Weird entry names in .msi file about js-cfb HOT 5 CLOSED

Those are the actual entry names.

MS-CFB 2.6.1 asserts the names are encoded in UTF-16. Here are the actual bytes from the first four directory entries:

5200 6f00 6f00 7400 2000 4500 6e00 7400
7200 7900 0000
"Root Entry" (this is not included in the output)

3042 2743 6438 be41 6441 0000 
"䈰䌧㡤䆾䅤"

0500 5300 7500 6d00 6d00 6100 7200 7900
4900 6e00 6600 6f00 7200 6d00 6100 7400
6900 6f00 6e00 0000
"\u0005SummaryInformation"

4048 ff3f e443 ec41 e445 ac44 3148 0000
"䡀㿿䏤䇬䗤䒬䠱"

Since both the Root Entry and the standard \u0005SummaryInformation stream appear, I'm inclined to believe that MSI is doing something funky with the filenames.

And if this blog post is to be believed, MSI is in fact doing something funky with the filenames:

The Windows Installer actually compresses the stream names to double the space available to 62 or 63 characters (plus one extra for the null terminator, but again, who's counting?). That compression is why if you open a MSI file with dfview.exe you'll see a bunch of gobbledygook names. That compression algorithm is not documented so I can't comment on it.

from js-cfb.

We added the display to the website, reversing the algorithm based on the expected names in the Installer Database documentation:

from js-cfb.

Awesome, thanks!

from js-cfb.

can you describe the algorithm used to encode the names?

from js-cfb.

Thanks for your help. This worked quite well.

from js-cfb.