Microsoft Cabinet (CAB) Archive Format

Overview

Microsoft Cabinet (CAB) is a lossless data compression and archive format developed by Microsoft. CAB files are widely used for software installation, Windows system updates, and file distribution. The format supports multiple compression algorithms and advanced features like digital signatures and multi-cabinet spanning.

Technical Details

File Extension: .cab
MIME Type: application/vnd.ms-cab-compressed
Compression Algorithms: MSZIP, LZX, Quantum
Maximum File Size: 2GB per cabinet
Multi-Cabinet Support: Yes (spanning across multiple files)
Digital Signatures: Supported

CAB archives contain:

• Compressed files and directories
• File metadata and attributes
• Optional digital signatures
• Multi-volume spanning information

Key Features

• Multiple Compression: MSZIP, LZX, and Quantum algorithms
• Digital Signing: Authenticode signature support
• Multi-Cabinet Archives: Spanning large archives across multiple files
• Efficient Storage: Delta compression for related files
• Windows Integration: Native Windows support
• Self-Extracting: Can create self-extracting executables

File Structure

CAB Archive Structure:
├── CAB Header
│   ├── Signature ('MSCF')
│   ├── Reserved fields
│   ├── Cabinet size
│   ├── Folder count
│   └── File count
├── Folder Headers
│   ├── Compression type
│   ├── Data offset
│   └── Data block count
├── File Headers
│   ├── Uncompressed size
│   ├── Folder index
│   ├── Date/time
│   ├── Attributes
│   └── Filename
├── Data Blocks
│   └── Compressed file data
└── Digital Signature (optional)

Common Use Cases

1. Software Installation: Windows Installer (MSI) packages
2. System Updates: Windows Update packages
3. Device Drivers: Hardware driver distribution
4. Application Deployment: Enterprise software distribution
5. File Archiving: Compressed file storage
6. Patch Distribution: Software updates and patches

Command Line Tools

Windows Built-in Tools

REM Extract CAB file
expand archive.cab -F:* destination\

REM Extract specific file
expand archive.cab -F:filename.txt destination\

REM Create CAB file (using makecab)
makecab source.txt archive.cab

REM Create CAB with directive file
makecab /F directive.ddf

Makecab Directive File Example

; Cabinet directive file
.OPTION EXPLICIT
.Set CabinetNameTemplate=MyApp.cab
.Set DiskDirectory1=output
.Set CompressionType=MSZIP
.Set Cabinet=on
.Set Compress=on

"file1.txt"
"file2.exe"
"subdir\file3.dll"

Third-Party Tools

# 7-Zip
7z x archive.cab
7z a -tCAB archive.cab files\

# WinRAR
WinRAR x archive.cab
WinRAR a -afCAB archive.cab files\

# CabArc (Microsoft Cabinet SDK)
cabarc -r -p N archive.cab files\*
cabarc X archive.cab

Programming APIs

Windows API (C++)

#include <windows.h>
#include <fdi.h>
#include <fci.h>

// Function to extract CAB file
BOOL ExtractCabinet(LPCTSTR cabPath, LPCTSTR extractPath) {
    HFDI hfdi = FDICreate(
        fnMemAlloc,
        fnMemFree,
        fnFileOpen,
        fnFileRead,
        fnFileWrite,
        fnFileClose,
        fnFileSeek,
        cpuUNKNOWN,
        &erf
    );
    
    if (hfdi == NULL) return FALSE;
    
    BOOL result = FDICopy(
        hfdi,
        (char*)cabPath,
        (char*)extractPath,
        0,
        fnNotification,
        NULL,
        NULL
    );
    
    FDIDestroy(hfdi);
    return result;
}

// Create CAB file
BOOL CreateCabinet(LPCTSTR cabPath, FileList files) {
    HFCI hfci = FCICreate(
        &erf,
        fnFilePlaced,
        fnMemAlloc,
        fnMemFree,
        fnFileOpen,
        fnFileRead,
        fnFileWrite,
        fnFileClose,
        fnFileSeek,
        fnFileDelete,
        fnGetTempFile,
        &ccab,
        NULL
    );
    
    if (hfci == NULL) return FALSE;
    
    // Add files to cabinet
    for (auto& file : files) {
        FCIAddFile(hfci, file.sourcePath, file.cabPath,
                  FALSE, fnGetNextCab, fnProgress, fnOpenInfo,
                  tcompTYPE_MSZIP);
    }
    
    FCIFlushCabinet(hfci, FALSE, fnGetNextCab, fnProgress);
    FCIDestroy(hfci);
    return TRUE;
}

.NET Framework

using Microsoft.Deployment.Compression.Cab;

// Extract CAB file
public void ExtractCab(string cabPath, string extractPath)
{
    using (var cab = new CabInfo(cabPath))
    {
        cab.UnpackFiles(extractPath);
    }
}

// Create CAB file
public void CreateCab(string cabPath, string[] sourceFiles)
{
    using (var cab = new CabInfo(cabPath))
    {
        cab.PackFiles(null, sourceFiles, sourceFiles);
    }
}

// Extract with progress tracking
public void ExtractWithProgress(string cabPath, string extractPath)
{
    var cab = new CabInfo(cabPath);
    cab.Unpack(extractPath, (sender, e) =>
    {
        Console.WriteLine($"Extracting: {e.CurrentFileName} ({e.ProgressPercentage}%)");
    });
}

PowerShell

# Extract CAB using expand
expand archive.cab -F:* C:\destination\

# Using .NET Compression library
Add-Type -AssemblyName "Microsoft.Deployment.Compression.Cab"

$cab = New-Object Microsoft.Deployment.Compression.Cab.CabInfo "archive.cab"
$cab.UnpackFiles("C:\destination")

# Create CAB file
$sourceFiles = @("file1.txt", "file2.exe")
$cab = New-Object Microsoft.Deployment.Compression.Cab.CabInfo "output.cab"
$cab.PackFiles($null, $sourceFiles, $sourceFiles)

Advanced Features

Multi-Cabinet Archives

Large Archive Spanning:
MyApp001.cab  (First cabinet)
MyApp002.cab  (Continuation)
MyApp003.cab  (Final cabinet)

Each cabinet contains:
- Cross-references to other cabinets
- Continuation information
- File spanning data

Digital Signatures

// Add digital signature to CAB
BOOL SignCabinet(LPCTSTR cabPath, LPCTSTR certPath) {
    HCRYPTPROV hProv;
    HCRYPTMSG hMsg;
    
    // Acquire cryptographic context
    CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, 0);
    
    // Create signed message
    hMsg = CryptMsgOpenToEncode(
        X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
        0,
        CMSG_SIGNED,
        &signInfo,
        NULL,
        NULL
    );
    
    // Sign the CAB file
    // Implementation details...
    
    CryptMsgClose(hMsg);
    CryptReleaseContext(hProv, 0);
}

Compression Algorithms

MSZIP (Deflate)

Characteristics:
- Fast compression/decompression
- Good compression ratio
- Low memory usage
- Compatible with ZIP deflate

LZX

Characteristics:
- Better compression than MSZIP
- Slower compression/decompression
- Higher memory usage
- Used in Windows Installer

Quantum

Characteristics:
- Highest compression ratio
- Slowest performance
- Rarely used in practice

Integration Examples

Windows Installer Integration

<!-- MSI Package using CAB -->
<Package Id="*" 
         Keywords="Installer" 
         Description="My Application"
         Manufacturer="Company" 
         InstallerVersion="200" 
         Languages="1033" 
         Compressed="yes" 
         SummaryCodepage="1252" />

<Media Id="1" Cabinet="MyApp.cab" EmbedCab="yes" />

<Directory Id="TARGETDIR" Name="SourceDir">
    <Directory Id="ProgramFilesFolder">
        <Directory Id="INSTALLFOLDER" Name="MyApp" />
    </Directory>
</Directory>

<ComponentGroup Id="ProductComponents" Directory="INSTALLFOLDER">
    <Component Id="MainExecutable">
        <File Id="MyApp.exe" Source="MyApp.exe" />
    </Component>
</ComponentGroup>

Deployment Scripts

@echo off
REM Automated CAB deployment script

echo Creating CAB archive...
makecab /F deployment.ddf

echo Verifying CAB integrity...
expand deployment.cab -D

echo Deploying to target systems...
for /f %%i in (servers.txt) do (
    echo Copying to %%i...
    copy deployment.cab \\%%i\deploy\
    echo Extracting on %%i...
    psexec \\%%i expand deploy\deployment.cab -F:* C:\Program Files\MyApp\
)

echo Deployment complete.

Security Considerations

Digital Signature Verification

// Verify CAB signature
BOOL VerifyCabSignature(LPCTSTR cabPath) {
    WINTRUST_FILE_INFO fileInfo;
    WINTRUST_DATA winTrustData;
    GUID actionGuid = WINTRUST_ACTION_GENERIC_VERIFY_V2;
    
    memset(&fileInfo, 0, sizeof(fileInfo));
    fileInfo.cbStruct = sizeof(fileInfo);
    fileInfo.pcwszFilePath = cabPath;
    
    memset(&winTrustData, 0, sizeof(winTrustData));
    winTrustData.cbStruct = sizeof(winTrustData);
    winTrustData.dwUIChoice = WTD_UI_NONE;
    winTrustData.fdwRevocationChecks = WTD_REVOKE_NONE;
    winTrustData.dwUnionChoice = WTD_CHOICE_FILE;
    winTrustData.pFile = &fileInfo;
    
    LONG result = WinVerifyTrust(NULL, &actionGuid, &winTrustData);
    return (result == ERROR_SUCCESS);
}

Safe Extraction Practices

public void SafeExtraction(string cabPath, string extractPath)
{
    var cab = new CabInfo(cabPath);
    
    foreach (var file in cab.GetFiles())
    {
        // Validate file path to prevent directory traversal
        string fullPath = Path.Combine(extractPath, file.Name);
        string normalizedPath = Path.GetFullPath(fullPath);
        
        if (!normalizedPath.StartsWith(extractPath))
        {
            throw new InvalidOperationException("Invalid file path in CAB");
        }
        
        // Extract file safely
        file.CopyTo(fullPath);
    }
}

Performance Optimization

Compression Level Selection

Algorithm    Speed      Ratio    Use Case
MSZIP        Fast       Good     General purpose
LZX          Medium     Better   Installation packages
Quantum      Slow       Best     Archive storage

Multi-Threading

// Parallel CAB processing
void ProcessCabinetsParallel(vector<string> cabFiles) {
    vector<thread> workers;
    
    for (const auto& cabFile : cabFiles) {
        workers.emplace_back([cabFile]() {
            ExtractCabinet(cabFile.c_str(), "output\\");
        });
    }
    
    for (auto& worker : workers) {
        worker.join();
    }
}

Troubleshooting

Common Issues

REM CAB file corruption
expand archive.cab -D
REM Lists files without extracting

REM Access denied errors
takeown /f archive.cab
icacls archive.cab /grant %username%:F

REM Invalid CAB format
cabarc L archive.cab
REM Lists contents and verifies format

CAB files remain an important format in Windows environments, offering robust compression, digital signing capabilities, and seamless integration with Microsoft technologies for software distribution and system updates.