Extract files from Wise installers without executing them. NOTE: Repo moved to https://codeberg.org/CYBERDEV/REWise

CYBERDEV 42d0110dd6 Bump version to v0.2.0, README & CHANGELOG update 6 months ago
imhex ce1852b585 Initial commit 1 year ago
src 42d0110dd6 Bump version to v0.2.0, README & CHANGELOG update 6 months ago
tests 571b910b57 Disable test where advertised size is larger then 7 months ago
.editorconfig 8044744776 Add .gitignore and .editorconfig 1 year ago
.gitignore 8044744776 Add .gitignore and .editorconfig 1 year ago
CHANGELOG.md 42d0110dd6 Bump version to v0.2.0, README & CHANGELOG update 6 months ago
COPYING ce1852b585 Initial commit 1 year ago
Makefile 75df5bed82 Small Makefile cleanup 7 months ago
README.md 42d0110dd6 Bump version to v0.2.0, README & CHANGELOG update 6 months ago
rewise.1 75bddabaa4 Change git host to Codeberg 6 months ago

README.md

Reverse Engineering Wise

Extract files from Wise installers without executing them.

The aim of this project is to extract assets from old game installers made with Wise installer without executing the PE file (.exe), so they can be used with free software implementations of the game engine.

==============================================================
              Welcome to REWise version 0.2.0
==============================================================

 Usage: rewise [OPERATION] [OPTIONS] INPUT_FILE

  OPERATIONS
   -x --extract      OUTPUT_PATH  Extract files.
   -r --raw          OUTPUT_PATH  Extract all files in the overlay data. This does not move/rename files!
   -l --list                      List files.
   -V --verify                    Run extract without actually outputting files, crc32s will be checked.
   -z --script-debug              Print parsed WiseScript.bin
   -v --version                   Print version and exit.
   -h --help                      Display this HELP.

  OPTIONS
   -p --preserve                  Don't delete TMP files.
   -t --tmp-path     TMP_PATH     Set temporary path, default: /tmp/
   -d --debug                     Print debug info.
   -s --silent                    Be silent, don't print anything.
   -n --no-extract                Don't extract anything. This will be ignored with -x or -r. It also will not try to remove TMP files, so -p won't do anything.

  NOTES
    - Path to directory OUTPUT_PATH and TMP_PATH should exist and be writable.
    - All files REWise does output will be overwritten when they exist!

Acknowledgement

The WiseUnpacker project helped a lot to give insight on how to unpack files from Wise installers. So a lot of thanks to mnadareski!

Unlike WiseUnpacker which tries to support all versions of Wise installers, REWise tries to focus on old game installers (1999-2003) in the form of PE executables. But when REWise fails to extract any Wise installer feel free to open an issue (no guarantees!).

Technical

NOTE: The PE build date will not be the same as the installer creation date (or release date) since the overlay-data is just appended to a existing Wise PE32 stub on creation of the installer. The supported installer release dates seen so far are between 1999 and 2003. While the PE build dates are between 1998 and 2001.

A Wise installer is a PE executable (NE is also possible, but not supported at this time) with extra data appended to the end of it (overlay-data at the overlay-offset). The overlay-data contains a Wise specific header which is not very important to us (it might be, but no usable values have been found yet). After the Wise header there is raw DEFLATEd data without file-headers, after each DEFLATEd data entry there is a CRC32 for the inflated data. The DEFLATEd data + CRC32 continues until EOF.

The first inflated file is a .dib file we call WiseColors.dib, containing colors used by the installer, it is no use for us so we skip it.

The second inflated file is a binary file that has all sorts of data relevant for the installation (including custom file headers). Within REWise this file is named WiseScript.bin. Most time was spend on reverse engineering different WiseScript.bin files with a hex-editor (ImHex) so a WiseScript.bin can be parsed without as much of guessing as possible. One discovered struct that is the most relevant for extracting files that would be installed by the installer is (it contains file names, metadata, CRC32 and offset to deflatedata):

/* 0x00 WiseScriptFileHeader */
typedef struct {
  unsigned char unknown_2[2];   // seen: 0x8000, 0x8100, 0x0000, 0x9800 0xA100
  uint32_t deflateStart;
  uint32_t deflateEnd;
  uint16_t date;
  uint16_t time;
  uint32_t inflatedSize;
  unsigned char unknown_20[20]; // 20 * \0?
  uint32_t crc32;               // do not check when it is 0
  char * destFile;              // \0 terminated string
  char * fileText;              // \0 terminated string
  unsigned char terminator;     // always \0? terminator?
} WiseScriptFileHeader;

On how REWise handles a WiseScript.bin file: SEE src/wisescript.h and src/wisescript.c.

Stub from different Wise Installation System versions

NOTE: Stubs are patched on creation of the installer so we cannot do a sum of compiled installers and compare below. VsVersionInfo and StringFileInfo are patched and a value in a section somewhere up is patched to contain the overlay offset value.

VERSION BUILD DATE-TIME OVERLAY OFFSET SHA256
7.01 09-11-1998 21:17:09 0x00003800 6a6266fc674bc61852d3e5dc2b3608de9205f518baf718880b81aa1a6179573f
8.11.0.505 25-04-2000 16:37:12 0x00003A00 23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
8.12.0.508 25-04-2000 16:37:12 0x00003A00 23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
8.14.0.512 25-04-2000 16:37:12 0x00003A00 23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
9.01.202.0 25-10-2001 21:47:11 0x00003A00 96a173c62f632140e9d14a7eee0d42f8ef62bee4b66ed317f2077bdfaa32376a
9.02.204.0 25-10-2001 21:47:11 0x00003A00 96a173c62f632140e9d14a7eee0d42f8ef62bee4b66ed317f2077bdfaa32376a

State

Do you know any Wise installer that is not listed below? Please consider reporting it for completeness and for further investigation.

Known working Wise installers

SHORT SOURCE FULL
HL:UL Download Half-Life Uplink (1999)
GSPY220 Download GameSpy 220 std (2000)
OPFOR:DEMO Download Half-Life:Opposing Force Demo (2000)
HL:CS Retail CD Half-Life Counter-Strike (2000)
HL:GOTY Retail CD Half-Life Game Of The Year Edition (1999)
RTCW Retail CD Return to Castle Wolfenstein (2001)
RTCW:MPDEMO Download Return to Castle Wolfenstein Multi-Player Demo (2001)
RTCW:SPDEMO Download Return to Castle Wolfenstein Single-Player Demo (2001)
CS15 Download Counter-Strike 1.5 (2001)
GIFT Download Gift (PL) (2000) (aka Gifty (DE))
HL1WON Download Half-Life 1 WON 1.1.1.0 Patch (2002)
ET Download Wolfenstein: Enemy Territory (2001)
HL23SDK Download Half-Life SDK 2.3 (2002)
HL:STEAM Download Steam Client with Half-Life Cache (2003)

SHORT FILENAME PE BUILD STUB
HL:UL hluplink.exe 09-11-1998 21:17:09 InstallMaster 7
GSPY220 gamespyinstaller220std.exe 21-05-1999 22:48:48 ?
OPFOR:DEMO opfordemofull.exe 21-05-1999 22:48:48 ?
HL:CS counter-strike.exe 17-08-1999 17:25:48 ?
HL:GOTY SETUP.EXE 25-04-2000 16:37:12 InstallMaster 8
RTCW Setup.exe 25-04-2000 16:37:12 InstallMaster 8
RTCW:MPDEMO Wolf_MPDemo.exe 25-04-2000 16:37:12 InstallMaster 8
RTCW:SPDEMO wolf_spdemo.exe 25-04-2000 16:37:12 InstallMaster 8
CS15 csv15full.exe 13-08-2001 19:13:38 ?
GIFT Gift.exe 13-08-2001 19:13:38 ?
HL1WON hl1110.exe 13-08-2001 19:13:38 ?
ET WolfET.exe 25-10-2001 21:47:11 Installation System 9
HL23SDK hl_sdk_v23.exe 25-10-2001 21:47:11 Installation System 9
HL:STEAM steaminstall_halflife.exe 25-10-2001 21:47:11 Installation System 9

Not working installers

NOTE: All multi-disc installers are currently NOT supported.

SHORT SOURCE FULL
WILDWHEELS Retail CD Wild Wheels (2002) (aka Buzzing Cars)
HM:C Retail CD Hitman Contracts (2004)
GOTHIC II Retail CD Gothic II (2003)

SHORT FILENAME PE BUILD STUB
WILDWHEELS setup.EXE 17-08-1999 17:25:48 ?
HM:C setup.exe 25-04-2000 16:37:12 InstallMaster 8
GOTHIC II Gothic2-Setup.exe 25-10-2001 21:47:11 Installation System 9

WILDWHEELS

In contrary to what we've seen before there are PK headers at inflate start which also contains the CRC32 (instead of just the CRC32 after the deflate data). It is either build with a different Wise package or maybe different configuration (maybe with the zip support option? still has to be analyzed).

This game supposed to be open sourced, see this , but have not found the source or license yet.

HM:C

This is a multi-disc installer which is not supported yet.

Not aware of a free software implementation of this game, so it has no priority.

GOTHIC II

This is a multi-disc installer which is not supported yet.

Would be nice to support for the use with REGoth-bs or OpenGothic.

What can be done better

In general:

  • Option(s) to extract only given file(s), maybe with wildcards or a specified file list?
  • Error handling (different exit codes for different errors).

Values that are currently calculated that might be in the WiseHeader, somewhere in WiseScript.bin or a constant defined somewhere else are:

  • Total inflated size.
  • The deflate-offset that is added to deflateStart defined in the WiseScript.bin file.

Other values that are of interest but not found yet are:

  • Deflated/Inflated size of WiseColors.dib and WiseScript.bin.
  • To determine what Wise package/version was used other then the PE build date. On Wikipedia is a list of different Wise installer releases, comparing that list to the tested installers (games) their PE build date it suggests that the targeted Wise installer versions are either one of these:

    • WISE Installation System version 7 (1998) (InstallMaker)
    • WISE Installation System version 7 (1998) (InstallMaster)
    • WISE Installation System version 8 (1999) (InstallBuilder)
    • WISE Installation System version 8 (1999) (InstallMaker)
    • WISE Installation System version 8 (1999) (InstallMaster)
    • WISE Installation System version 9 (2001)

Things that might be a problem

  • REWise is only tested on Little Endian systems.
  • Wise installers where the PE was build before 1998 or after 2001, or installers that where created/released before 1999 or after 2003.

Dependencies

NAME LICENSE URL
zlib Zlib https://www.zlib.net/

Many thanks to

Other projects