Jump to content

Nullsoft Scriptable Install System

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Викидим (talk | contribs) at 21:12, 25 April 2024 (Added tags to the page using Page Curation (notability, refimprove, third-party)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Nullsoft Scriptable Install System (NSIS) is a software for creating installation programs for the Windows operating system. It was originally developed by Nullsoft, who used the installer for their media player Winamp, among others. Today, NSIS is free software and is licensed under the zlib/libpng License. The source code of NSIS and the downloads are offered through SourceForge, where NSIS was awarded Project of the Month in January 2006.

NSIS itself consists only of a command-line compiler and a graphical user interface for the compiler, which aids in compiling and simplifies some settings. However, several free IDEs for NSIS are available. The most comprehensive one currently is EclipseNSIS, a plug-in for the cross-platform, also free, Eclipse IDE.

When using NSIS in software products, it is not possible to obtain a certification from Microsoft as "Designed for Windows Vista" because NSIS is not capable of generating the necessary Windows Installer files.

Features (Selection)

  • Very small overhead of about 34 KB
  • Compatible with all common Windows operating systems (Windows 95, 98, 2000, 2003, 2008, ME, NT, XP, Vista, 7, 8, 10)
  • Three different compression algorithms (zlib, bzip2, and LZMA), optionally with solid compression
  • 49 languages, including languages written from right to left
  • Plug-in system for nearly unlimited extension of the already extensive features (e.g., there are plug-ins for array operations, advanced mathematical functions, or control of Windows services and processes)
  • Compilation of the installer under Windows or a POSIX compatible system such as Linux or FreeBSD (currently only support for x86 platforms)
  • In addition to a "classic design," also a modern design that closely resembles proprietary installers.

Through the scripting language and the plugin interface, almost unlimited functions can be implemented in self-written installers. This includes managing system services, web-based installations, dynamic updates, repair and rollback functions.

Functionality

An installer is based on a script, where each line is an instruction. The script file is compiled into an executable file containing all files (compressed) and the installation program (script commands) by the command-line compiler "makensis.exe", which can then be easily distributed. MakeNSISW is available as a graphical interface for makensis. 

 ; Example script
 Name "MyExample"
 OutFile "installer.exe"
 SetCompressor lzma
 InstallDir "$PROGRAMFILES\example"
 InstallDirRegKey HKLM "SOFTWARE\example" "installdir"
 LoadLanguageFile "${NSISDIR}\Contrib\Language files\German.nlf"
 Page directory
 Page instfiles
 Section
   SetOutPath $INSTDIR
   File "myexample.exe"
   WriteRegStr HKLM "SOFTWARE\example" "installdir" "$INSTDIR"
   CreateShortCut "$DESKTOP\example.lnk" "$OUTDIR\myexample.exe"
 SectionEnd

The adjacent images show the result of the above script. Using extensions like the "Modern UI" or specific plug-ins, visually appealing installation wizards can also be created.

Thanks to strong compression algorithms and low overhead, very small installers are possible, making NSIS ideal for distributing programs over the Internet.

Security

Installers created with NSIS have security vulnerabilities when an outdated version is used.[1][2][3][4][5][6] Possible security vulnerabilities were closed in versions 2.47[7], 2.50[8], and 2.51[9].

References

  1. ^ FullDisclosure: Executable installers are vulnerable^WEVIL (case 2): NSIS allows remote code execution with escalation of privilege
  2. ^ FullDisclosure: Arbitrary code execution resp. escalation of privilege with Mozilla's SETUP.EXE
  3. ^ FullDisclosure: Executable installers are vulnerable^WEVIL (case 10): McAfee Security Scan Plus, WebAdvisor and CloudAV (Beta)
  4. ^ FullDisclosure: Executable installers are vulnerable^WEVIL (case 11): Nmap <7.01 and Nmap-WinPcap <4.13
  5. ^ Gpg4win: Security Advisory Gpg4win 2015-11-25
  6. ^ Intel: Intel Security – Security Bulletin: Security patch for several McAfee installers and uninstallers
  7. ^ Appendix F: Changelog and Release Notes
  8. ^ Appendix F: Changelog and Release Notes
  9. ^ Appendix F: Changelog and Release Notes
Retrieved from "https://en.wikipedia.org/w/index.php?title=Nullsoft_Scriptable_Install_System&oldid=1220777412"