View Single Post
  #5  
Old 08-11-2003, 19:50
dynio
 
Posts: n/a
Rhodium: Koncol is suggesting You use UPX as unpacker (switch -d does that). Then You'll know almost for sure if it is UPX'ed.

I haven't seen this file but:

1. The signatures sometimes are the same for various packers/protectors (just try to protect Your executable with ExeShield and scan with ANY scanner. You will always get: PeCompact(!)). So, it's possible that it can be badly recognized.
2. Sometimes unpackers doesn't work as thay should
3. Sometimes coders are modyfiyng specific structures just to fail automatic unpackers (and that's the most common for free packers, especially UPX).
4. Author could set another, own envelope, after first unpack.
5. Bla bla
6. ...

Ok. I suggest You to dump the file from memory then rebuild everything. If someone is using UPX, there is 98% possibility it's a piece of cake. Just try dumping...

Regards.
Reply With Quote