如何比较两个(或多个)MSI 文件的内容? [英] How can I compare the content of two (or more) MSI files?

查看：28
本文介绍了如何比较两个(或多个)MSI 文件的内容?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

如何对两个(或更多)MSI 文件进行内容比较"并查看文件内部的实际不同 - 而不是 无用的二进制比较?(这显然只告诉我是否正在处理同一文件的副本).

How can I do a "content compare" of two (or more) MSI files and see what is actually different inside the files - instead of doing a useless binary compare? (which obviously only tells me if I am dealing with copies of the same file or not).

一些相关的典型问题场景:

  • 我们的构建系统疯狂地吐出 MSI 文件，有时我们需要弄清楚不同 MSI 文件之间存在哪些差异(阅读:发生了一些变化，现在我们无法部署).
  • 我们在不同位置有从相同来源编译的 MSI 文件，其中一些文件无法运行报告System.BadImageFormatException - 我们如何调试 MSI 文件的差异?(此处专门处理此错误的答案:应用程序是否依赖于编译环境?).
  • MSI 文件可以使用各种工具编译，但对于 stackoverflow 用户来说，此类文件可能最常使用 WiX 或 Visual Studio 安装程序项目(免费工具包).

这是一个问答式的问题，主题是比较已编译的 MSI 文件以确定存在哪些真正的内容差异".

This is a Q/A-style question on the topic of comparing your compiled MSI files to determine what real "content differences" exist.

推荐答案

Microsoft Orca:如果您安装了 Visual Studio，请尝试搜索 Orca-x86_en-us.msi - 在 Program Files (x86) 下 - 并安装它.然后在开始菜单中找到 Orca.

Microsoft Orca: If you have Visual Studio installed, try searching for Orca-x86_en-us.msi - under Program Files (x86) - and install it. Then find Orca in the start menu.

  • 当前路径:C:Program Files (x86)Windows Kits10in10.0.17763.0x86
  • 根据需要更改版本号

<小时>

关于 MSI 文件

粗略地说 MSI 文件是 COM 结构的存储文件 - 本质上是文件中的文件系统 - 具有不同内容的流，其中一个是精简的 SQL Server 数据库(我认为是最通用的术语).如果 MSI 文件是可读的，则可以比较(各种格式和类型的)内容.

About MSI Files

Roughly speaking MSI files are COM-structured storage files - essentially a file system within a file - with streams of different content, one of which is a stripped down SQL Server database (in the most generic of terms I believe). Provided the MSI files are readable, the content (of various formats and types) can be compared.

技术说明:可以想象，触发 System.BadImageFormatException 的 MSI 无法运行(msiexec.exe 无法运行)运行它)，但它可能仍然是可读的 - 因此具有可比性(如果您遇到它，请添加评论以验证这一点).

Tech Note: It is conceivable that an MSI which triggers a System.BadImageFormatException is just not runnable (msiexec.exe can't run it), but it may still be readable - and hence comparable (please add a comment to verify this if you experience it).

Streams:MSI 中的一些 streams 是带有字符串值的表.也可能有用于存储要部署的文件的嵌入式 cab-archives 流，以及仅具有 二进制内容 的表 - 例如 二进制表其中已编译和未编译的自定义操作与设置所需的其他二进制内容一起存储.还有一个特殊的summary stream"和一个表格，其中的图标以它们的原生二进制格式存储，这个列表还在继续……对于大多数表格，我们可以比较每个表格中的字符串很像我们比较 Word 文档中的文本(也曾经是 OLE/COM 文件 -虽然较新的版本现在使用 Open Office XML)并获得详细的差异报告.为了做到这一点，您显然需要一个专用工具来完成这项工作 - 一个能够在所有相关流中找到方法的工具.下面列出了一些商业和免费工具.

Streams: Some streams in the MSI are tables with string values. There may also be streams for embedded cab-archives used to store files to deploy, and tables with binary content only - such as the Binary table where compiled and uncompiled custom actions alike are stored along with other binary content the setup needs. And there is a special "summary stream" and a table with icons stored in their native, binary format, and the list goes on... For most of the tables we can compare the strings in each table pretty much like we compare text in a Word document (which also used to be OLE / COM files - though newer versions now use Open Office XML) and get a detailed report of differences. In order to do this, you obviously need a special-purpose tool for the job - one capable of finding its way though all the relevant streams. Some commercial and free tools for this are listed below.

二进制内容:在详细说明之前，我应该注意比较 Binary Table、Cabs Table、Icon Table 中的内容 - 或任何其他二进制表，通常只允许您进行二进制比较(特别是对于已编译的自定义操作 dll 和 exe 文件).脚本自定义动作 - 在二进制表中 - 可以作为文本进行比较，但编译的自定义动作只是二进制比较.因此，如果您的问题源自已编译的自定义操作，则您无法在直接比较中真正看到它(您只看到二进制差异).您需要访问您的源代码控制系统以查看用于编译任何类型的自定义操作的代码 - 希望您有一个良好的标签实践，这样您就可以找到实际的源代码每个设置中使用的代码.我不使用这种做法，但对于内部的企业版本，也许您甚至可以为编译的自定义操作包含调试构建 dll，并尝试将调试器附加到正在运行的代码以真正弄清楚发生了什么?不过，我不会将调试模式 dll 用于公开发布 - 除非我澄清了任何风险.调试代码可能充斥着(意外的)调试消息框(用作附加调试器的入口点)和其他不应该出现在生产包中的问题.

Binary content: Before elaborating this, I should note that comparing content in the Binary Table, Cabs Table, Icon Table - or any other binary table, will generally allow you a binary compare only (particularly for compiled custom action dll and exe files). Script custom actions - in the binary table - can be compared as text, but compiled custom actions are binary compare only. So if your problem emanates from a compiled custom action, you can't really see it in a direct compare (you see the binary difference only). You need to hit your source control system to see what code was used for compiled custom actions of any kind - hopefully you have a good label practice so you can find the actual source code used in each setup. I don't use this practice, but for internal, corporate releases perhaps you can even include your debug-build dll for your compiled custom action, and attempt to attach the debugger to the running code to really figure out what is going on? I wouldn't use a debug mode dll for a public release though - unless I'd clarified any risks. Debug code may be riddled with (unexpected) debug message boxes (used as entry points to attach the debugger) and other problems that should never hit a production package.

想一想，您的 cab 文件和图标文件绝对可以通过使用 dark.exe 反编译 MSI 文件的技术与旧(或新)MSI 文件中的相应版本进行比较- 如下所述.然后，使用一个好的比较工具(Beyond Compare 将在下面提到)，您可以对不同 MSI 版本之间的 cab 文件内容进行完整的比较(并且某些文件可能是文本文件，可以进行文本比较).我猜 cab 和图标是一种开放格式的透明二进制文件"，而不是编译后的二进制文件(带有自定义操作等)，它们本质上是不可反编译或可检查的(除非您知道如何反编译托管二进制文件).

Come to think of it, your cab files and icon files can definitely be compared to their corresponding versions in older (or newer) MSI files by using the technique to decompile MSI files using dark.exe - which is described below. Then, using a good compare tool (Beyond Compare is mentioned below), you can do a full diff on the cab file content between different MSI versions (and some of the files could be text files, that could be text compared). I guess cabs and icons are sort of "transparent binaries" in an open format as opposed to compiled binaries (with custom actions and more) which are not inherently decompilable or inspectable (unless you know how to decompile managed binaries).

结论:MSI 文件是完全透明的，编译的自定义操作除外.这种透明度是 MSI 的核心优势之一.与以前的部署技术相比，大多数 Windows Installer 优势通常集中在企业部署优势上.不幸的是，开发人员可能只会看到 MSI 的缺点:the(潜在的)MSI 反模式(接近底部 - 目前非常混乱和临时).诚然，其中一些问题非常严重，违反了最小惊讶原则".开发人员 - 为什么还有其他同样重要的事情要做 - 坦率地说，他们可能会难以置信地摸不着头脑.

In conclusion: MSI files are fully transparent with the exception of compiled custom actions. This transparency is one of the core benefits of MSI. Most Windows Installer benefits, over previous deployment technologies, generally center around corporate deployment benefits. Unfortunately developers may only see the bad aspects of MSI: the (potential) MSI anti-patterns (towards bottom - very messy and ad-hoc for now). Admittedly some of these problems are very serious and violate "the principle of least astonishment". Developers - why have other and equally important things to do - may frankly be left scratching their heads in disbelief.

请不要误会:MSI 具有巨大的企业部署优势(参见与上面相同的链接，朝向底部).精简:可靠的静默运行、远程管理、回滚、日志记录、隐式卸载功能、提升权限、标准化命令行、透明度、标准化设置自定义转换和管理员安装以可靠地提取文件.只是为了快速命名大的.此处列出的好处.

Leave no mistake about it though: MSI has massive corporate deployment benefits (see same link as above, towards bottom). Condensed: reliable silent running, remote management, rollback, logging, implicit uninstall feature, elevated rights, standardized command line, transparency, transforms for standardized setup customization and admin install to reliably extract files. Just to name the big ones quickly. Benefits in list form here.

到目前为止有很多题外话 - 让我们进入正题.可以使用哪些工具来比较 MSI 文件?

A lot of digressions so far - let's get to the point. What tools can be used to compare MSI files?

几个商业部署工具，例如Installshield，高级安装程序和许多其他 MSI 工具 支持查看和比较 MSI 文件.也许我添加了太多链接，但让我使用我通常的策略如果你链接到一个，你就链接到每个人" - 它应该可以节省一些时间和一些 Google 搜索.

Several commercial deployment tools such as Installshield, Advanced Installer and many other MSI tools have support for viewing and comparing MSI files. Maybe I add too many links, but let me use my usual policy of "if you link to one, you link to everyone" - it should save some time and some Google searches.

作为一个特别说明 - 一个怀旧的 - 我见过的最好的 MSI-diff 功能是在 Wise Package Studio 中.老实说，它比其他人都高出一筹——总是在工作，颜色编码整齐，而且很容易理解.此工具不再出售，如下所述:使用什么安装产品?InstallShield、WiX、Wise、Advanced Installer 等(如果您的公司有打包团队，他们可能有备用许可证?).

As a special note - a nostalgic one - the best MSI-diff feature I ever saw was in Wise Package Studio. It was head and shoulders above the rest to be honest - always working, neatly color coded and just easy to comprehend. This tool is no longer for sale as described here: What installation product to use? InstallShield, WiX, Wise, Advanced Installer, etc (if you have a packaging team in your corporation, maybe they have a spare license laying around?).

商业工具不错，但也有几种免费替代品可用于比较 MSI 文件 - 以下是其中一些工具的列表以及如何使用每个工具的一些提示工具(以一种相当简约的方式).

The commercial tools are good, but there are also several free alternatives that can be used to compare MSI files - and below is a list of some of them along with some hints for how to use each tool (in a rather minimalistic way).

为 dark.exe 添加了更多细节——它根本不是 COM 结构存储文件的比较工具，而是一种将 MSI 文件反编译为 WiX XML 源文件并解压的方法所有支持文件(图标、二进制文件、cabs、设置文件) - 之后可以将它们与常规文本/二进制比较工具进行比较.

There are some more details added for dark.exe - which is not a comparison tool for COM-structured storage files at all, but a way to decompile MSI files to WiX XML source files and extract all support files (icons, binaries, cabs, setup files) - allowing them to be compared with regular text / binary compare tools afterwards.

微软的自己的 MSI SDK 工具/查看器称为 Orca 可以查看和编辑 MSI 文件，但不直接支持比较两个 MSI 文件(即我知道).我想您可以导出表格然后比较它们，但其他工具具有更多内置功能.之所以提到此选项，是因为您可能已经安装了 Orca，然后这可能是完成简单 diff 的一种快速方法.穷人的选择".

您可能已经有了安装程序.如果您安装了 Visual Studio，请尝试在 Program Files (x86) 下搜索 Orca-x86_en-us.msi - 并安装它.然后在开始菜单中找到 Orca.从技术上讲，Orca 是作为 Windows SDK 的一部分安装的(大，但免费下载).如果您没有安装 Visual Studio，也许您认识有人安装?只需让他们搜索此 MSI 并将其发送给您(这是一个很小的半 mb 文件)- 应该花费他们几秒钟的时间.如果没有，您可以随时下载 Windows SDK

You may already have the installer. If you have Visual Studio installed, try searching for Orca-x86_en-us.msi - under Program Files (x86) - and install it. Then find Orca in the start menu. Technically Orca is installed as part of the Windows SDK (large, but free download). If you don't have Visual Studio installed, perhaps you know someone who does? Just have them search for this MSI and send you (it is a tiny half mb file) - should take them seconds. If not, you can always download the Windows SDK

Super Orca 将允许对两个 MSI 文件进行初步比较.我的冒烟测试似乎表明可以忽略摘要流等高级字段.换句话说，一个直表只比较.可能还有其他限制.也许它已经足够好了?它易于使用.

Super Orca will allow a rudimentary compare of two MSI files. My smoke test seems to reveal that advanced fields such as the Summary Stream may be ignored. In other words a straight table compare only. There could be other limitations. Maybe it is good enough? It is easy to use.

注意:我无法确定验证，但我相信这个工具在没有警告的情况下保存了我的 MSI.这在当时是非常不受欢迎的.

Note: I have not been able to verify for sure, but I believe this tool saved my MSI without warning once. That was very undesirable at the time.

MSI SDK 有一个 VBScript，可用于查看两个 MSI 文件之间的差异.它被称为 widiffdb.vbs (msdn).使用此工具，我可以看到 Super Orca 忽略的摘要流差异.任何 MSI SDK 都是权威的.

The MSI SDK has a VBScript you can use to view differences between two MSI files. It is called widiffdb.vbs (msdn). With this tool I can see the Summary Stream differences ignored by Super Orca. Anything MSI SDK is authoritative.

更新:github.com 上的所有 MSI SDK API 脚本(实际的 VBScript 代码).

UPDATE: All MSI SDK API scripts on github.com (the actual VBScript code).

  • 提供指向 的链接此类 MSI SDK VBScripts 的完整列表 - 用于各种目的.不要混淆，只有 widiffdb.vbs 是比较 MSI 文件所必需的，但还有许多有用的脚本可用于其他用途.
  • 如果您安装了 Visual Studio，只需搜索 widiffdb.vbs.使用 cscript.exe 启动并传入两个 MSI 文件的完整路径以进行比较.在控制台中输出.

    • Throwing in a link to the full list of such MSI SDK VBScripts - for various purposes. Don't be confused, only widiffdb.vbs is needed for comparing MSI files, but there are many useful scripts for other purposes to be found.
    • If you have Visual Studio installed, just search for widiffdb.vbs. Launch with cscript.exe and pass in full path to two MSI files to compare them. Output in console.

      • 用法:

      cscript.exe widiffdb.vbs "Setup 1.msi" "Setup 2.msi"

      样本输出:

      Property Value           [ALLUSERS] {1}->{2}
Property Value           [MSIINSTALLPERUSER] {}->{1}
Property INSERT          [MSIINSTALLPERUSER]
05SummaryInformation   [9] {{00000000-0000-0000-0000-000000000000}}->{{00000000-0000-0000-0000-000000000001}}
05SummaryInformation   [12] {28.03.2019 15:20:02}->{28.03.2019 14:40:52}
05SummaryInformation   [13] {28.03.2019 15:20:02}->{28.03.2019 14:40:52}
05SummaryInformation   [15] {2}->{10}

      要查找脚本，如果您安装了 Visual Studio，您可以在 Program Files (x86) 下搜索它(它是 Windows SDK 的一部分，它也将与 Visual Studio 一起安装)-(当前路径为:C:Program Files (x86)Windows Kits10in10.0.17763.0x86 -只需适当地替换版本号，您应该可以更快地找到 MSI).

      To find the script, you can search for it under Program Files (x86) if you have Visual Studio installed (it is part of the Windows SDK which will also be installed along with Visual Studio) - (currently the path is: C:Program Files (x86)Windows Kits10in10.0.17763.0x86 - just replace the version numbers as appropriately and you should find the MSI quicker).

      dark.exe 二进制文件来自 WiX 工具集(可能用于编译您的一些 MSI 文件的工具包).此 dark.exe 是 MSI 文件的反汇编程序"或反编译程序".它将 MSI 文件转换为 wxs XML 格式(首先用于编译 MSI 文件的 WiX 自己的格式)，以及一些提取的二进制文件(如果您使用正确的反编译选项和标志).

      The dark.exe binary from the WiX toolset (a toolkit which was likely used to compile some of your MSI files). This dark.exe is a "disassembler" or "decompiler" for MSI files. It will convert MSI files to wxs XML format (WiX's own format used to compile MSI files in the first place), along with a number of extracted binary files (if you use the correct decompile options and flags).

      wxs 源文件可以与常规文本源文件进行比较(我最喜欢的工具是 Beyond Compare，但它是一个商业工具 - 有很多文本比较工具 - 包括 Visual Studio 中的那些).二进制文件显然可以进行二进制比较.例如，任何提取的 CAB 文件都可以与另一个 MSI 安装版本中的另一个类似 cab 文件进行比较.

      The wxs source files can be compared as regular text source files (my favorite tool for this is Beyond Compare, but it is a commercial tool - there are plenty of text compare tools - including those in Visual Studio). The binary files can obviously be binary compared. Any extracted CAB file can be compared to another, similar cab file from another MSI setup version for example.

      这是一个示例命令行:

      dark.exe -x outputfolder MySetup.msi

      • 在许多情况下，这将产生非常好的 MSI 文件比较，您应该能够确定真正不同的地方.

        • In many cases this will yield a very good compare of the MSI files and you should be able to determine what is really different.

          提取的二进制文件可以是脚本文件(VBScript 等)或任意数量的其他二进制文件(例如编译的 DLL 自定义操作).在后一种情况下，您无法真正进一步反编译它 - 除非它是 .NET 二进制文件并且您具有反编译此类二进制文件的专业知识.

          The extracted binaries could be script files (VBScripts, etc...) or any number of other binaries (for example compiled DLL custom actions). In the latter case you can't really decompile it further - unless it is a .NET binary and you have expertise in decompiling such binaries.

          但是，应该注意的是，使用完全相同的 WiX 源文件编译的 WiX 生成的 MSI 文件可能会因以下几个原因而有所不同:

          However, it should be noted that WiX-generated MSI files compiled using the exact same WiX source files can be different for a couple of reasons:

          • 同样的WiX源文件也可以用不同的编译器和链接器设置, 这会以几种不同的方式影响生成的 MSI 文件.要查看所有开关，下载并安装 WiX 并只需编写 candle.exe 或 light.exe 进入命令提示符并点击 enter.

          • The same WiX source file can also be compiled with different compiler and linker settings, and this can affect the generated MSI file in several different ways. To see all switches, download and install WiX and just write candle.exe or light.exe into a command prompt and hit enter.

          某些字段，例如 package GUIDs 和 product GUIDs 可以在 wxs 文件中设置为 auto-generate.在这种情况下，对于每个构建，生成的 MSI 文件中的相应字段显然会有所不同.

          Certain fields such as package GUIDs and product GUIDs can be set to auto-generate in the wxs file. The resultant, corresponding field in the generated MSI file will obviously be different for every build in this case.

          • 目前我没有完整的列表来说明哪些字段可以设置为自动生成(如果您知道，可以点击编辑并就地修改).

          • I don't have a full list of what fields can be set to auto-generate at this point (if you know, maybe hit edit and modify this in situ).

          提到的自动生成的字段也可以是硬编码的(这对包 GUID 不利，但这是另一个长篇故事 - 只要知道如果你发现两个二进制文件不同的 MSI 文件相同的包 GUID，那么你就遇到了严重的麻烦 - 如果它们在野外 - Windows Installer 将根据定义将它们视为相同的文件).包代码应始终自动生成.题外话.

          The mentioned auto-generated fields can also be hard-coded (which is not good for the package GUID, but that is another, long story - just know that if you find two MSI files that are binary different with the same package GUID, then you are in serious trouble - if they are in the wild - Windows Installer will treat them as the same file by definition). Package codes should always be auto-generated. Digression.

          MSI 文件本身显然具有不同的文件日期信息，已分别编译 - 只是为了说明这一点.

          The MSI files themselves obviously have different file date information having been compiled separately - just to state the obvious.

          还有一个与当前主题有些无关但重要的特别说明:您可以使用 dark.exe 来反编译使用 WiX 的刻录功能编译的可执行文件.这是 WiX 的引导程序功能，用于依次安装一个或多个 MSI 和/或 EXE 文件 - 一个接一个.这些引导程序是 EXE 文件，您可以将它们解压缩到其组成的 MSI 和/或 EXE 文件中:

          And a special note somewhat unrelated to the topic at hand, but important nonetheless: you can use dark.exe to decompile executables compiled with WiX's Burn feature. This is WiX's bootstrapper feature used to install one or more MSI and / or EXE files in sequence - one after the other. These bootstrappers are EXE files and you can decompress them into their constituent MSI and/or EXE files: 

          dark.exe -x outputfolder setup.exe

          只需打开命令提示符，CD 到 setup.exe 所在的文件夹.然后指定上面的命令.具体示例:dark.exe -x outputfolder MySetup.exe.输出文件夹将包含几个子文件夹，其中包含提取的 MSI 和 EXE 文件以及 Burn GUI 的清单和资源文件.然后可以如上所述反汇编任何 MSI 文件以生成 WiX 源文件 (wxs).

          Just open a command prompt, CD to the folder where the setup.exe resides. Then specify the above command. Concrete sample: dark.exe -x outputfolder MySetup.exe. The output folder will contain a couple of sub-folders containing both extracted MSI and EXE files and manifests and resource file for the Burn GUI. Any MSI files can then be disassembled as described above to produce a WiX source file (wxs).

          由于某种原因，我从未主动使用过这个工具，但测试了几次.再次测试它似乎确实可以比较两个 MSI 文件，尽管来自一个奇怪的菜单选项(这让我认为该功能以前不起作用).

          For some reason I have never used this tool actively, but tested it several times. Testing it again it does seem to do the job of comparing two MSI files, albeit from a strange menu option (which made me think the feature did not work before).

          • 打开一个 MSI，然后转到 Transform =>;比较... 并浏览到要比较第一个的 MSI.
          • 比较似乎没问题，我看到摘要流中有一些变化 - 例如 - 但差异似乎没有显示出什么不同(除非我只是看不到它).
          • 要查看摘要流更改，请在单独的 InstEd 实例中打开这两个文件，然后转到 Tables =>;两种情况下的摘要信息....现在比较属性表中的信息.或者使用上面列出的 widiffdb.vbs 脚本.
          • Open an MSI, then go to Transform => Compare Against... and browse to the MSI you want to compare the first one to.
          • Comparison seems OK, and I see that there are changes in the Summary Stream - for example - but the diff doesn't seem to show what is different (unless I just don't see it).
          • To see the summary stream changes, open both files in separate InstEd instances and go Tables => Summary Info... in both instances. Now compare the information in the property sheets. Alternatively use the widiffdb.vbs script listed above.

          毫无疑问，还有许多其他工具能够查看 COM 结构的存储文件，但我认为以上选项对于大多数用户来说应该足够了.我将添加一个链接到 installsite.org 的 MSI 工具列表 再次.

          There are no doubt many other tools capable of viewing COM-structured storage files, but I think the above options should suffice for most users. I'll add a link to installsite.org's list of MSI tools again.

          此商业工具将能够用作查看器并允许对 MSI 文件进行一些基本操作，即使没有使用完整许可证运行.好的一点是您甚至不需要使用原始表，而是可以使用更好的用户界面来修复"MSI 中的各种内容.例如各种升级参数(主要升级卸载失败时继续或失败等...).

          This commercial tool will be able to function as a viewer and allow some basic operations on MSI files even without running with a full license. The nice bit is that you don't even need to use the raw tables, but can use a much nicer user interface to "hotfix" various things in the MSI. For example various upgrade parameters (continue or fail when major upgrade uninstalls fail, etc...).

          在表格编辑器视图(垂直表格视图)中所做的更改在其他向导视图"中不可见.这里解释了原因.

          Changes made in the Table Editor view (straight-up table view) will not be visible in the other "wizard views". The reason for this is explained here.

          这篇关于如何比较两个(或多个)MSI 文件的内容?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！

查看全文
相关文章
其他开发最新文章
热门教程
热门工具
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆