-
-SectionIn RO
-SetOutPath $INSTDIR
-
-ClearErrors
-
-File \
-ossec-agent.exe \
-default-ossec.conf \
-manage_agents.exe \
-os_win32ui.exe \
-ossec-rootcheck.exe \
-internal_options.conf \
-setup-windows.exe \
-setup-syscheck.exe \
-setup-iis.exe \
-service-start.exe \
-service-stop.exe \
-doc.html \
-rootkit_trojans.txt \
-rootkit_files.txt \
-add-localfile.exe \
-LICENSE.txt \
-rootcheck\rootcheck.conf \
-rootcheck\db\win_applications_rcl.txt \
-rootcheck\db\win_malware_rcl.txt \
-rootcheck\db\win_audit_rcl.txt \
-help.txt \
-vista_sec.csv \
-route-null.cmd \
-restart-ossec.cmd
-
-WriteRegStr HKLM SOFTWARE\ossec "Install_Dir" "$INSTDIR"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayName" "${NAME} ${VERSION}"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayVersion" "${VERSION}"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayIcon" "${MUI_ICON}"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "HelpLink" "http://www.ossec.net/main/support/"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "URLInfoAbout" "http://www.ossec.net"
-WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "UninstallString" '"$INSTDIR\uninstall.exe"'
-WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "NoModify" 1
-WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "NoRepair" 1
-WriteUninstaller "uninstall.exe"
-
-; Writing version and install information
-FileOpen $0 $INSTDIR\VERSION.txt w
-IfErrors done
-FileWrite $0 "${NAME} v${VERSION} - "
-FileWrite $0 "Installed on ${CDATE}"
-FileClose $0
-done:
-
-CreateDirectory "$INSTDIR\rids"
-CreateDirectory "$INSTDIR\syscheck"
-CreateDirectory "$INSTDIR\shared"
-CreateDirectory "$INSTDIR\active-response"
-CreateDirectory "$INSTDIR\active-response\bin"
-Delete "$INSTDIR\active-response\bin\route-null.cmd"
-Delete "$INSTDIR\active-response\bin\restart-ossec.cmd"
-Rename "$INSTDIR\rootkit_trojans.txt" "$INSTDIR\shared\rootkit_trojans.txt"
-Rename "$INSTDIR\rootkit_files.txt" "$INSTDIR\shared\rootkit_files.txt"
-Rename "$INSTDIR\win_malware_rcl.txt" "$INSTDIR\shared\win_malware_rcl.txt"
-Rename "$INSTDIR\win_audit_rcl.txt" "$INSTDIR\shared\win_audit_rcl.txt"
-Rename "$INSTDIR\win_applications_rcl.txt" "$INSTDIR\shared\win_applications_rcl.txt"
-Rename "$INSTDIR\route-null.cmd" "$INSTDIR\active-response\bin\route-null.cmd"
-Rename "$INSTDIR\restart-ossec.cmd" "$INSTDIR\active-response\bin\restart-ossec.cmd"
-Rename "$INSTDIR\os_win32ui.exe" "$INSTDIR\win32ui.exe"
-Delete "$SMPROGRAMS\OSSEC\Edit.lnk"
-Delete "$SMPROGRAMS\OSSEC\Uninstall.lnk"
-Delete "$SMPROGRAMS\OSSEC\Documentation.lnk"
-Delete "$SMPROGRAMS\OSSEC\Edit Config.lnk"
-Delete "$SMPROGRAMS\OSSEC\*.*"
-
-; Remove start menu entry.
-RMDir "$SMPROGRAMS\OSSEC"
-
-; Creating start menu directory
-CreateDirectory "$SMPROGRAMS\OSSEC"
-CreateShortCut "$SMPROGRAMS\OSSEC\Manage Agent.lnk" "$INSTDIR\win32ui.exe" "" "$INSTDIR\win32ui.exe" 0
-CreateShortCut "$SMPROGRAMS\OSSEC\Documentation.lnk" "$INSTDIR\doc.html" "" "$INSTDIR\doc.html" 0
-CreateShortCut "$SMPROGRAMS\OSSEC\Edit Config.lnk" "$INSTDIR\ossec.conf" "" "$INSTDIR\ossec.conf" 0
-CreateShortCut "$SMPROGRAMS\OSSEC\Uninstall.lnk" "$INSTDIR\uninstall.exe" "" "$INSTDIR\uninstall.exe" 0
-
-; Install in the services (perhaps it would be better to use a plug-in here?)
-;nsExec::ExecToStack '"$INSTDIR\ossec-agent.exe" install-service'
-ExecWait '"$INSTDIR\ossec-agent.exe" install-service'
-;nsExec::ExecToStack '"$INSTDIR\setup-windows.exe" "$INSTDIR"'
-ExecWait '"$INSTDIR\setup-windows.exe" "$INSTDIR"'
-
+ ; set install type and cwd
+ SectionIn RO
+ SetOutPath $INSTDIR
+
+ ; clear any errors
+ ClearErrors
+
+ ; use real date modified times
+ SetDateSave off
+
+ ; overwrite existing files
+ SetOverwrite on
+
+ ; create necessary directories
+ CreateDirectory "$INSTDIR\bookmarks"
+ CreateDirectory "$INSTDIR\rids"
+ CreateDirectory "$INSTDIR\syscheck"
+ CreateDirectory "$INSTDIR\shared"
+ CreateDirectory "$INSTDIR\active-response"
+ CreateDirectory "$INSTDIR\active-response\bin"
+ CreateDirectory "$INSTDIR\tmp"
+
+ ; install files
+ File ossec-lua.exe
+ File ossec-luac.exe
+ File ossec-agent.exe
+ File ossec-agent-eventchannel.exe
+ File default-ossec.conf
+ File manage_agents.exe
+ File /oname=win32ui.exe os_win32ui.exe
+ File ossec-rootcheck.exe
+ File internal_options.conf
+ File default-local_internal_options.conf
+ File setup-windows.exe
+ File setup-syscheck.exe
+ File setup-iis.exe
+ File doc.html
+ File /oname=shared\rootkit_trojans.txt rootkit_trojans.txt
+ File /oname=shared\rootkit_files.txt rootkit_files.txt
+ File add-localfile.exe
+ File LICENSE.txt
+ File /oname=shared\win_applications_rcl.txt rootcheck\db\win_applications_rcl.txt
+ File /oname=shared\win_malware_rcl.txt rootcheck\db\win_malware_rcl.txt
+ File /oname=shared\win_audit_rcl.txt rootcheck\db\win_audit_rcl.txt
+ File help.txt
+ File vista_sec.csv
+ File /oname=active-response\bin\route-null.cmd route-null.cmd
+ File /oname=active-response\bin\restart-ossec.cmd restart-ossec.cmd
+
+ ; use appropriate version of "ossec-agent.exe"
+ ${If} ${AtLeastWinVista}
+ Delete "$INSTDIR\ossec-agent.exe"
+ Rename "$INSTDIR\ossec-agent-eventchannel.exe" "$INSTDIR\ossec-agent.exe"
+ ${Else}
+ Delete "$INSTDIR\ossec-agent-eventchannel.exe"
+ ${Endif}
+
+ ; write registry keys
+ WriteRegStr HKLM SOFTWARE\ossec "Install_Dir" "$INSTDIR"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayName" "${NAME} ${VERSION}"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayVersion" "${VERSION}"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "DisplayIcon" "${MUI_ICON}"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "HelpLink" "http://www.ossec.net/main/support/"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\OSSEC" "URLInfoAbout" "http://www.ossec.net"
+ WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "UninstallString" '"$INSTDIR\uninstall.exe"'
+ WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "NoModify" 1
+ WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\ossec" "NoRepair" 1
+ WriteUninstaller "uninstall.exe"
+
+ ; write version and install information
+ VersionInstall:
+ FileOpen $0 "$INSTDIR\VERSION.txt" w
+ FileWrite $0 "${NAME} v${VERSION} - Installed on ${CDATE}"
+ FileClose $0
+ IfErrors VersionError VersionComplete
+ VersionError:
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure saving version to file.$\r$\n$\r$\n\
+ File:$\r$\n$\r$\n$INSTDIR\VERSION.txt$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE VersionComplete IDRETRY VersionInstall
+
+ SetErrorLevel 2
+ Abort
+ VersionComplete:
+ ClearErrors
+
+ ; create log file
+ LogInstall:
+ ClearErrors
+ IfFileExists "$INSTDIR\ossec.log" LogComplete
+ FileOpen $0 "$INSTDIR\ossec.log" w
+ FileClose $0
+ IfErrors LogError LogComplete
+ LogError:
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure creating the ossec.log file.$\r$\n$\r$\n\
+ File:$\r$\n$\r$\n$INSTDIR\ossec.log$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE LogComplete IDRETRY LogInstall
+
+ SetErrorLevel 2
+ Abort
+ LogComplete:
+ ClearErrors
+
+ ; rename local_internal_options.conf if it does not already exist
+ ConfInstallInternal:
+ ClearErrors
+ IfFileExists "$INSTDIR\local_internal_options.conf" ConfPresentInternal
+ Rename "$INSTDIR\default-local_internal_options.conf" "$INSTDIR\local_internal_options.conf"
+ IfErrors ConfErrorInternal ConfPresentInternal
+ ConfErrorInternal:
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure renaming configuration file.$\r$\n$\r$\n\
+ From:$\r$\n$\r$\n\
+ $INSTDIR\default-local_internal_options.conf$\r$\n$\r$\n\
+ To:$\r$\n$\r$\n\
+ $INSTDIR\local_internal_options.conf$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE ConfPresentInternal IDRETRY ConfInstallInternal
+
+ SetErrorLevel 2
+ Abort
+ ConfPresentInternal:
+ ClearErrors
+
+ ; rename ossec.conf if it does not already exist
+ ConfInstallOSSEC:
+ ClearErrors
+ IfFileExists "$INSTDIR\ossec.conf" ConfPresentOSSEC
+ Rename "$INSTDIR\default-ossec.conf" "$INSTDIR\ossec.conf"
+ IfErrors ConfErrorOSSEC ConfPresentOSSEC
+ ConfErrorOSSEC:
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure renaming configuration file.$\r$\n$\r$\n\
+ From:$\r$\n$\r$\n\
+ $INSTDIR\default-ossec.conf$\r$\n$\r$\n\
+ To:$\r$\n$\r$\n\
+ $INSTDIR\ossec.conf$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE ConfPresentOSSEC IDRETRY ConfInstallOSSEC
+
+ SetErrorLevel 2
+ Abort
+ ConfPresentOSSEC:
+ ClearErrors
+
+ ; handle shortcuts
+ ; http://nsis.sourceforge.net/Shortcuts_removal_fails_on_Windows_Vista
+ SetShellVarContext all
+
+ ; remove shortcuts
+ Delete "$SMPROGRAMS\OSSEC\Edit.lnk"
+ Delete "$SMPROGRAMS\OSSEC\Uninstall.lnk"
+ Delete "$SMPROGRAMS\OSSEC\Documentation.lnk"
+ Delete "$SMPROGRAMS\OSSEC\Edit Config.lnk"
+ Delete "$SMPROGRAMS\OSSEC\*.*"
+ RMDir "$SMPROGRAMS\OSSEC"
+
+ ; create shortcuts
+ CreateDirectory "$SMPROGRAMS\OSSEC"
+ CreateShortCut "$SMPROGRAMS\OSSEC\Manage Agent.lnk" "$INSTDIR\win32ui.exe" "" "$INSTDIR\win32ui.exe" 0
+ CreateShortCut "$SMPROGRAMS\OSSEC\Documentation.lnk" "$INSTDIR\doc.html" "" "$INSTDIR\doc.html" 0
+ CreateShortCut "$SMPROGRAMS\OSSEC\Edit Config.lnk" "$INSTDIR\ossec.conf" "" "$INSTDIR\ossec.conf" 0
+ CreateShortCut "$SMPROGRAMS\OSSEC\Uninstall.lnk" "$INSTDIR\uninstall.exe" "" "$INSTDIR\uninstall.exe" 0
+
+ ; install OSSEC service
+ ServiceInstall:
+ nsExec::ExecToLog '"$INSTDIR\ossec-agent.exe" install-service'
+ Pop $0
+ ${If} $0 <> 1
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure setting up the ${SERVICE} service.$\r$\n$\r$\n\
+ Check the details for information about the error.$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE ServiceInstallComplete IDRETRY ServiceInstall
+
+ SetErrorLevel 2
+ Abort
+ ${EndIf}
+ ServiceInstallComplete:
+
+ ; install files
+ Setup:
+ nsExec::ExecToLog '"$INSTDIR\setup-windows.exe" "$INSTDIR"'
+ Pop $0
+ ${If} $0 <> 1
+ MessageBox MB_ABORTRETRYIGNORE|MB_ICONSTOP "$\r$\n\
+ Failure running setup-windows.exe.$\r$\n$\r$\n\
+ Check the details for information about the error.$\r$\n$\r$\n\
+ Click Abort to stop the installation,$\r$\n\
+ Retry to try again, or$\r$\n\
+ Ignore to skip this file." /SD IDABORT IDIGNORE SetupComplete IDRETRY Setup
+
+ SetErrorLevel 2
+ Abort
+ ${EndIf}
+ SetupComplete: