I did some digging with Orca.
It seems the masthead info is in the Registry table of the MSI.
- RegistryMasthead
- SOFTWARE\BigFix\EnterpriseClient\GlobalOptions
- ActionMasthead
- RegistrySiteURL
- SOFTWARE\BigFix\ClientComplianceAPI
- SiteURL
- Registry3
- SOFTWARE\BigFix\EnterpriseClient\Settings\Client__RelayServer1
There is also a MASTHEADFILE
entry in the MSI property table
The SOFTWARE\BigFix\EnterpriseClient\GlobalOptions\ActionMasthead
value seems to be very close to the size of the contents of the masthead file in a hexadecimal representation with #x
on the front.
With some further digging, I think this is exactly it:
("#x" & it) of (it as hexadecimal) of concatenations of (characters it) of bytes (integers in(0,size of it)) of files "C:\Program Files (x86)\BigFix Enterprise\BES Installers\Server\actionsite.afxm"
This seems to go in the ActionMasthead
value in the SOFTWARE\BigFix\EnterpriseClient\GlobalOptions\ActionMasthead
32bit reg key.