installation - Windows Installer Detection: What's the full list of keywords?

Question

On Microsoft's website about UAC and in several existing answers and articles (like this one) it is mentioned that the Installer Detection of Windows checks the assembly for certain keywords for detecting if the application is an installer or not:

Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:

• Filename includes keywords like "install," "setup," "update," etc.

However, I could not find a full list of those keywords. Only "install," "setup," "update," etc. is mentioned even on Microsoft's website. So what are the "cetera"?

Answer 1

Probably the closest you'll find to a "full list of keywords" is to read the shim database itself at %windir%AppPatchsysmain.sdb. (And possibly other .sdb files in the same folder).

The sdb2xml utility seems to do a good job of parsing it. The XML output from the sysmain.sdb on my Windows 7 x64 system can be found here.

A useful starting point would be to search the file for the string "GenericInstaller". You'll find <exe> profiles matching against filenames ("*instal*", "*setup*", "trustedinstaller.exe", etc.), checksums, file version information strings ("InstallShield*", "RTPatch Executable", etc.) and other various attributes. It sometimes even recognises the presence of other files such as "EULA.rtf".

To extract a full list of filename patterns used for installer detection is a bit nontrivial since there seems to be a number of different classifications for installers ("GenericInstaller", "SpecificInstaller", "MozillaFirefoxSetup", etc.). But I'm sure anyone who's read this far will be able to find the information they need by digging around in the XML.