Package executable mapping (classic)

It isn’t always easy to figure out which package an executable belongs to and it is difficult to be 100% accurate as sometimes an executable may not even belong to a package. Use the heuristic below to help identify which executable belongs to which package.

Let's define an executable as the tuple path, hash and name/size for example [PATH,HASH,FILE].

An MSI package contains both an installation and uninstallation script linked to embedded resources, usually binaries. Once installed, the system stores an MSI on the machine but strips out its resources to save disk space. However, the system lists most embedded binaries either by name or by size. In addition, an MSI defines an installation directory.

For each MSI there is a tuple [{HASH},{FILE},DIR] even though some installed binaries might not have either {HASH} or {FILE}.

Other types of packages are treated as a black box. In this case, we only take the installation directory if present or the path of the uninstallation program if not, so we have the tuple [{},{},DIR].

An executable [PATH,HASH,FILE] is associated to a package [{HASH},{FILE},{DIR}] whenever one of these conditions is met:

• HASH is contained in {HASH}

• DIR is equal to {DIR}

• DIR parent is equal to {DIR}

• FILE is contained in {FILE}

If the system cannot associate a specific package to an executable, it associates the executable to the default “unknown” package.

The system excludes the following directories:

• WINDOWS
  for example C:\WINDOWS

• SYSTEM
  for example C:\WINDOWS\system32

• PROGRAM_FILES_COMMON
  for example C:\Program Files\Common Files\Common Files

• PROGRAM_FILES
  for example C:\Program Files\Common Files

• COMMON_STARTMENU
  for example C:\Documents and Settings\LeeT\Start Menu

• COMMON_PROGRAMS
  for example C:\Documents and Settings\LeeT\Start Menu\Programs

• COMMON_STARTUP
  for example C:\Documents and Settings\gjaunin\Start Menu\Programs\Startup

• COMMON_MUSIC
  for example C:\Documents and Settings\LeeT\Favorites

• COMMON_FAVORITES
  for example C:\Documents and Settings\LeeT\Favorites

• COMMON_DOCUMENTS
  for example C:\Documents and Settings\LeeT\My Documents

• COMMON_DESKTOPDIRECTORY
  for example C:\Documents and Settings\LeeT\Desktop

• COMMON_APPDATA
  for example C:\Documents and Settings\LeeT\Application Data