Unlike generic archivers, xtool targets specific chunk-based compression methods (e.g., aPLib, LZMA, zlib) used inside installer stubs, decompressing them so that a repackager can later apply more efficient compression. | Feature | Description | |---------|-------------| | Precompression | Decompresses existing compressed blocks inside an installer executable or data file. | | Chunk detection | Automatically finds and extracts compressed streams based on known signatures (e.g., aP for aPLib, LZMA headers). | | Recompression support | Prepares data for tools like FreeArc or 7-Zip to recompress with stronger algorithms. | | Integrity preservation | Maintains original offsets and alignment to avoid breaking installer checksums or overlay signatures. |
Report ID: RE-XTOOL-2025-01 Subject: Analysis of xtool – a precompression and repackaging utility for executable installers Author: Security Research Unit Date: April 14, 2026 1. Executive Summary xtool is a command-line utility developed by the programmer razor12911 (active in communities such as ZenHAX and CS.RIN.RU). Its primary function is to act as a precompressor – a tool that processes compressed data streams within proprietary installer setups (e.g., InnoSetup, InstallShield) to allow recompression with higher ratios or to enable modification of precompressed archives. razor12911 xtool precompression tool
xtool --mode=precompress --in=game_setup.exe --out=precompressed.dat xtool --mode=extract-chunks --in=precompressed.dat --outdir=chunks/ After recompressing chunks externally: | | Recompression support | Prepares data for
| Installer / Format | Compression Methods Supported | |--------------------|-------------------------------| | InnoSetup (v5.x, v6.x) | aPLib, LZMA, zlib (deflate) | | InstallShield (v11+) | zlib, LZX, CabLZ | | MSI (Embedded CABs) | LZMA, zlib | | Custom game archives | Generic chunk detection (heuristic) | Executive Summary xtool is a command-line utility developed