Add MSI file validation after download to catch bad downloads early

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1-estudio-Install-TacticalRMM-and-RustDesk.ps1

@@ -29,13 +29,26 @@ function Install-RustDesk {
     # Download
     Write-Host "Downloading ScoutIT Remote Support client..."
     Try {
-        Invoke-WebRequest -Uri $rustdeskDl -OutFile $msiPath
+        Invoke-WebRequest -Uri $rustdeskDl -OutFile $msiPath -UseBasicParsing
     }
     Catch {
         Write-Warning "RustDesk download failed: $($_.Exception.Message)"
         return
     }
 
+    # Verify the downloaded file is a valid MSI (OLE compound doc magic bytes: D0 CF 11 E0)
+    $fileSize = (Get-Item $msiPath).Length
+    Write-Host "Downloaded file size: $fileSize bytes"
+    $magic = [System.IO.File]::ReadAllBytes($msiPath) | Select-Object -First 4
+    $magicHex = ($magic | ForEach-Object { $_.ToString('X2') }) -join ' '
+    Write-Host "File header bytes: $magicHex"
+    if ($magicHex -ne 'D0 CF 11 E0') {
+        Write-Warning "Downloaded file is not a valid MSI (expected D0 CF 11 E0, got $magicHex). Check the download URL."
+        Remove-Item $msiPath -Force -ErrorAction SilentlyContinue
+        return
+    }
+    Write-Host "File verified as valid MSI."
+
     # Silent MSI install
     $msiLog = "$env:SystemRoot\Temp\estudio-scoutit-remotesupport-install.log"
     Write-Host "Installing ScoutIT Remote Support client silently (log: $msiLog)..."

2-estudio-Install-RustDesk-Standalone.ps1

@@ -20,13 +20,26 @@ if ($null -ne $svcCheck) {
 $msiPath = "$env:SystemRoot\Temp\$rustdeskMsi"
 Write-Host "Downloading ScoutIT Remote Support client..."
 Try {
-    Invoke-WebRequest -Uri $rustdeskDl -OutFile $msiPath
+    Invoke-WebRequest -Uri $rustdeskDl -OutFile $msiPath -UseBasicParsing
 }
 Catch {
     Write-Error "Download failed: $($_.Exception.Message)"
     exit 1
 }
 
+# Verify the downloaded file is a valid MSI (OLE compound doc magic bytes: D0 CF 11 E0)
+$fileSize = (Get-Item $msiPath).Length
+Write-Host "Downloaded file size: $fileSize bytes"
+$magic = [System.IO.File]::ReadAllBytes($msiPath) | Select-Object -First 4
+$magicHex = ($magic | ForEach-Object { $_.ToString('X2') }) -join ' '
+Write-Host "File header bytes: $magicHex"
+if ($magicHex -ne 'D0 CF 11 E0') {
+    Write-Error "Downloaded file is not a valid MSI (expected D0 CF 11 E0, got $magicHex). Check the download URL."
+    Remove-Item $msiPath -Force -ErrorAction SilentlyContinue
+    exit 1
+}
+Write-Host "File verified as valid MSI."
+
 # ── Silent MSI install ────────────────────────────────────────────────────────
 $msiLog = "$env:SystemRoot\Temp\estudio-scoutit-remotesupport-install.log"
 Write-Host "Installing ScoutIT Remote Support client silently (log: $msiLog)..."