CAB

Supported formats

Microsoft Cabinet (CAB)

Description

This backend extracts files and metadata from Microsoft Cabinet (CAB) files. The format is primarily used by software and driver installers on Windows systems.

info

Available in Contextal Platform 1.0 and later.

Symbols

Object

• LIMITS_REACHED → limits triggered while processing the archive

Children

• TOOBIG → this child object was not extracted as it exceeds the limits

Example Metadata

{
   "org": "ctx",
   "object_id": "3a510a6727e8e893cf7b811806bb9b48492e9e6a47b1ab28b5fa22bded6a7bb5",
   "object_type": "CAB",
   "object_subtype": null,
   "recursion_level": 1,
   "size": 12428524,
   "hashes": {
      "md5": "64efd667537ee0f114aacbfdc24b8bae",
      "sha1": "3bf861ff14f394df9666e5b652daaf362df99975",
      "sha256": "3a510a6727e8e893cf7b811806bb9b48492e9e6a47b1ab28b5fa22bded6a7bb5",
      "sha512": "39ab8f02d3a039426cbda18e12b86d4bac7855ddb097bf5380abdd19fb3f13b00036d4b04572a181986bb2bc22ec3d1c01811202f4ea641a9148dbac6c50ca75"
   },
   "ctime": 1711388204.562852,
   "relation_metadata": {},
   "ok": {
      "symbols": [],
      "object_metadata": {
         "_backend_version": "1.0.0",
         "number_of_files": 22,
         "number_of_folders": 1
      },
      "children": [
         {
            "org": "ctx",
            "object_id": "8974ec1166c41d1190ac69f136857c5a21f9f1d0ebf75485414a960c73b30538",
            "object_type": "PE",
            "object_subtype": null,
            "recursion_level": 2,
            "size": 1394008,
            "hashes": {
               "sha512": "7a62413e5b08a2fe14dc9e862b7ffa07ff14a48b97159f739258df0d9ea43f77ab3959c5276828838fe6787cd5c1d6334a9f90e41323ad6b406086efa81626d3",
               "sha256": "8974ec1166c41d1190ac69f136857c5a21f9f1d0ebf75485414a960c73b30538",
               "md5": "ae33d64125353a602342967db9ec0ac8",
               "sha1": "f655a31d402ec3bf1fe1e83916fe34309e9778c4"
            },
            "ctime": 1711388204.562852,
            "relation_metadata": {
               "compression_type": "MSZIP",
               "is_archive": true,
               "is_exec": false,
               "is_hidden": false,
               "is_name_utf": false,
               "is_read_only": false,
               "is_system": false,
               "name": "fBtProxy",
               "uncompressed_size": 1394008
            },
[...]

Example Queries

object_type == "CAB"
  && @has_child(object_type == "PE" && @has_symbol("ISSUES"))

• This matches a CAB object, in which a PE object with potential issues is identified.

Configuration Options

• max_processed_size → maximum size of the input object that will be processed (default: 262144000)
• max_children → maximum number of children objects to create (default: 100)
• max_child_output_size → maximum size of a single output children object (default: 41943040)