NSIS Extractor

nsisextract safely lists or extracts files from an NSIS installer without executing it. Its command-line interface and user-facing conventions follow innoextract.

Warning

This project is at a very early stage. It may be unstable, interfaces may change without notice, and behavior may diverge between format-specific code branches. For safety, run it in an isolated environment, use only installers from trusted sources, and apply memory, CPU, disk, and time limits whenever resource requirements are uncertain.

It supports the tested stock NSIS, NSISBI/NData, and legacy formats but does not claim universal NSIS compatibility. It is an independent project and is not affiliated with or endorsed by NSIS, NSISBI, or their maintainers.

Installation

Install from a source checkout with Python 3.10 or newer:

python3 -m pip install .

Usage

List archived files:

nsisextract --list installer.exe

Extract into the current directory:

nsisextract installer.exe

Extract into another directory:

nsisextract --output-dir output installer.exe

-l is the short form of --list, while -d is the short form of --output-dir. Extraction is the default action; -e or --extract makes it explicit. -i or --info prints an installer summary.

Useful options:

• --collisions=overwrite keeps the last statically encountered payload at each path. This is the default, matching innoextract terminology.
• --collisions=rename preserves overwritten payloads with stable, NSIS-specific suffixes while leaving the selected payload at the original path.
• --collisions=rename-all gives every member of a collision set a suffix.
• --collisions=error rejects an archive containing such collisions.
• --lowercase converts output paths to lower case.
• --quiet reduces informational output.
• --silent prints only errors.
• --version prints the program version.

Like innoextract, extraction replaces files already present in the output directory without prompting. Writes still use a sibling temporary file and atomic replacement.

Options that cannot yet preserve innoextract semantics are not exposed. Notably, --test, --list-sizes, and --list-checksums require validation or metadata that the current NSIS parser cannot report accurately.

Run nsisextract --help for the complete command synopsis.

The command reads the NSIS stream directly from the installer, without making a temporary copy of a potentially multi-gigabyte overlay. A previously dumped NSIS stream can also be supplied as input.

Safety model

Installers are treated as untrusted data:

• installer code is never executed;
• PE and NSIS ranges are validated before use;
• malformed or nonterminal Authenticode data is not silently discarded;
• destination paths are contained beneath the selected output directory;
• absolute, drive-relative, and traversal paths are rejected;
• extraction uses temporary files and atomic replacement; and
• case-insensitive archive collisions are handled deterministically.

These protections reduce risk but are not a security boundary or a guarantee that malformed input cannot trigger excessive resource consumption or parser defects. Prefer a disposable virtual machine, container, sandbox, or similarly isolated account, and constrain available resources when analyzing an unfamiliar installer.

Extraction reconstructs archived file operations. It does not emulate installer control flow, registry operations, callbacks, or runtime plugins. Section-local SetOutPath state is applied to subsequent archived files so their directory layout is preserved when it can be established statically.

As in 7-Zip, the $INSTDIR prefix is omitted from the extracted tree, so $INSTDIR\bin\app.exe is written as bin/app.exe. Other runtime roots are kept, for example $PLUGINSDIR\System.dll.

Support the project

If this extractor is useful to you, please consider making a donation to support its continued development and maintenance:

Web3 wallet domain: kokerzhou.brave

Use a compatible wallet and verify the resolved address, network, and selected asset before sending funds. Donations are voluntary and do not purchase support, warranties, or influence over the project.

Development

Install the development tools and run the checks:

python3 -m pip install -e '.[dev]'
python3 -m ruff check .
python3 -m unittest discover -v
python3 -m build

See CONTRIBUTING.md for contribution rules and docs/architecture.md for component responsibilities, trust boundaries, format policy, and known limitations. The NSIS format notes record the source-derived version mappings and output-path semantics used during parser development. TODO.md defines the bounded work remaining before development becomes maintenance-only.

This project is licensed under the zlib License. See LICENSE and THIRD_PARTY_NOTICES for the project and upstream notices.

Reporting unsupported installers

Open an Unsupported installer or format edge case issue and provide:

• the nsisextract version;
• complete diagnostic output;
• the installer SHA-256;
• expected behavior and observations; and
• a lawful public source URL, when one can safely be shared.

Do not attach multi-gigabyte installers, overlay dumps, extracted payloads, confidential files, or malware to an issue. Large or sensitive samples belong outside Git history and built packages.