Log in

View Full Version : how to tell which packer used on *.exe


()whore
November 29th, 2000, 15:39
Well the title says it all. I have stumbled onto a target MP3 Navigator that is proving difficult. It is obviously packed but I haven't been able to figure out what program it is packed with. GetType didn't recognize it.
If anyone wants to look at MP3 Navigator it seams quite well protected. Not only is it packed but it shuts down reg mon and file mon when it is run. And it does some kind of CRC checking. When I tried to change things in the PEheader it gave me "this program has been tampered with" message.
I think if I could get it unpacked I could gut this bastard but need some help getting that done.
thanks

meRlin
November 29th, 2000, 16:11
Hi,
Well the first and the most easy way you can find out wich packer that have been used, open target file in your hexeditor and take a look at the header or use quickview or ..... the list is long.
As those packers delete some section names you can only tell wich one thats been used at a specific target if you unpack them as they appear or as you did, ask someone who should know.
If this link is leading to your target (updated today) http://www.vertexlab.com I should guess it's packed with some ASPack/ASProtect.

sorry for my bad english

regards
meRlin

hz
November 29th, 2000, 17:35
hi,
language2000 at protools is a good util, recognises most (not all), upto the new asprotect. If it is asprotect get Casper while your there.

Hi MeRlin, how's it going.