Extract files from Wise installers without executing them. NOTE: Repo moved to https://codeberg.org/CYBERDEV/REWise

CYBERDEViL d345bcae72 Small manpage update 1 éve
imhex ce1852b585 Initial commit 1 éve
src d50e517f0b Add manpage, update README and extra note added to --help 1 éve
tests 249020c97b Add test.sh script to preform some tests on REWise. 1 éve
.editorconfig 8044744776 Add .gitignore and .editorconfig 1 éve
.gitignore 8044744776 Add .gitignore and .editorconfig 1 éve
COPYING ce1852b585 Initial commit 1 éve
Makefile ce1852b585 Initial commit 1 éve
README.md d50e517f0b Add manpage, update README and extra note added to --help 1 éve
rewise.1 d345bcae72 Small manpage update 1 éve

README.md

Reverse Engineering Wise

Extract files from Wise installers without executing them.

The aim of this project is to extract assets from old game installers made with Wise installer without executing the PE file (.exe), so they can be used with free software implementations of the game engine.

==============================================================
              Welcome to REWise version 0.1.0
==============================================================

 Usage: rewise [OPERATION] [OPTIONS] INPUT_FILE

  OPERATIONS
   -x --extract      OUTPUT_PATH  Extract files.
   -r --raw          OUTPUT_PATH  Extract all files in the overlay data. This does not move/rename files!
   -l --list                      List files.
   -V --verify                    Run extract without actually outputting files, crc32s will be checked.
   -z --script-debug              Print parsed WiseScript.bin
   -v --version                   Print version and exit.
   -h --help                      Display this HELP.

  OPTIONS
   -p --preserve                  Don't delete TMP files.
   -t --tmp-path     TMP_PATH     Set temporary path, default: /tmp/
   -d --debug                     Print debug info.
   -s --silent                    Be silent, don't print anything.
   -n --no-extract                Don't extract anything. This will be ignored with -x or -r. It also will not try to remove TMP files, so -p won't do anything.

  NOTES
    - Path to directory OUTPUT_PATH and TMP_PATH should exist and be writable.
    - All files REWise does output will be overwritten when they exist!

Acknowledgement

The WiseUnpacker project helped a lot to give insight on how to unpack files from Wise installers. The REWise inflation process is heavily based on the inflation process of WiseUnpacker. So a lot of thanks to mnadareski!

Unlike WiseUnpacker which tries to support all versions of Wise installers, REWise tries to focus on old game installers (1999-2003) in the form of PE executables. But when REWise fails to extract any Wise installer feel free to open an issue (no guarantees!).

Technical

NOTE: The PE build date will not be the same as the installer creation date (or release date) since the overlay-data is just appended to a existing Wise PE on creation of the installer. The supported installer release dates seen so far are between 1999 and 2003. While the PE build dates are between 1998 and 2001.

A Wise installer is a PE executable (NE is also possible, but not supported at this time) with extra data appended to the end of it (overlay-data at the overlay-offset). The overlay-data contains a Wise specific header which is not very important to us (it might be, but no useable values have been found yet). After the Wise header there is raw DEFLATEd data without file-headers, after each DEFLATEd data entry there is a CRC32 for the inflated data. The DEFLATEd data + CRC32 continues until EOF.

The first inflated file is a .dib file containing colours used by the installer, it is no use for us so we skip it.

The second inflated file is a binary file that has all sorts of data relevant for the installation (including custom file headers). Within REWise this file is named WiseScript.bin. Most time was spend on reverse engeneering different WiseScript.bin files with a hex-editor (ImHex) so a WiseScript.bin can be parsed without as much of guessing as possible. One discovered struct that is the most relevant for extracting files that would be installed by the installer is (it contains file names, metadata, CRC32 and offset to deflatedata):

/* 0x00 WiseScriptFileHeader */
typedef struct {
  unsigned char unknown_2[2];   // seen: 0x8000, 0x8100, 0x0000, 0x9800 0xA100
  uint32_t deflateStart;
  uint32_t deflateEnd;
  uint16_t date;
  uint16_t time;
  uint32_t inflatedSize;
  unsigned char unknown_20[20]; // 20 * \0?
  uint32_t crc32;               // do not check when it is 0
  char * destFile;              // \0 terminated string
  char * fileText;              // \0 terminated string
  unsigned char terminator;     // always \0? terminator?
} WiseScriptFileHeader;

On how REWise handles a WiseScript.bin file: SEE src/wisescript.h and src/wisescript.c.

State

Known working Wise installers

SHORT SOURCE FULL
CS15 Download Counter-Strike 1.5 (2001)
ET Download Wolfenstein: Enemy Territory (2001)
GSPY220 Download GameSpy 220 std (2000)
HL:CS Retail CD Half-Life Counter-Strike (2000)
HL:GOTY Retail CD Half-Life Game Of The Year Edition (1999)
HL1WON Download Half-Life 1 WON 1.1.1.0 Patch (2002)
HL23SDK Download Half-Life SDK 2.3 (2002)
HL:STEAM Download Steam Client with Half-Life Cache (2003)
HL:UL Download Half-Life Uplink (1999)
OPFOR:DEMO Download Half-Life:Opposing Force Demo (2000)
RTCW Retail CD Return to Castle Wolfenstein (2001)
RTCW:MPDEMO Download Return to Castle Wolfenstein Multi-Player Demo (2001)
RTCW:SPDEMO Download Return to Castle Wolfenstein Single-Player Demo (2001)

SHORT FILENAME PE BUILD
CS15 csv15full.exe Mon Aug 13 19:13:38 2001 UTC+1
ET WolfET.exe Thu Oct 25 21:47:11 2001 UTC+1
GSPY220 gamespyinstaller220std.exe Fri May 21 22:48:48 1999 UTC+1
HL:CS counter-strike.exe Tue Aug 17 17:25:48 1999 UTC+1
HL:GOTY SETUP.EXE Tue Apr 25 16:37:12 2000 UTC+1
HL1WON hl1110.exe Mon Aug 13 19:13:38 2001 UTC+1
HL23SDK hl_sdk_v23.exe Thu Oct 25 21:47:11 2001 UTC+1
HL:STEAM steaminstall_halflife.exe Thu Oct 25 21:47:11 2001 UTC+1
HL:UL hluplink.exe Mon Nov 9 21:17:09 1998 UTC+1
OPFOR:DEMO opfordemofull.exe Fri May 21 22:48:48 1999 UTC+1
RTCW Setup.exe Tue Apr 25 16:37:12 2000 UTC+1
RTCW:MPDEMO Wolf_MPDemo.exe Tue Apr 25 16:37:12 2000 UTC+1
RTCW:SPDEMO wolf_spdemo.exe Tue Apr 25 16:37:12 2000 UTC+1

What can be done better

In general:

  • Error handling.
  • The inflate process is currently custom made with https://github.com/mnadareski/WiseUnpacker as a source of information. It is doing fine but it probably will be better and faster with a zlib implementation.

Values that are currently calculated that might be in the WiseHeader, somewhere in WiseScript.bin or a constant defined somewhere else are:

  • Total inflated size.
  • The deflate-offset that is added to deflateStart defined in the WiseScript.bin file.

Other values that are of interest but not found yet are:

  • To determine what Wise package/version was used other then the PE build date. On Wikipedia is a list of different Wise installer releases, comparing that list to the tested installers (games) their PE build date it suggests that the targeted Wise installer versions are either one of these:

    • WISE Installation System version 7 (1998) (InstallMaker)
    • WISE Installation System version 7 (1998) (InstallMaster)
    • WISE Installation System version 8 (1999) (InstallBuilder)
    • WISE Installation System version 8 (1999) (InstallMaker)
    • WISE Installation System version 8 (1999) (InstallMaster)
    • WISE Installation System version 9 (2001)

Things that might be a problem

  • REWise is only tested on Little Endian systems.
  • Wise installers where the PE was build before 1998 or after 2001, or installers that where created/released before 1999 or after 2003.

Many thanks to

Other projects