DEFACTORY v0.1.0

Published: 10-04-2025 Updated: 10-04-2025

Today the first version of DEFACTORY has been released. DEFACTORY is a program to extract files from Indigo Rose Setup Factory installers. It currently supports extracting files from Setup Factory versions 4 to 7.

The project got started after a tip from eukara@frag-net.com who found this not very common installer and a project called Setup Factory unpacker which can extract files from Setup Factory versions 5 and 6.

A Wikipedia search for Indigo Rose and Setup Factory did not yield any results but their website is up and they still seem to be in business. For info on older versions Archive.org was used, more info on that in the README.

The Setup Factory unpacker project revealed that the compression methods are PKWARE DCL (implode/explode) and provided initial irsetup.dat parsing for Setup Factory versions 5 and 6.

DEFACTORY uses blast.h and blast.c from zlib/contrib/blast created by Mark Adler for decompression.

How it works

First we need to get to the overlay offset of the PE file, the struct below follows:

// size of 7 for version 4 and some version of version 5
// size of 8 for versions 5 to 7
char signature[8];

// only for versions >= 7.0.3.0
uint8_t unk;

// only for versions >= 7.0.0.0
uint32_t someSize;
/* .. skip someSize .. */

// uint8_t for version 4 and some version of version 5
// uint32_t for versions 5 to 7
uint32_t tmpFileCount;

// read tmpFileCount * the following struct
struct TmpInstallerFile {
  char filename[260]; // size of 16 characters on versions 4 and 5
  uint32_t dataSize;
  uint32_t crc32;
  char data[dataSize]; // Compressed (imploded)
};

Now follows compressed (imploded) data, these are the files that would normally be installed by the installer.

File names, dates, sizes, CRC32 and other stuff need to be parsed from the irsetup.dat (one of the TmpInstallerFile's). The structure of that binary file is different per major version and in some cases also the minor version.

On how the irsetup.dat parsing is done see the source.