Bootstrapper is extracting endless when setup.exe is corrupt

[jtaphorn]

Hello AI-Team,

today we hit the bad situation that our setup.exe was corrupt caused by copying to USB flash and remove stick.
File size did match with the original one, but by checking the MD5 sum we saw that the MD5 is different.

The corrupted setup.exe caused the bootstrapper to extracting the main application files (MSI package file) in an endless loop. The MSI file got extracted and then the bootstrapper extracted it again and again and never stopped until the user canceld the extracting dialog.

Do you guys know any way to stop the bootstrapper from extracting the msi package in an endless loop when the exe file is corrupt?
We got no kind of error message and starting the setup.exe with logging enabled did not worked because the error already occurs at the bootstrapper.

Thanks for any input.

P.S. The bootstrapper option "sign and check integrity using MD5" seems not to have any effect.

BR,
JT

[Sorin]

Hello,

I'm not sure why you encounter this behavior. If the setup is indeed corrupt I'm affraid there is no other solution to your problem then to rebuild the package.
If this problem persists after rebuild, please give us a detailed testcase to further investigate your issue.

Best regards,
Sorin

[jtaphorn]

Hello,

that the setup.exe is corrupt can occur at e.g. transfering the file.
Our problem was that we did not discovered it directly that the setup.exe is corrupt. We did only asked ourselves why the bootstrapper is extracting the msi file in an endless loop - until we looked up the MD5 checksum of the transfered setup.exe manually which was different than the original one.

I know that you or the AdvancedInstaller itself does not have a real chance when the .exe file is corrupt but I thought that the bootstrapper should recognize it when the file is corrupt.
The bootstrapper option "Sign and check integrity using MD5" at Build configurations sounds very good to check for the correct MD5 but I can not see any difference in the behavior when the .exe file is corrupt (you can make the exe file corrupt manually by editing some values of the .exe with e.g. a HexEditor).
Do you know how this option "sign and check integrity using MD5" works?

Thanks,
JT

[Sorin]

Hello,

Please note that there is a difference between a corrupt exe and a tampered exe. The corrupt exe is not a valid exe, it's functionality could not be guaranteed. The MD5 signature check is useful only when the EXE is tampered, but not when it is corrupted.

The bootstrapper option "Sign and check integrity using MD5" at Build configurations sounds very good to check for the correct MD5 but I can not see any difference in the behavior when the .exe file is corrupt (you can make the exe file corrupt manually by editing some values of the .exe with e.g. a HexEditor).

I'm not sure why, in your case, the check integrity option doesn't work.
What version of Advanced Installer do you use? I have tested this scenario - manually modifying the exe with a hex editor and each time the bootstrapper prompted that the archive is corrupted, stopping the installation.
It would be very halpful if you could give us a testcase to reproduce this issue.

Best regards,
Sorin

[jtaphorn]

Hello,

I'm not sure why, in your case, the check integrity option doesn't work.
What version of Advanced Installer do you use? I have tested this scenario - manually modifying the exe with a hex editor and each time the bootstrapper prompted that the archive is corrupted, stopping the installation.
It would be very halpful if you could give us a testcase to reproduce this issue.

Best regards,
Sorin

Thanks for your answer.
I tested it again with an example project and there it works pretty good!
With our "main" setup project file it does not seems to work. Should I send the project file to you via EMail?
Used AI version is: 14.0.2

Thanks,
JT

[Sorin]

Hello,

Yes, please send us the .AIP (project) to support at advancedinstallerdot com so we can investigate it.

Best regards,
Sorin

[Sorin]

Hello,

I've investigated your project and the issue is caused by the fact that your project contains two builds configured to store the output at the same location. Only one of these builds has the "Sign and check integrity using MD5" option enabled. As these builds are configured to generate the output at the same location (and with the same name - only the msi names are different), when you build your project, the first build that that has the "Sign and check integrity using MD5" option enabled is overwitten by the second that has this option disabled.

Please enable "Sign and check integrity using MD5" option enabled for both builds contained by your project and choose different names or paths for your builds.

Best regards,
Sorin

[jtaphorn]

Thanks for your investigation and the resulting answer and solution.

We automatically rename the setup files during our build mechanism on the server - that's why the configuration looks the same.

You wrote that by not signing both builds that by building the second one the first one will be overwritten and therefore it's neccessary to check this option at both files and rename or re-locate the output path. What I still don't understand: When I check the "sign md5..." option at both build configurations, keep the name and location the same and build again, why does it not work as the option could not be overwritten because it's set in both configurations? And it does also not seems to work when I only build one specific build configuration..?

I don't understand the circumstances but you delivered an answer / workaround and that's acceptable. Thanks!

BR,
JT

[Sorin]

Hello,

You are welcome!

What I still don't understand: When I check the "sign md5..." option at both build configurations, keep the name and location the same and build again, why does it not work as the option could not be overwritten because it's set in both configurations?

I have tested your project by building it with dummy resources and I could not reproduce this issue. Everything is working as expected. Could you replicate this issue in a sample project and send it to support at advancedinstaller dot com so we can investigate it?

And it does also not seems to work when I only build one specific build configuration..?

I have also tested your project on this scenario and it worked as expected.

Best regards,
Sorin

[jtaphorn]

Hello,

You are welcome!

What I still don't understand: When I check the "sign md5..." option at both build configurations, keep the name and location the same and build again, why does it not work as the option could not be overwritten because it's set in both configurations?

I have tested your project by building it with dummy resources and I could not reproduce this issue. Everything is working as expected. Could you replicate this issue in a sample project and send it to support at advancedinstaller dot com so we can investigate it?

And it does also not seems to work when I only build one specific build configuration..?

I have also tested your project on this scenario and it worked as expected.

Best regards,
Sorin

Hi Sorin,

I can reproduce it with the project I already send to you. With a test dummy project where I setup the build configurations exactly the same as in the "real" project I am not able to reproduce it - there it seems to work fine. Strange!
I changed the "Sign and check md5..." option by setting this option to true in both build configurations. As this did not had an effect I changed the output folder of the first build configuration for test purpose and build only this specific build manually but there was no difference in the behavior after changing the setup.exe with HexEditor. Bootstrapper was still extracting endless..
Well that's really strange... Can't see the difference between the real project and the dummy test project in terms of build configurations.

Best regards,
jt

[Sorin]

Hello JT,

Could you please re-test this scenario but instead of Build, use Rebuild option for your project?

Let me know if this helped.

Best regards,
Sorin

[jtaphorn]

Hi Sorin,

I'm sorry but I can not get it working. For the Default build I changed the Output-Folder, Output-MSI Name, entered an EXE name (was empty before),and set the "Sign and check.." option for both builds, doing rebuild but still extracting endless after manipulating the exe via HexEdit..

I think you don't need to investigate this any longer.

Thanks for everything,
Best regards,
jt