{"success":true,"data":{"ext":"msp","name":"Windows Installer Patch","description":"Windows Installer Patch (MSP) is a patch package format created and maintained by Microsoft for updating software installed through Windows Installer. It is used to apply fixes, feature updates, and administrative changes to existing applications, commonly alongside enterprise deployment and software maintenance tools. Because patches can modify installed programs and may run with elevated privileges, files from untrusted sources should be handled cautiously; the format remains in use but is largely associated with legacy Windows deployment workflows.","mime":["application/x-ms-installer"],"risk_level":"High","signatures":[{"hex":"D0 CF 11 E0 A1 B1 1A E1","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["msi"],"usage":{"python":"def is_msp(file_path: str) -> bool:\n    \"\"\"Check if file is a valid MSP by magic bytes.\"\"\"\n    signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])\n    with open(file_path, \"rb\") as f:\n        return f.read(8) == signature","node":"function isMSP(buffer: Buffer): boolean {\n  const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);\n  return buffer.subarray(0, 8).equals(signature);\n}","go":"func IsMSP(data []byte) bool {\n    signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}\n    if len(data) < 8 {\n        return false\n    }\n    return bytes.Equal(data[:8], signature)\n}"}}}