powershell - 从 MSI 中提取二进制数据

Question

我正在尝试使用 Powershell 从 MSI 文件中提取二进制数据。 我可以获得任何其他数据，但我似乎无法提取二进制信息。

$Query = "SELECT Data FROM Binary WHERE Name = 'bannrbmp'"
$View = $Database.GetType().InvokeMember("OpenView", "InvokeMethod", $null, $Database, ($Query))
$View.GetType().InvokeMember("Execute", "InvokeMethod", $null, $View, $null)
$Record = $View.GetType().InvokeMember("Fetch", "InvokeMethod", $null, $View, $null)

$BinaryData = $Record.GetType().InvokeMember("StringData", "GetProperty", $null, $Record, 1)

它在最后一行中断，这让我相信“StringData”存在问题，但我可能偏离目标。这是在 Orca 中打开表格时的样子。

提取文本数据时，此代码将成功完成，如下所示。

$Query = "SELECT Component FROM FeatureComponents WHERE Feature = 'OrcaHelp'"
$View = $Database.GetType().InvokeMember("OpenView", "InvokeMethod", $null, $Database, ($Query))
$View.GetType().InvokeMember("Execute", "InvokeMethod", $null, $View, $null)
$Record = $View.GetType().InvokeMember("Fetch", "InvokeMethod", $null, $View, $null)

$Data = $Record.GetType().InvokeMember("StringData", "GetProperty", $null, $Record, 1)

我似乎在网上找不到任何东西，如果有人能够提供帮助，我将不胜感激。

Answer 1

这是一个 C++ 代码片段，用于提取二进制文件并将其写入磁盘。您可以使用它，或者至少可以看到流程和读取的流。这些是所有脚本语言最终调用的基本 Win32 API 调用，不需要互操作。它需要一些包含 stdio.h、windows.h、msiquery.h 的内容并打包在程序或 Dll 中进行调用 - 我不知道您对 C++ 的熟悉程度。这应该可以正常工作，即使我最近没有测试过。

PMSIHANDLE hDatabase;
PMSIHANDLE hBinaryView;
PMSIHANDLE hBinaryRecord;

//Get the handle to the active database. we need this to do view manipulation
UINT nr = MsiOpenDatabase ("some.msi", MSIDBOPEN_READONLY, &hDatabase);

//Get a view of the binary table based on the SQL Query
char sQuery []  = {"SELECT * FROM Binary WHERE Name='somebinary'"}; // Binary

nr = MsiDatabaseOpenView(hDatabase, sQuery, &hBinaryView);
if (nr!= ERROR_SUCCESS)
   return 1;

//MsiViewExecute Needs to to be called for MsiFetchView.
//We pass it null because the query above is as granular as we can get
//so we do not need to take it further by specifying an additional value.
nr = MsiViewExecute(hBinaryView, NULL);  
if (nr == ERROR_SUCCESS)
    //Fetch the view into a record.  We do this because we can only do
    //streams out of a record and not out of the view.
    nr = MsiViewFetch(hBinaryView, &hBinaryRecord);

//Make sure that the entry was found in the table
if (nr == ERROR_SUCCESS)
{

    //Build the path to write the file to
    TCHAR FileName [MAX_PATH] = {"somefile.ext"}; 
    char bStream [4096] = {0};
    BOOL bOkay=TRUE;

    HANDLE hFile = CreateFile(FileName, GENERIC_WRITE, 0, 0, 
                        CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
    if (hFile == INVALID_HANDLE_VALUE)
        nr = -1;
    else
    {
        long nTotal = 0;            
        long nattr = 0;
        DWORD nWritten, nBuffer;
        do
        {   // Read the stream into a buffer, 1023 bytes at a time
            nBuffer=1023;
            nr = MsiRecordReadStream(hBinaryRecord, 2, bStream, &nBuffer); // Binary & cab are 2
            if ((ERROR_SUCCESS == nr) && (nBuffer > 0))
            {
                //Write the buffer to a file. 
                nr = WriteFile(hFile, bStream, nBuffer, &nWritten, NULL);

                if (nr != 0)// 0 is bad
                    nTotal = nTotal + nBuffer; // debug only
                else
                    bOkay = FALSE;
            }
            else
            if (nr != ERROR_SUCCESS)
                bOkay = FALSE;
        } // record record stream
        while (bOkay == TRUE && (nBuffer > 0));

        // done copying file
        CloseHandle(hFile);
        }// create file

    // we only needed one row, so close the view
    MsiViewClose(hBinaryView);

    // done with query
    MsiCloseHandle(hBinaryRecord);
}

// done with binary table
MsiCloseHandle(hBinaryView);
// done with MSI database
MsiCloseHandle(hDatabase);