REWise

Reverse Engineering Wise

Extract files from Wise installers without executing them.

The aim of this project is to extract assets from old game installers made with Wise installer without executing the PE file (.exe), so they can be used with free software implementations of the game engine.

==============================================================
              Welcome to REWise version 0.1.0
==============================================================

 Usage: rewise [OPERATION] [OPTIONS] INPUT_FILE

  OPERATIONS
   -x --extract      OUTPUT_PATH  Extract files.
   -r --raw          OUTPUT_PATH  Extract all files in the overlay data. This does not move/rename files!
   -l --list                      List files.
   -V --verify                    Run extract without actually outputting files, crc32s will be checked.
   -z --script-debug              Print parsed WiseScript.bin
   -v --version                   Print version and exit.
   -h --help                      Display this HELP.

  OPTIONS
   -p --preserve                  Don't delete TMP files.
   -t --tmp-path     TMP_PATH     Set temporary path, default: /tmp/
   -d --debug                     Print debug info.
   -s --silent                    Be silent, don't print anything.
   -n --no-extract                Don't extract anything. This will be ignored with -x or -r. It also will not try to remove TMP files, so -p won't do anything.

  NOTES
    - Path to directory OUTPUT_PATH and TMP_PATH should exist and be writable.
    - All files REWise does output will be overwritten when they exist!

Acknowledgement

The WiseUnpacker project helped a lot to give insight on how to unpack files from Wise installers. The REWise inflation process is heavily based on the inflation process of WiseUnpacker. So a lot of thanks to mnadareski!

Unlike WiseUnpacker which tries to support all versions of Wise installers, REWise tries to focus on old game installers (1999-2003) in the form of PE executables. But when REWise fails to extract any Wise installer feel free to open an issue (no guarantees!).

Technical

NOTE: The PE build date will not be the same as the installer creation date (or release date) since the overlay-data is just appended to a existing Wise PE on creation of the installer. The supported installer release dates seen so far are between 1999 and 2003. While the PE build dates are between 1998 and 2001.

A Wise installer is a PE executable (NE is also possible, but not supported at this time) with extra data appended to the end of it (overlay-data at the overlay-offset). The overlay-data contains a Wise specific header which is not very important to us (it might be, but no useable values have been found yet). After the Wise header there is raw DEFLATEd data without file-headers, after each DEFLATEd data entry there is a CRC32 for the inflated data. The DEFLATEd data + CRC32 continues until EOF.

The first inflated file is a .dib file containing colours used by the installer, it is no use for us so we skip it.

The second inflated file is a binary file that has all sorts of data relevant for the installation (including custom file headers). Within REWise this file is named WiseScript.bin. Most time was spend on reverse engeneering different WiseScript.bin files with a hex-editor (ImHex) so a WiseScript.bin can be parsed without as much of guessing as possible. One discovered struct that is the most relevant for extracting files that would be installed by the installer is (it contains file names, metadata, CRC32 and offset to deflatedata):

/* 0x00 WiseScriptFileHeader */
typedef struct {
  unsigned char unknown_2[2];   // seen: 0x8000, 0x8100, 0x0000, 0x9800 0xA100
  uint32_t deflateStart;
  uint32_t deflateEnd;
  uint16_t date;
  uint16_t time;
  uint32_t inflatedSize;
  unsigned char unknown_20[20]; // 20 * \0?
  uint32_t crc32;               // do not check when it is 0
  char * destFile;              // \0 terminated string
  char * fileText;              // \0 terminated string
  unsigned char terminator;     // always \0? terminator?
} WiseScriptFileHeader;

On how REWise handles a WiseScript.bin file: SEE src/wisescript.h and src/wisescript.c.

State

Known working Wise installers

SHORT	SOURCE	FULL
CS15	Download	Counter-Strike 1.5 (2001)
ET	Download	Wolfenstein: Enemy Territory (2001)
GSPY220	Download	GameSpy 220 std (2000)
HL:CS	Retail CD	Half-Life Counter-Strike (2000)
HL:GOTY	Retail CD	Half-Life Game Of The Year Edition (1999)
HL1WON	Download	Half-Life 1 WON 1.1.1.0 Patch (2002)
HL23SDK	Download	Half-Life SDK 2.3 (2002)
HL:STEAM	Download	Steam Client with Half-Life Cache (2003)
HL:UL	Download	Half-Life Uplink (1999)
OPFOR:DEMO	Download	Half-Life:Opposing Force Demo (2000)
RTCW	Retail CD	Return to Castle Wolfenstein (2001)
RTCW:MPDEMO	Download	Return to Castle Wolfenstein Multi-Player Demo (2001)
RTCW:SPDEMO	Download	Return to Castle Wolfenstein Single-Player Demo (2001)

---

SHORT	FILENAME	PE BUILD
CS15	csv15full.exe	Mon Aug 13 19:13:38 2001 UTC+1
ET	WolfET.exe	Thu Oct 25 21:47:11 2001 UTC+1
GSPY220	gamespyinstaller220std.exe	Fri May 21 22:48:48 1999 UTC+1
HL:CS	counter-strike.exe	Tue Aug 17 17:25:48 1999 UTC+1
HL:GOTY	SETUP.EXE	Tue Apr 25 16:37:12 2000 UTC+1
HL1WON	hl1110.exe	Mon Aug 13 19:13:38 2001 UTC+1
HL23SDK	hl_sdk_v23.exe	Thu Oct 25 21:47:11 2001 UTC+1
HL:STEAM	steaminstall_halflife.exe	Thu Oct 25 21:47:11 2001 UTC+1
HL:UL	hluplink.exe	Mon Nov 9 21:17:09 1998 UTC+1
OPFOR:DEMO	opfordemofull.exe	Fri May 21 22:48:48 1999 UTC+1
RTCW	Setup.exe	Tue Apr 25 16:37:12 2000 UTC+1
RTCW:MPDEMO	Wolf_MPDemo.exe	Tue Apr 25 16:37:12 2000 UTC+1
RTCW:SPDEMO	wolf_spdemo.exe	Tue Apr 25 16:37:12 2000 UTC+1

What can be done better

In general:

• Error handling.
• The inflate process is currently custom made with https://github.com/mnadareski/WiseUnpacker as a source of information. It is doing fine but it probably will be better and faster with a zlib implementation.

Values that are currently calculated that might be in the WiseHeader, somewhere in WiseScript.bin or a constant defined somewhere else are:

• Total inflated size.
• The deflate-offset that is added to deflateStart defined in the WiseScript.bin file.

Other values that are of interest but not found yet are:

• To determine what Wise package/version was used other then the PE build date. On Wikipedia is a list of different Wise installer releases, comparing that list to the tested installers (games) their PE build date it suggests that the targeted Wise installer versions are either one of these:

  • WISE Installation System version 7 (1998) (InstallMaker)
  • WISE Installation System version 7 (1998) (InstallMaster)
  • WISE Installation System version 8 (1999) (InstallBuilder)
  • WISE Installation System version 8 (1999) (InstallMaker)
  • WISE Installation System version 8 (1999) (InstallMaster)
  • WISE Installation System version 9 (2001)

Things that might be a problem

• REWise is only tested on Little Endian systems.
• Wise installers where the PE was build before 1998 or after 2001, or installers that where created/released before 1999 or after 2003.

Many thanks to

• The WiseUnpacker project for a great source of information.
• The FragNet community for testing and feedback.

Other projects

• https://github.com/mnadareski/WiseUnpacker
• https://github.com/lmop/exwise