Reverse engineering an install on windows

[newjerseyrunner]

Hello,
I'm in sort of a strange predicament. I need to figure out how to install a bunch of software that we don't have install programs for. They did at one time, but I think they've been lost by the employee before me or even before that.

Luckily though, I do have servers with the program installed on and I do have the licenses so I don't need to work around that. The problem I'm up against though, is how do I take an installed program and figure out where all of it's components are (executables, dlls, dependencies, registry entries, service hooks...) I'm quite unfamiliar with all of the nuances of MS Windows and know it's software management is pretty much non-existent.

I need to do this with a number of proprietary abandonware components.

It's MS Server 2008 if that's helpful.

 

[rootone]

Windows uses the registry to associate all the components of a system.
There are not hard and fast rules about how that should be done though.
If you examine the registry content you will likely glean some useful information, but you might miss important entries that don't seem obvious.
If the products you want to use really are abandonware with no user support or documentation still in existence you could waste a lot of time getting nowhere.

 

[john101]

this might help : http://www.howtogeek.com/school/sysinternals-pro/lesson2/

I'd clone a working install and disect that.

 

[Routaran]

I would suggest contacting the manufacturer of the programs to see if they are willing to provide you replacement disks or a digital download for the software that you are looking for. This is your best option.

As rootone suggested, examining the windows registry is the other. Most of the settings for a program are stored in either HKCU or HKLM within the Software tree, but it could be else where too. You can search through that for your applications and export the relevant keys (I'd do a search for the name of the program/publisher as well. ) and attempt copying the program to another system. But if the software in question used an activation procedure, then this will most likley not work.

Pay extra if it comes down to it to get replacement disks, it's worth avoiding the windows registry.

 

[newjerseyrunner]

The issue isn't about paying, my company is perfectly willing to pay. The problem is that these are legacy systems and the companies that created the products literally don't exist any more. I have a nuclear option of simplying copying the VM, but I want a repeatable install procedure.

 

[Routaran]

Try copying the program folder then. I have several instances of the exact same issue at work, 25 year old instrument control systems in my case.
With the older programs, you may be able to get away with just copying the program and transferring it. Do you get errors if you just move the relevant subfolders from program files to a new system?

 

[newjerseyrunner]

Try copying the program folder then. I have several instances of the exact same issue at work, 25 year old instrument control systems in my case.
With the older programs, you may be able to get away with just copying the program and transferring it. Do you get errors if you just move the relevant subfolders from program files to a new system?

Yeah, they were complicated systems that installed things all over the place. I'm really hoping I'm not stuck cloning VMs forever.

 

[rbelli1]

What is it that this software accomplishes? Can you upgrade to a more modern software? The pain of transitioning may be less than that of whatever you are doing and are planning on doing.

BoB

 

[Routaran]

Yeah, they were complicated systems that installed things all over the place. I'm really hoping I'm not stuck cloning VMs forever.

You'll have to use some process monitor software to figure out what the program on question is doing.
Here's Sysinternals' Process Monitor software
https://technet.microsoft.com/en-us/sysinternals/processmonitor

It will show you all the files/registry locations any program running on your system accesses. Filter by the process name and see what your application is doing and all the different files/locations it's using. Then make a list and copy the relevant data over to a new system. This is a slow, and rather painful process. Depending on how many different things your application hits, it might be infinitely simpler to clone your VM.

Give it a go, hopefully you'll get lucky.