Extracting file from MSI package

[Av0id]

put break on LoadLibraryExW (take a look at stack, there is filename), then but break inside LoadLibraryExW after LdrLoadDll call, then you can try to directly forward to export name (CTRL+G in olly) or search your dll in module list (ALT+M in olly)

[Kerlingen]

Most the MSI unpacking tools will only unpack the *.CAB files inside the MSI, they will ignore any files outside the *.CAB, but still embedded in the MSI.

Extracting these files can be a bit tricky, one easy way is to simply prevent the files from being deleted. This can be done by breaking on DeleteFile or (if available) by telling your host intrusion prevention system to deny the file delete privilege to any application. If breaking on DeleteFile will not work, the file handle will have the "delete on close" flag set and you will have to start looking there. A HIPS will prevent this trick.

LoadLibrary might be called many times before you see the call you're looking for.

Is the MSI you're working with available for public download?

try MSI Plus plugin for Total Commander
http://www.totalcmd.net/plugring/msiplus.html

[sendersu]

Last update 6 years ago, does it still crack the latest MSIs?