What’s in a Patch

Windows Installer relies on structured storage for information about the installation package and to store data used by the installation such as any Binary types and cabinet files. Patches (.msp files) are no different in structure but will contain different data.

Up until Windows Installer 3.0, patches themselves didn’t contain any standard tables but could contain user tables. For Windows Installer 3.0 the tables MsiPatchSequence and MsiPatchMetadata could be added as meaningful tables. What patches have always contained, though, was a set of sub-storages for each transform that transforms the target installer package (.msi file) to the upgraded installer package, and possibly a stream for a single cabinet file that contained the patched files, either in whole or in part as delta patches. Like all Windows Installer files, patches also contain a summary information stream, but some properties mean different things like the Revision Number summary property which contains only the patch code prior to Windows Installer 2.0, and contains the patch code followed by a list of patch codes to obsolete.

The transforms embedded in patches contain all the differences between a certain target and upgrade package. If you’re using PatchWiz.dll, a transform is created for each corresponding row in the TargetImages and UpgradeImages tables. If you use a SQL expression to select from the temporary _Storages table you can enumerate all sub-storages within the package, which will list two transforms for each corresponding target and upgrade package. One transform is the actual difference between the target and upgrade packages, while the other transform beginning with ‘#’ adds entries to the Patch, PatchPackage, Media, InstallExecuteSequence, and the AdminExecuteSequence tables. This transform is not applied to administrative installation images because the patch is merged directly into the installer package so no patch-specific data is required.

Below you can see a basic representation of an MSP file, though an MSI, MSM (merge module), or PCP (patch creation properties) file has the same structure though they don’t typically contain transforms but can.

MSP File Structure