- Joined
- Mar 14, 2023
- Messages
- 80,649
Thanks — useful diagnostics. The parse errors you saw were not from PowerShell or Windows being weird; they come from the script text itself being syntactically broken (square-bracket type annotations and comments got mangled and some statements ended up on single lines). Copy/paste from the forum earlier introduced those problems.
I’ll give a short, robust PowerShell snippet you can paste directly into an interactive PowerShell prompt (no file required). It avoids fancy type attributes and inline comments that were causing the parser errors, finds the MZ/PK/OLE signatures, prints offsets and a small hex/ASCII preview, and includes a small carve function you can use to write a carved file from an offset.
1) Open PowerShell (regular, not necessarily elevated) and paste the entire block below exactly as one paste:
$fn = 'C:\Temp\SamsungExtract\carved_container.exe'
Write-Host "File: $fn"
$bytes = [System.IO.File]::ReadAllBytes($fn)
Write-Host ("Size: {0:N0} bytes" -f $bytes.Length)
$patPK = 0x50,0x4B,0x03,0x04 # "PK.." (ZIP/MSI/CAB local header)
$patOLE = 0xD0,0xCF,0x11,0xE0 # OLE compound file (MSI)
function FindOffsets($patternInts) {
$pattern = [byte[]$patternInts
$offs = @()
for ($i=0; $i -le $bytes.Length - $pattern.Length; $i++) {
$ok = $true
for ($j=0; $j -lt $pattern.Length; $j++) {
if ($bytes[$i+$j] -ne $pattern[$j]) { $ok = $false; break }
}
if ($ok) { $offs += $i; $i += $pattern.Length - 1 }
}
return ,$offs
}
$map = @{ MZ=$patMZ; PK=$patPK; OLE=$patOLE }
foreach ($k in $map.Keys) {
$offs = FindOffsets $map[$k]
if ($offs.Count -eq 0) {
Write-Host "$k offsets: none"
continue
}
Write-Host "
Write-Host " -> preview at offset $o (dec) / 0x{0:X}" -f $o
Write-Host " context start=$start len=$len"
Write-Host (" HEX: " + $hex.Substring(0,[Math]::Min(200,$hex.Length)))
Write-Host (" ASCII:" + $ascii.Substring(0,[Math]::Min(200,$ascii.Length)))
}
}
function CarveFrom($offset, $outFullPath) {
$in = [System.IO.File]::OpenRead($fn)
try {
$in.Position = $offset
$out = [System.IO.File]::Create($outFullPath)
$buf = New-Object byte[] 8192
while (($r = $in.Read($buf,0,$buf.Length)) -gt 0) { $out.Write($buf,0,$r) }
$out.Close()
} finally { $in.Close() }
Write-Host "Wrote $outFullPath ($(Get-Item $outFullPath).Length bytes)"
}
When that finishes it will print any offsets for MZ/PK/OLE and a small preview. Post those offsets here (copy the output). If you get nothing, tell me that too.
2) If you get PK or OLE offsets: carve and test
If 7z lists contents, extract with:
"C:\Program Files\7-Zip\7z.exe" x 'C:\Temp\SamsungExtract\carved_at_394394.bin' -o'C:\Temp\SamsungExtract\extracted_394394' -y
If the carved file is an MSI (shows ProductName or similar), you can also extract MSI payloads with msiexec administrative install:
msiexec /a "C:\Temp\SamsungExtract\carved_at_394394.bin" /qn TARGETDIR=C:\Temp\SamsungExtract\msi_extracted
3) If the carved file is a PE (starts with MZ) that contains an embedded container (Burn bootstrapper / attached container):
Notes and tips
I’ll give a short, robust PowerShell snippet you can paste directly into an interactive PowerShell prompt (no file required). It avoids fancy type attributes and inline comments that were causing the parser errors, finds the MZ/PK/OLE signatures, prints offsets and a small hex/ASCII preview, and includes a small carve function you can use to write a carved file from an offset.
1) Open PowerShell (regular, not necessarily elevated) and paste the entire block below exactly as one paste:
$fn = 'C:\Temp\SamsungExtract\carved_container.exe'
Write-Host "File: $fn"
$bytes = [System.IO.File]::ReadAllBytes($fn)
Write-Host ("Size: {0:N0} bytes" -f $bytes.Length)
signature patterns as integer arrays (will be cast to bytes)
$patMZ = 0x4D,0x5A # "MZ" (PE)$patPK = 0x50,0x4B,0x03,0x04 # "PK.." (ZIP/MSI/CAB local header)
$patOLE = 0xD0,0xCF,0x11,0xE0 # OLE compound file (MSI)
function FindOffsets($patternInts) {
$pattern = [byte[]$patternInts
$offs = @()
for ($i=0; $i -le $bytes.Length - $pattern.Length; $i++) {
$ok = $true
for ($j=0; $j -lt $pattern.Length; $j++) {
if ($bytes[$i+$j] -ne $pattern[$j]) { $ok = $false; break }
}
if ($ok) { $offs += $i; $i += $pattern.Length - 1 }
}
return ,$offs
}
$map = @{ MZ=$patMZ; PK=$patPK; OLE=$patOLE }
foreach ($k in $map.Keys) {
$offs = FindOffsets $map[$k]
if ($offs.Count -eq 0) {
Write-Host "$k offsets: none"
continue
}
Write-Host "
n$k offsets: $($offs -join ', ')" foreach ($o in $offs) { $start = [Math]::Max(0, $o - 48) $len = [Math]::Min(160, $bytes.Length - $start) $seg = $bytes[$start..($start + $len - 1)] $hex = [BitConverter]::ToString($seg) -replace '-',' ' $ascii = ([System.Text.Encoding]::ASCII.GetString($seg)) -replace "0",'·'Write-Host " -> preview at offset $o (dec) / 0x{0:X}" -f $o
Write-Host " context start=$start len=$len"
Write-Host (" HEX: " + $hex.Substring(0,[Math]::Min(200,$hex.Length)))
Write-Host (" ASCII:" + $ascii.Substring(0,[Math]::Min(200,$ascii.Length)))
}
}
function CarveFrom($offset, $outFullPath) {
$in = [System.IO.File]::OpenRead($fn)
try {
$in.Position = $offset
$out = [System.IO.File]::Create($outFullPath)
$buf = New-Object byte[] 8192
while (($r = $in.Read($buf,0,$buf.Length)) -gt 0) { $out.Write($buf,0,$r) }
$out.Close()
} finally { $in.Close() }
Write-Host "Wrote $outFullPath ($(Get-Item $outFullPath).Length bytes)"
}
When that finishes it will print any offsets for MZ/PK/OLE and a small preview. Post those offsets here (copy the output). If you get nothing, tell me that too.
2) If you get PK or OLE offsets: carve and test
- Suppose a PK/OLE offset printed as 394394. Carve it to a file by running (in the same session — paste exactly):
- Test the carved file with 7‑Zip to see if it's an archive / MSI / CAB:
If 7z lists contents, extract with:
"C:\Program Files\7-Zip\7z.exe" x 'C:\Temp\SamsungExtract\carved_at_394394.bin' -o'C:\Temp\SamsungExtract\extracted_394394' -y
If the carved file is an MSI (shows ProductName or similar), you can also extract MSI payloads with msiexec administrative install:
msiexec /a "C:\Temp\SamsungExtract\carved_at_394394.bin" /qn TARGETDIR=C:\Temp\SamsungExtract\msi_extracted
3) If the carved file is a PE (starts with MZ) that contains an embedded container (Burn bootstrapper / attached container):
- 7-Zip sometimes opens those embedded containers if the container blob is complete. If 7z doesn’t open it, try Resource Hacker or use the PowerShell carving above to carve the region that corresponds to the attached container start (the Burn manifest region often appears as XML near a PK or MZ marker).
- If you find a file named SamsungInstaller64.msi inside, extract that MSI and follow step 2.
Notes and tips
- Don’t paste the whole large file into chat—just paste the offsets and small previews the script prints.
- If you prefer a saved script rather than interactive paste, save the exact block above to a .ps1 and run with ExecutionPolicy Bypass (you already did that). Make sure the saved file matches the block (no bracket/comment corruption).
- If carving large files in PowerShell is slow, you can carve using dsf/gnuwin dd if you have it, but the CarveFrom function is safe and works on stock Windows.
) [], ParentContainsErrorRecordException