QUOTE (nitro322 @ Jun 29 2007, 12:21 AM)

I had some code in 1.4.2, before I started using TrID, that would try to detect if crap files were extracted instead of files with the proper names since I couldn't distinguish between the two from analyzing the file. The code was ugly, hackish, and slow, so I removed it in favor of properly identifying the files with TrID, but unfortunately the old method seemed to be more reliable. I'll look into this more deeply once I start working on the code again, and may add that code back if I can't get the TrID detection to work more reliably.
Here's another hackish idea:
USSF.
Not many executables support the peculiar selection of switches that modern MS hotfixen do...
EDIT: Or, here's something a little less hackish. At some point after an attempt to identify the hotfix with TrID, try to list the contents with cabextract:
QUOTE
# cabextract.exe -l 'C:\Download\WindowsServer2003-KB923845-x86-ENU.exe'
Viewing cabinet: C:\Download\WindowsServer2003-KB923845-x86-ENU.exe
File size | Date Time | Name
-----------+---------------------+-------------
2630 | 26.05.2007 07:48:12 | _sfx_manifest_
30720 | 17.03.2007 06:14:22 | _sfx_.dll
193 | 26.05.2007 07:44:48 | _sfx_0026._p
176 | 26.05.2007 07:44:48 | _sfx_0019._p
1015 | 26.05.2007 07:44:48 | _sfx_0030._p
141 | 26.05.2007 07:44:48 | _sfx_0022._p
360 | 26.05.2007 07:44:48 | _sfx_0005._p
144 | 26.05.2007 07:44:48 | _sfx_0014._p
217 | 26.05.2007 07:44:48 | _sfx_0027._p
139 | 26.05.2007 07:44:48 | _sfx_0020._p
135 | 26.05.2007 07:44:48 | _sfx_0031._p
821 | 26.05.2007 07:44:48 | _sfx_0021._p
335 | 26.05.2007 07:44:48 | _sfx_0004._p
5000 | 26.05.2007 07:44:48 | _sfx_0013._p
9524 | 26.05.2007 07:44:48 | _sfx_0025._p
1315 | 26.05.2007 07:44:48 | _sfx_0017._p
174 | 26.05.2007 07:44:48 | _sfx_0032._p
176 | 26.05.2007 07:44:48 | _sfx_0023._p
237 | 26.05.2007 07:44:48 | _sfx_0003._p
183 | 26.05.2007 07:44:48 | _sfx_0015._p
191 | 26.05.2007 07:44:48 | _sfx_0028._p
141 | 26.05.2007 07:44:48 | _sfx_0018._p
139 | 26.05.2007 07:44:48 | _sfx_0033._p
139 | 26.05.2007 07:44:48 | _sfx_0024._p
148589 | 26.05.2007 07:44:48 | _sfx_0002._p
144 | 26.05.2007 07:44:48 | _sfx_0016._p
1668 | 22.03.2007 00:31:50 | _sfx_0012._p
41248 | 22.03.2007 00:31:50 | _sfx_0001._p
325 | 26.05.2007 07:44:48 | _sfx_0037._p
449 | 22.03.2007 00:31:50 | _sfx_0035._p
6308 | 26.05.2007 07:44:48 | _sfx_0034._p
7182 | 22.03.2007 00:31:50 | _sfx_0011._p
249639 | 22.03.2007 00:31:50 | _sfx_0000._p
1015 | 26.05.2007 07:44:48 | _sfx_0029._p
267 | 30.04.2007 15:21:50 | _sfx_0036._p
199 | 26.05.2007 07:44:48 | _sfx_0009._p
5468 | 26.05.2007 07:44:48 | _sfx_0006._p
179 | 26.05.2007 07:44:48 | _sfx_0008._p
232 | 26.05.2007 07:44:48 | _sfx_0007._p
118273 | 22.03.2007 00:31:50 | _sfx_0010._p
That's pretty definitive. But, if it's not definitive enough, here're the contents at the top of "_sfx_manifest_":
QUOTE
[Options]
Run = "update\update.exe"
PatchDLL = "_sfx_.dll"
You'd think that cabarc would be able to extract a cabinet from an SFX, but noooo... Anyhow, cabextract appears to be [L]GPLed. It's over
here, and it's available as a DOS or Cygwin binary. Or perhaps a way to use the author's libmspack directly from AutoIt?