MSI files are detected as ppt/xls/doc files

narayan · 2011-11-15 02:53

Hi Denis,

There is a problem with the Extension rule: The binary signature of a msi file is falsely detected as doc/ppt/xls.

How I found the problem:

My downloader's renaming mask was set wrongly. As a result, it changed the extension of a newly downloaded file to "flv".
It also had changed the file's name also, so I had no clue as to what the file really was.

So I used ReNamer's Extension rule and detected the extension based on its binary signature. It detected the file as doc/ppt/xls.
I renamed the file as doc, ppt and xls in turn, but that did not work. Finally I went to the downloader's history to find it was an msi.

Last edited by narayan (2011-11-15 02:54)

den4b · 2011-11-17 17:45

Hi Narayan,

Microsoft formats: DOC, PPT, XLS, MSI, PUB, and many more - all have have same file signature. There is no way of detecting the difference between them just by the file signature. Their header hex dump is:

D0 CF 11 E0 A1 B1 1A E1

There is nothing I can do, unfortunately.

narayan · 2011-11-17 18:17

Ah. But in that case the suggestions should include pub and msi as well. Especially pub, as this extension is gaining more popularity (thanks to iTab).

den4b · 2011-11-18 12:34

Done.

Andrew · 2011-11-18 23:44

DUBS

I know it's overkill for most users, but TrID is so vastly superior, why would anyone who wants to decipher correct extensions on a regular basis want to waste time trying to decide between wildly varying formats such as DOC/PPT/XLS/MSI etc.?

Last edited by Andrew (2011-11-18 23:44)

narayan · 2011-11-19 11:20

Hi Andrew,

I cannot find this TrID pas either in the menu or in the folder. Where is it?

Stefan · 2011-11-19 20:46

narayan wrote:

Hi Andrew,
I cannot find this TrID pas either in the menu or in the folder. Where is it?

Second page of
http://www.den4b.com/forum/viewtopic.php?id=550

narayan · 2011-11-20 04:58

Hi Andrew,

I found that a link from the "Extension" rule page of wiki leads to this page: http://www.den4b.com/wiki/ReNamer:Scripts:TrID
However, that script is dated 16 Dec 2008.

But now Stefan has pointed to your script posted at forum.
Your version was written a month later; and has some improvements.
Could you please update the wiki page with the new script?
I could have done a simple "copy and paste" in the wiki, but you would be a better judge about what needs to be done.

Thanks in advance!

Last edited by narayan (2011-11-20 05:00)

narayan · 2011-11-20 05:42

BTW I downloaded the zips and extracted the dll and trd files in ReNamer's folder.
I also saved Andrew's script (v5) as a new pas file and ran it.
But the script reports an error: It cannot find the dll and trd files.

Currently the dll and trd files are in the top-level folder of ReNamer (where the renamer.exe file is.)
Should I move them to a subfolder?

narayan · 2011-11-20 05:50

Update: Since the TrID script did not show relative path for the dll, I moved the dll and trd files to the "Scripts" subfolder in the ReNamer folder. Now the error does not appear when I run the script.

But the problem is, it does not detect the correct extension either (I experimented by changing the extension of a known pdf file to "msi").
When I run the TrID script, it does not affect the file at all.

den4b Forum

#1 2011-11-15 02:53

MSI files are detected as ppt/xls/doc files

#2 2011-11-17 17:45

Re: MSI files are detected as ppt/xls/doc files

#3 2011-11-17 18:17

Re: MSI files are detected as ppt/xls/doc files

#4 2011-11-18 12:34

Re: MSI files are detected as ppt/xls/doc files

#5 2011-11-18 23:44

Re: MSI files are detected as ppt/xls/doc files

#6 2011-11-19 11:20

Re: MSI files are detected as ppt/xls/doc files

#7 2011-11-19 20:46

Re: MSI files are detected as ppt/xls/doc files

#8 2011-11-20 04:58

Re: MSI files are detected as ppt/xls/doc files

#9 2011-11-20 05:42

Re: MSI files are detected as ppt/xls/doc files

#10 2011-11-20 05:50

Re: MSI files are detected as ppt/xls/doc files

Board footer