View and extract files from Inno Setup installers with InnoEx

Run a "setup.exe" on your PC and there’s no way to tell what might happen next. Will it install adware, hundreds of system files, maybe just a single executable? Who knows?

InnoEx is a free portable tool which can display the contents of some setup files, without having to install them first.

As you might guess from the name, the program only works with installers created by Inno Setup, and supported by InnoUnp (the bundled app which does the actual decoding). Fortunately that’s quite a lot: we selected 20 at random from our Downloads folder, and 11 were Inno files.

Getting started is as simple as dragging and dropping your installer.exe onto the program. If it’s an Inno Setup build, you’ll see a list of the contents.

Just seeing an application’s files will give you an idea whether it’s likely to be safe (just an EXE and a README) or maybe more intrusive (loads of DLLs, drivers and other system-related files).

If you’d like to know more, double-click TXT, RTF or other document types to open them in your normal viewer.

Select one or more files and right-click for an option to extract them to a local folder. This might allow running an application without using the installer at all, although there are no guarantees (the application may depend on some Registry key or folder created by its Setup).

If you really want to understand exactly what an installer is going to do, find and double-click install_script.iss, the text file which describes every step of the installer process.

The script isn’t aimed at the average reader, but the basics aren’t difficult to understand. Here are a few sample lines from a Zemana AntiMalware installer.

[Files]
Source: "{app}\ZAM.exe"; DestDir: "{app}"; MinVersion: 0.0,5.0; Flags: ignoreversion
Source: "{app}\res\app.ico"; DestDir: "{app}\res"; MinVersion: 0.0,5.0;
Source: "{tmp}\zam.eula.rtf"; DestDir: "{tmp}"; MinVersion: 0.0,5.0; Flags: deleteafterinstall dontcopy
Source: "{pf32}\KeyCryptSDK\app.db"; DestDir: "{pf32}\KeyCryptSDK"; Check: "IsIdProtectionEnabled"; MinVersion: 0.0,5.0; Flags: sharedfile ignoreversion

The initial "Source" names a particular installation file.

The "DestDir" specifies the destination folder. Here it’s either the application folder {app}, a subfolder {app\res}, the system temporary folder {tmp}, or Program Files x86 {pf32}.

There are other codes, too, which you may be able to figure out in some situations. Zam.eula.rtf looks like a license agreement which the installer’s going to ask you to accept. That’s presumably why it’s saved only to the temporary folder, and the "deleteafterinstall" flag ensures it’s deleted once the process is complete.

InnoEx won’t deliver this kind of detail in all situations -- or even most -- but there’s no penalty in using it, no installation required, adware or anything else. Grab a copy for your own security toolkit.

InnoEx is a free tool for Windows XP and later.