of Google Update deep into your system. That said, it is possible to find copies of the Chrome installer sans-GU which contains a large 7-Zip file containing the Chrome files and no Google Update, but getting them is not easy. (Fun fact, the Google Update files have names like goopdate.dll—they’re admitting it’s goop. ☺) – Synetech Mar 14 '16 at 18:22
4

I ran the installer through an online EXE inspector which told me the 102 resource contained LZMA compressed data. Stupidly, I closed that window to look up what 'LZMA' is. I forgot to note the URL of this specific tool, and now I cannot find it anymore! Such a shame because this hint was crucial.

I then ran it through PEdump.me, which allows one to download it separately. To unpack the LZMA compression, I used Stuffit Expander (for OS X), but you can probably use 7-Zip as well -- you may need to add the file extension .lzma to make it work.

This gave me a TAR-like file, containing a few more executables. My local tar was unable to unpack it any further (possibly it's some variant of the standard tar).

The TAR file format is a wrapper to concatenate multiple files into one; its headers contain the original file name and its size, amongst other data. TAR does not apply compression to the resulting file, so you only need a good hex editor to manually split it into the separate programs.

.. my very questionable use of 7-zip for this purpose which also fails for a large number of executables ..

Being able to show the PE Sections of a Windows executable is a rather uncommon function for a general compressing/uncompressing program... That said: I have found no fault in 7-zip's handling of PE executables. It splits them up into their sections and does nothing more.

You can use a tool such as PE Studio to inspect the resources (are you sure it cannot extract them? It seems such a basic function); but after extracting them, you are on your own. There is no "standard" way of compressing or otherwise obfuscating resources; some programs may even contain custom code to extract their own data.

Recognizing the format of a resource is then reduced to the more general "recognize the file format", which is an extremely broad topic on its own.

|improve this answer
  • 1
    Browser history would be helpful! – 0xec Aug 9 '14 at 11:43
  • @Extreme: Incredibly annoying. Safari has a "History" but it seems it only keeps this for your 'main' window, and I have the habit of opening links in a new window. So all it shows is me looking for the meaning of "LZMA". I also cannot recall the exact Google query I used to locate this particular EXE dumper. It's a shame because other tools I tried did not recognize the resource as "LZMA packed", so it really was a crucial hint. – usr2564301 Aug 9 '14 at 12:32
  • pestudio - www.winitor.com - can definitively extract / dump resources of executable files! – mox Jan 23 '16 at 20:10
0

If your goal is really just to recover the installer files from within the offline package, you could probably save yourself the trouble.

Odds are that the resources are extracted on the fly into the %TEMP% directory on a Windows machine which isC:\Users\Troy\AppData\Local\Temp for me.

On Unix/Linux/OSX, the files probably reside at /tmp.

The files will likely only be available while the installer is executing.

|improve this answer
  • Odds are that the resources are extracted on the fly into the %TEMP% directory Yes, probably, but you still have to run the installer which is undesirable because it may do unwanted things like installing Google Update or even performing an unattended installation. Also, while it might not apply to the Chrome installer (right now?), this technique is not good for other things which might contain viruses. However, this technique is fine if you are using a disposable VM, then it is a relatively quick, easy, and safe way to quickly extract the files. – Synetech Mar 14 '16 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.