MAKEMSI quickly and reliably creates MSI files in a non-programmatic way\Tips and TricksHiding Sensitive Information

---

Hiding Sensitive Information

This section shows how you can with a little work hide sensitive information such as a userid and password pair. It is not perfect as a knowledgeable person can obviously extract the information but as "ORCA" doesn't show stream information it is hidden from most people.

First of all you must have a file containing the information you wish to save, the following shows one way to get such a file:

;--- Create some "constants" ------------------------------------------------
#define STUFF_STREAM_KEY  Stuff                ;;Name of key into "_Streams" table
#define TMP_STUFF_FILE    <?TmpDir>\STUFF.TMP  ;;Name of file we create

;--- Create a one line file containing the userid/password ------------------
#output "<$TMP_STUFF_FILE>" ASIS
   SomeUserid,SomePassword,            ;;Last "," to simplify extraction in CA
#output

You now wish to add the file to the MSI:

<$Table "_Streams" CREATE="N">
   <$Row Name="<$STUFF_STREAM_KEY>" Data="<$TMP_STUFF_FILE>">
<$/Table>

Then you wish to set up a custom action to retrieve and process the information:

<$VbsCa Binary="Stuff.vbs">
   <$VbsCaEntry "Install">
       ;--- Get the name of the MSI -----------------------------------------
       CaDebug 2, "Getting MSI name"
       dim MsiName : MsiName = VbsCaPropertyGet("CustomActionData", "", "")

       ;--- Open the MSI ----------------------------------------------------
       CaDebug 2, "Opening """ & MsiName & """"
       on error resume next
       dim oDB : set oDB = session.installer.OpenDatabase(MsiName, 0)
       if  err.number <> 0 then
           on error goto 0
           VbsCaRaiseError "Opening MSI", "Could not open the database """ & MsiName & """"
       end if

       ;--- Look for the entry ----------------------------------------------
       dim oView : set oView = oDB.OpenView("SELECT `Data` FROM `_Streams` WHERE `Name`='<$STUFF_STREAM_KEY>'")
       oView.Execute
       dim oRec : set oRec = oView.Fetch
       If oRec Is Nothing Then
           on error goto 0
           VbsCaRaiseError "Fetching stream", "Could not fetch the stream"
       end if

       ;--- Get the data ----------------------------------------------------
       dim All, Info
       All = oRec.ReadStream(1, 9999, 2)
       if  err.number <> 0 then
           on error goto 0
           VbsCaRaiseError "Reading stream", "Could not read the stream"
       end if
       Info = split(All, ",")

       ;--- Display results -------------------------------------------------
       CaMsgBox "I", "UserId = " & Info(0) & VbCRLF & "Password = " & Info(1)

       ;--- Finished --------------------------------------------------------
       set oView = Nothing
       set oDB = Nothing
   <$/VbsCaEntry>
<$/VbsCa>
<$PropertyCa     "UseStuff" Value="[DATABASE]"                 Seq="InstallFiles-">  ;;Setup "CustomActionData"
<$VbsCaSetup Key="UseStuff" Binary="Stuff.vbs" Entry="Install" Seq="InstallFiles-" CONDITION=^<$CONDITION_INSTALL_ONLY>^>

If it was not the custom action processing the data then you probably would not use a deferred custom action and it would return the results in properties. If this was done remember that a verbose log will contain this information!

Please email me any feedback, additional information or corrections. See this page online (look for updates) MAKEMSI© is (C)opyright Dennis Bareis 2003-2008 (All rights reserved). Saturday November 15 2008 at 2:05pm Visit MAKEMSI's Home Page