REWise

Reverse Engineering Wise

Extract files from Wise installers without executing them.

The aim of this project is to extract assets from old game installers made with Wise installer without executing the PE file (.exe), so they can be used with free software implementations of the game engine.

==============================================================
              Welcome to REWise version 0.2.0
==============================================================

 Usage: rewise [OPERATION] [OPTIONS] INPUT_FILE

  OPERATIONS
   -x --extract      OUTPUT_PATH  Extract files.
   -r --raw          OUTPUT_PATH  Extract all files in the overlay data. This does not move/rename files!
   -l --list                      List files.
   -V --verify                    Run extract without actually outputting files, crc32s will be checked.
   -z --script-debug              Print parsed WiseScript.bin
   -v --version                   Print version and exit.
   -h --help                      Display this HELP.

  OPTIONS
   -p --preserve                  Don't delete TMP files.
   -t --tmp-path     TMP_PATH     Set temporary path, default: /tmp/
   -d --debug                     Print debug info.
   -s --silent                    Be silent, don't print anything.
   -n --no-extract                Don't extract anything. This will be ignored with -x or -r. It also will not try to remove TMP files, so -p won't do anything.

  NOTES
    - Path to directory OUTPUT_PATH and TMP_PATH should exist and be writable.
    - All files REWise does output will be overwritten when they exist!

Acknowledgement

The WiseUnpacker project helped a lot to give insight on how to unpack files from Wise installers. So a lot of thanks to mnadareski!

Unlike WiseUnpacker which tries to support all versions of Wise installers, REWise tries to focus on old game installers (1999-2003) in the form of PE executables. But when REWise fails to extract any Wise installer feel free to open an issue (no guarantees!).

Technical

NOTE: The PE build date will not be the same as the installer creation date (or release date) since the overlay-data is just appended to a existing Wise PE32 stub on creation of the installer. The supported installer release dates seen so far are between 1999 and 2003. While the PE build dates are between 1998 and 2001.

A Wise installer is a PE executable (NE is also possible, but not supported at this time) with extra data appended to the end of it (overlay-data at the overlay-offset). The overlay-data contains a Wise specific header which is not very important to us (it might be, but no usable values have been found yet). After the Wise header there is raw DEFLATEd data without file-headers, after each DEFLATEd data entry there is a CRC32 for the inflated data. The DEFLATEd data + CRC32 continues until EOF.

The first inflated file is a .dib file we call WiseColors.dib, containing colors used by the installer, it is no use for us so we skip it.

The second inflated file is a binary file that has all sorts of data relevant for the installation (including custom file headers). Within REWise this file is named WiseScript.bin. Most time was spend on reverse engineering different WiseScript.bin files with a hex-editor (ImHex) so a WiseScript.bin can be parsed without as much of guessing as possible. One discovered struct that is the most relevant for extracting files that would be installed by the installer is (it contains file names, metadata, CRC32 and offset to deflatedata):

/* 0x00 WiseScriptFileHeader */
typedef struct {
  unsigned char unknown_2[2];   // seen: 0x8000, 0x8100, 0x0000, 0x9800 0xA100
  uint32_t deflateStart;
  uint32_t deflateEnd;
  uint16_t date;
  uint16_t time;
  uint32_t inflatedSize;
  unsigned char unknown_20[20]; // 20 * \0?
  uint32_t crc32;               // do not check when it is 0
  char * destFile;              // \0 terminated string
  char * fileText;              // \0 terminated string
  unsigned char terminator;     // always \0? terminator?
} WiseScriptFileHeader;

On how REWise handles a WiseScript.bin file: SEE src/wisescript.h and src/wisescript.c.

Stub from different Wise Installation System versions

NOTE: Stubs are patched on creation of the installer so we cannot do a sum of compiled installers and compare below. VsVersionInfo and StringFileInfo are patched and a value in a section somewhere up is patched to contain the overlay offset value.

VERSION	BUILD DATE-TIME	OVERLAY OFFSET	SHA256
7.01	09-11-1998 21:17:09	0x00003800	6a6266fc674bc61852d3e5dc2b3608de9205f518baf718880b81aa1a6179573f
8.11.0.505	25-04-2000 16:37:12	0x00003A00	23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
8.12.0.508	25-04-2000 16:37:12	0x00003A00	23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
8.14.0.512	25-04-2000 16:37:12	0x00003A00	23da437bde09458cd512644a139c6ce8d180187a9cc6d32e7bfef077ed99f580
9.01.202.0	25-10-2001 21:47:11	0x00003A00	96a173c62f632140e9d14a7eee0d42f8ef62bee4b66ed317f2077bdfaa32376a
9.02.204.0	25-10-2001 21:47:11	0x00003A00	96a173c62f632140e9d14a7eee0d42f8ef62bee4b66ed317f2077bdfaa32376a

State

Do you know any Wise installer that is not listed below? Please consider reporting it for completeness and for further investigation.

Known working Wise installers

SHORT	SOURCE	FULL
HL:UL	Download	Half-Life Uplink (1999)
GSPY220	Download	GameSpy 220 std (2000)
OPFOR:DEMO	Download	Half-Life:Opposing Force Demo (2000)
HL:CS	Retail CD	Half-Life Counter-Strike (2000)
HL:GOTY	Retail CD	Half-Life Game Of The Year Edition (1999)
RTCW	Retail CD	Return to Castle Wolfenstein (2001)
RTCW:MPDEMO	Download	Return to Castle Wolfenstein Multi-Player Demo (2001)
RTCW:SPDEMO	Download	Return to Castle Wolfenstein Single-Player Demo (2001)
CS15	Download	Counter-Strike 1.5 (2001)
GIFT	Download	Gift (PL) (2000) (aka Gifty (DE))
HL1WON	Download	Half-Life 1 WON 1.1.1.0 Patch (2002)
ET	Download	Wolfenstein: Enemy Territory (2001)
HL23SDK	Download	Half-Life SDK 2.3 (2002)
HL:STEAM	Download	Steam Client with Half-Life Cache (2003)

---

SHORT	FILENAME	PE BUILD	STUB
HL:UL	hluplink.exe	09-11-1998 21:17:09	InstallMaster 7
GSPY220	gamespyinstaller220std.exe	21-05-1999 22:48:48	?
OPFOR:DEMO	opfordemofull.exe	21-05-1999 22:48:48	?
HL:CS	counter-strike.exe	17-08-1999 17:25:48	?
HL:GOTY	SETUP.EXE	25-04-2000 16:37:12	InstallMaster 8
RTCW	Setup.exe	25-04-2000 16:37:12	InstallMaster 8
RTCW:MPDEMO	Wolf_MPDemo.exe	25-04-2000 16:37:12	InstallMaster 8
RTCW:SPDEMO	wolf_spdemo.exe	25-04-2000 16:37:12	InstallMaster 8
CS15	csv15full.exe	13-08-2001 19:13:38	?
GIFT	Gift.exe	13-08-2001 19:13:38	?
HL1WON	hl1110.exe	13-08-2001 19:13:38	?
ET	WolfET.exe	25-10-2001 21:47:11	Installation System 9
HL23SDK	hl_sdk_v23.exe	25-10-2001 21:47:11	Installation System 9
HL:STEAM	steaminstall_halflife.exe	25-10-2001 21:47:11	Installation System 9

Not working installers

NOTE: All multi-disc installers are currently NOT supported.

SHORT	SOURCE	FULL
WILDWHEELS	Retail CD	Wild Wheels (2002) (aka Buzzing Cars)
HM:C	Retail CD	Hitman Contracts (2004)
GOTHIC II	Retail CD	Gothic II (2003)

---

SHORT	FILENAME	PE BUILD	STUB
WILDWHEELS	setup.EXE	17-08-1999 17:25:48	?
HM:C	setup.exe	25-04-2000 16:37:12	InstallMaster 8
GOTHIC II	Gothic2-Setup.exe	25-10-2001 21:47:11	Installation System 9

WILDWHEELS

In contrary to what we've seen before there are PK headers at inflate start which also contains the CRC32 (instead of just the CRC32 after the deflate data). It is either build with a different Wise package or maybe different configuration (maybe with the zip support option? still has to be analyzed).

This game supposed to be open sourced, see this , but have not found the source or license yet.

HM:C

This is a multi-disc installer which is not supported yet.

Not aware of a free software implementation of this game, so it has no priority.

GOTHIC II

This is a multi-disc installer which is not supported yet.

Would be nice to support for the use with REGoth-bs or OpenGothic.

What can be done better

In general:

• Option(s) to extract only given file(s), maybe with wildcards or a specified file list?
• Error handling (different exit codes for different errors).

Values that are currently calculated that might be in the WiseHeader, somewhere in WiseScript.bin or a constant defined somewhere else are:

• Total inflated size.
• The deflate-offset that is added to deflateStart defined in the WiseScript.bin file.

Other values that are of interest but not found yet are:

• Deflated/Inflated size of WiseColors.dib and WiseScript.bin.

• To determine what Wise package/version was used other then the PE build date. On Wikipedia is a list of different Wise installer releases, comparing that list to the tested installers (games) their PE build date it suggests that the targeted Wise installer versions are either one of these:

  • WISE Installation System version 7 (1998) (InstallMaker)
  • WISE Installation System version 7 (1998) (InstallMaster)
  • WISE Installation System version 8 (1999) (InstallBuilder)
  • WISE Installation System version 8 (1999) (InstallMaker)
  • WISE Installation System version 8 (1999) (InstallMaster)
  • WISE Installation System version 9 (2001)

Things that might be a problem

• REWise is only tested on Little Endian systems.
• Wise installers where the PE was build before 1998 or after 2001, or installers that where created/released before 1999 or after 2003.

Dependencies

NAME	LICENSE	URL
zlib	Zlib	https://www.zlib.net/

Many thanks to

• The WiseUnpacker project for a great source of information.
• The FragNet community for testing and feedback.

Other projects

• https://github.com/mnadareski/WiseUnpacker
• https://github.com/lmop/exwise
• https://www.angelfire.com/ego/jmeister/hwun/