i have manually unpacked an aspr (new strain) app. i had to do it the hard way as i wasn't able to dump it - icedump, lord pe, procdump failed. what i did:

* dump every section, 3rd one is 52 mb!
* realign 3rd section
* paste all together, pe header from disk
* update pe-header (phys. size and offset of some sections)
* rebuild imports with imprec

the dump is now 1.4 mb and runs fine.

but now i'm unable to get a listing. ida starts and after a while just quits with an error message: EAccess Error. i guess it has to do with the huge virtual size of the 3rd section (0335D000h), but i don't know why.

the sections (sections 1..3 don't have names):

sec1 00001000 0008D000 00001000 0008D000 E0000040
sec2 0008E000 00006000 0008E000 00006000 E0000040
sec3 00094000 0335D000 00094000 0005C000 C0000040
.rsrc 033F1000 0001C000 000F0000 0001C000 C0000040
.text 0340D000 00011000 0010C000 00011000 C0000040
.adata 0341E000 00002000 0011D000 00002000 C0000040

does anybody have an explanation?