Universal Extractor extract the nsi file

Recently i saw that the Universal Extractor is able to extract the files from the installer compiled by makensis.
The files and the nsi script source !!!

How can we prevent that and protect our works ?

thx

The only way, that I know, that can extract the scripts is if the developer include the script. About the files, well...I think you can use external apps like armadillo to protect it, but I don't know. NSIS is a self-extractor, maybe changing the compressor?

but the thing i cant understand is that exposes the nsi file source we created to make the installer. This is not good 🙁
The files into the installer are protected because i use other comrpessor.

But how can we protect the nsi source to not be extracted ?
Must exist some way.

I think you are mistaken about the nsi source.

Like Joel said, unless you are packaging the nsi source file into your Installer, there is no way they can see
your nsi source file.
That nsi source file is compiled into a whole different command structure, and unless the person built an decompiler for NSIS, they wouldn't be able to make heads or tails out of whats there.

7z had a decompiler, its output is not pretty tho

I just tried it, indeed UE decompiles the script using 7zip. My script came out with several "Invalid" lines, so it looks like it's not good enough to make it recompilable. As long as you don't do any secret stuff in plaintext nsis code, there isn't much of a risk in this.

Though I do agree that it would be really nice if NSIS installers could be made more solid. Would it be possible, say, to make the compression algorithms randomize their behaviour?

Ah, that makes sense, and definitely is interesting.

I suppose if you had any real "secret sauce" you wanted hidden, you could make a plugin to do it.
Obviously the "hacker" could get your plugin .dll, and attempt to decompile that as well, but at some point, if you are that worried about things, you probably should consider moving to an Installer that isn't free, and has encryption at its cornerstone.

Universal Extractor is most likely using 7-zip v4.40 beta which can "extract" the script too.

PaR

maybe is not the same nsi that the one i created, but !!!

imagine you have lines on your nsi source where some passwords are used to extract or things like that. The passwords are revealed !!

But can someone explain me how the hell the nsi is recovered by teh extraction ? Someone told on this topic about we are packing the nsi source with the installer. I not made that, at least as far as i know.

please help !

If I'm not wrong, it's been already discussed, you may add a kind of security level on your installer by implementing a decryption/encryption method, e.g.

Or, if you don't want to go the DcryptDll route, create a plugin that contains your passwords.
Of course, you should use some sort of random thing in there, since anyone could run "strings" against said dll, and get the password strings.

sorry but i see this problem as so serious.
In my dictionary the use of a free tool not mean i could want to show or allow to extract the whole of my work.

This is not serious. Now i suggest and request some countermeasure about this problem on future nsis releases. And i dont think i am the only onw who probably could request this, or yes ?

Free or not free tool, there's nothing really uncrackable, if you believe so go ask M$, sony, etc etc etc.
Anyway, this is a long conversation which has been done in the near past, you may want to search the forum about.

ths not change the fact this is not serious.

The passwords i use with my compressor are exposed extracting the files. Then what i an do related to that ? nothing 🙁

as i said, this is not serious 🙁

As I said earlier, you may cover your code with encryption which is especially offered within nsis. Moreover you may write your own plugin to suit your needs or even better modify the source code the way you like it. What else you expect from an open source free program? I'm wondering what is serious and what's not indeed.

the encription make the files cant be compressed :P

Re: Universal Extractor extract the nsi file

Originally posted by arfgh
Recently i saw that the Universal Extractor is able to extract the files from the installer compiled by makensis.
The files and the nsi script source !!!

How can we prevent that and protect our works ?

thx

NSIS is an OpenSource project. It lives from people contributing to the community, sharing their scripts. What in the world is so bad about people "extracting" your installer? If someone has got your installer, he/she will get the files anyway by running the installer. Also: One the one hand you want use NSIS for free, on the other hand you want to keep your script in private. I call that egoistic...

👎

Originally posted by arfgh
the encription make the files cant be compressed :P

I bet you haven't even test it though.
Anyways, this conversation does not lead somewhere. Perhaps nsis does not cover your needs, thus probably you should go for a more sophisticated installer. Whenever you find it let me know please.

Encrypting the files *before* encoding will hurt the compression indeed. That is because compressing files always means entropy coding. After the files have been encrypted, they will "look" and behave like random data (unless you decrypt them with a proper key). I believe this will prevent efficient entropy coding (compression). So if you really want to encrypt the files, you should compress them first and then do the encryption. This of course will prevent solid compression, except you encrypt your files as one solid block of data...

Hi

I to checked this tool and it generetes your NSIS script!

Its not a problem for my application
but I'm intressted on why it is able to genereate the sourcecode of the nsis script!
Is this tool able to do an "uncompile"?
or is the script somehow stored inside the installer?

Somebody knows details?

The endless circle...
Either you haven't read the whole thread, or...

I just gave this "Universal Extractor" a try. Indeed it uses 7-Zip to extract the NSIS installer. And indeed it gets some files out of the installer. However some folder names are incorrect, like "$[31]". Furthermore they obviously use a disassembler to create that "[NSIS].nsi" file. If you look at this file you will notice that this is NOT your original script. It's a very poor disassembly! Of course almost everything is lost, like function names, variable names and all the macros. So the resulting script is totally useless. And where have all the strings gone? The disassembly event won't compile! Instead of looking at this disassembly you could simply run the installer and look at a memory dump. The information you get are the same...

Original installer code:


Disassembly created by 7-Zip:


🧟

How did they get the NSIS code?

It's been discussed, what else should I say?
This thread contains nothing new, a simple forum search is enough instead.

Originally posted by pospec
How did they get the NSIS code?

Don't you read my post? 😕

RedWine: I have searched the forum. Unfortunately, I can't find a right search phrase to get other discussion on this topic. As you know, English is not my native language.

LoRd_MuldeR: I have red your post two times and it reads about SOME disassembly, but HOW did they made it? (I don't understand this things well.)

Sorry for disturbing.

English is not my native language either 😉

I know that it isn't. Thanks. I didn't searched for 7-zip 🙁

Originally posted by pospec
LoRd_MuldeR: I have red your post two times and it reads about SOME disassembly, but HOW did they made it? (I don't understand this things well.)

How did they make it? I guess they implemented it! If you can compile a program, then you can disassemble it as well. Simply translate every binary instruction back to the corresponding textual representation. Since NSIS is OpenSource this shouldn't be too hard to implement. Of course some information cannot be restored, like variable/function names and macros. That's because those information simply are NOT present in the compiled binary. Also all comments and all the code formatting is lost for obvious reasons. That's why the disassembly is more or less useless. You end up with a load of code that looks like a mess. And in this case it even won't compile...