Procmon did indeed catch it all, but extracting and getting the data is a bit tedious, even with filters.
Ironically, this tool gave a flawless output where it showed files with classification "Renamed (New name)" which made this a two second job to sort the deps it copied everywhere and create a batch file. Thanks guys! jlc From: Jeff Frantz [mailto:[email protected]] Sent: Monday, September 26, 2011 12:26 PM To: NT System Admin Issues Subject: RE: Unpacking a binary installation source This may work: http://www.lcibrossolutions.com/spyme_tools.htm From: Joseph L. Casale [mailto:[email protected]]<mailto:[mailto:[email protected]]> Sent: Monday, September 26, 2011 1:56 PM To: NT System Admin Issues Subject: Unpacking a binary installation source I have a crappy accounting program I am stuck supporting which is copied to a network share, each time a new update comes I have to manually see what deps it copies who knows where and copy those to the binary folder along with the program directory. I cant seem to use the usual methods to unpack it, is there a "strace" equivalent or maybe a way to utilize procmon to watch what copy operations the installer performs? Thanks guys, jlc ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
