1

在使用 WiXToolSet 制作的 MSI 安装 osquery 后（使用 osquery 提供的脚本），我尝试卸载它，但失败了。它也没有在 appwiz 中显示为程序。（链接到脚本 - https://github.com/osquery/osquery/blob/master/tools/deployment/make_windows_package.ps1）

我试过同时使用 MSI 本身 -osquery.msi /uninstall和 unsintall 字符串 - msiexec /I{'uninstallstring'}。我还尝试使用该/fv选项进行修复。

与 WiX 一起使用的脚本创建 MSI 的代码：

@'
<?xml version='1.0' encoding='windows-1252'?>
<?define OsqueryVersion = 'OSQUERY_VERSION'?>
<?define OsqueryUpgradeCode = 'ea6c7327-461e-4033-847c-acdf2b85dede'?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
  <Product
    Name='osquery'
    Manufacturer='Facebook'
'@
$wix += "`n    Id='$(New-Guid)'`n"
$wix +=
@'
    UpgradeCode='$(var.OsqueryUpgradeCode)'
    Language='1033'
    Codepage='1252'
    Version='$(var.OsqueryVersion)'>
    <Package Id='*'
      Keywords='Installer'
      Description='osquery standalone installer'
      Comments='Facebooks opensource host intrusion detection agent'
      Manufacturer='Facebook'
      InstallerVersion='200'
      Platform='x64'
      Languages='1033'
      Compressed='yes'
      SummaryCodepage='1252' />
    <MediaTemplate EmbedCab="yes" />
    <MajorUpgrade
      DowngradeErrorMessage="A later version of osquery is already installed. Setup will now exit." />
    <Condition Message='A newer version of osquery is already installed.'>
      NOT NEWERVERSIONDETECTED
    </Condition>
    <Condition Message="You need to be an administrator to install this product.">
        Privileged
    </Condition>
    <Property Id='SOURCEDIRECTORY' Value='packs'/>
    <PropertyRef Id="WIX_ACCOUNT_LOCALSYSTEM" />
    <PropertyRef Id="WIX_ACCOUNT_USERS" />
    <PropertyRef Id="WIX_ACCOUNT_ADMINISTRATORS" />
    <Directory Id='TARGETDIR' Name='SourceDir'>
      <Directory Id='ProgramFiles64Folder'>
        <Directory Id='INSTALLFOLDER' Name='osquery'>
          <Directory Id='DaemonFolder' Name='osqueryd'>
            <Component Id='osqueryd'
                Guid='41c9910d-bded-45dc-8f82-3cd00a24fa2f'>
                <CreateFolder>
                <Permission User="[WIX_ACCOUNT_USERS]" Read="yes"
                  ReadExtendedAttributes="yes" Traverse="yes"
                  ReadAttributes="yes" ReadPermission="yes" Synchronize="yes"
                  GenericWrite="no" WriteAttributes="no"/>
                <Permission User="[WIX_ACCOUNT_ADMINISTRATORS]" GenericAll="yes"/>
                <Permission User="[WIX_ACCOUNT_LOCALSYSTEM]" GenericAll="yes"/>
              </CreateFolder>
              <File Id='osqueryd'
                Name='osqueryd.exe'
                Source='OSQUERY_DAEMON_PATH'
                KeyPath='yes'/>
              <ServiceInstall Id='osqueryd'
                Name='osqueryd'
                Account='NT AUTHORITY\SYSTEM'
                Arguments='--flagfile="C:\Program Files\osquery\osquery.flags"'
                Start='auto'
                Type='ownProcess'
                Vital='yes'
                ErrorControl='normal'/>
              <ServiceControl Id='osqueryd'
                Name='osqueryd'
                Stop='both'
                Start='install'
                Remove='uninstall'
                Wait='no'/>
            </Component>
          </Directory>
          <Component Id='osqueryi' Guid='6a49524e-52b0-4e99-876f-ec50c0082a04'>
            <File Id='osqueryi'
              Name='osqueryi.exe'
              Source='OSQUERY_SHELL_PATH'
              KeyPath='yes'/>
          </Component>
          <Component Id='extras' Guid='3f435561-8fe7-4725-975a-95930c44d063'>
            <File Id='osquery.conf'
              Name='osquery.conf'
              Source='OSQUERY_CONF_PATH'
              KeyPath='yes'/>
            <File Id='osquery.flags'
              Name='osquery.flags'
              Source='OSQUERY_FLAGS_PATH'/>
            <File Id='osquery.man'
              Name='osquery.man'
              Source='OSQUERY_MAN_PATH'/>
            <File Id='osquery_utils.ps1'
              Name='osquery_utils.ps1'
              Source='OSQUERY_UTILS_PATH'/>
            <File Id='manage_osqueryd.ps1'
              Name='manage-osqueryd.ps1'
              Source='OSQUERY_MGMT_PATH'/>
'@

尝试使用 MSI 卸载时，我看到以下消息： This patch package could not be opened. Verify that the patch package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer patch package 尝试使用卸载字符串时，我看到此消息： This action is only valid for products that are currently installed

4

1 回答 1

0

升级代码检索：如何找到已安装 MSI 文件的升级代码？（如果您想使用另一个软件包系列测试以下内容，请通过此处描述的方法查找升级代码）。

调试：要找到产品代码（假设它是实际定义的），也许尝试运行此代码：

Set installer = CreateObject("WindowsInstaller.Installer")
Set upgrades = installer.RelatedProducts("ea6c7327-461e-4033-847c-acdf2b85dede")

For Each u In upgrades
   MsgBox u, vbOKOnly, "Product Code: "
Next

步骤：1)将脚本复制粘贴到记事本中，2)保存为ANSI文件：桌面上的“Find Related Products.vbs”，3)双击脚本文件运行。记下消息框（如果有）显示的产品代码。点击CTRL+C复制实际 VBScript 对话框的内容。

卸载：cmd.exe使用您通过运行上面的脚本找到的产品代码：

msiexec.exe /x {Product-Code}

替代%SystemRoot%\Installer方法：如果您无法使用上述方法，请手动浏览，并按照此处第 4 节中的建议进行操作。Locate正确的MSI，right click然后去"Uninstall"。

链接：

于 2019-08-02T00:02:56.640 回答