Hi all,
Does someone know where I can find some tuto about unpacking thinstall packed programs ?
Tnaks you very much.

Have you, by any chance used the search button at the top of all the forums and read the threads which mention that protection system here? Have you by any chance entered "thinstall" in your favorite search engine and reviewed the material that produces? Are you aware there is a tool out that claims it is a Thinstall unpacker?

Please read the FAQ linked at the bottom of the Forum and follow its advise about what you should do before you post and then come back with a more pointed question, including some discussion about what you have attempted to do to help yourself.

Regards,

Yes i've tried and there is no answer about unpacking.

And you, do you tried to search about unpacking thinstall before posting your "reply" ??

PS : I'm not looking for a tool that unpack, but if it exist a tuts that explain how to unpack this kind of packer by using si or another debugger

Well then I guess you didn't bother to read this thread:

http://www.woodmann.com/forum/showthread.php?t=4921&highlight=thinstall

You haven't looked at the unpacker on Protools and you haven't reviewed all the hits that "thinstall" will get anyone who enters it into a search engine. And, the answer is Yes, I did search about unpacking Thinstall before I replied to your post, that's WHY I had that information.

You are not off to a very good start. Perhaps you want to rethink your approach.

regards,

selecta:

I have read your PM and believe you should keep trying both with your searching and your investigation. Have you gone to the authors site and downloaded their .pdf file and reviewed the information on their site about how their program works? This usually is a good source of information and gives helpful clues on how the program works. You can also download the program and experiment with it and then report back here what you have tried and what you have discovered and where you need further help.

Regards,

Hi,
Well I had dump the packed software with a litle prog in C (call to createProcess/ReadProcessMemory) and using pe-tools i had recreate raw size of the sections so dissassembly is possible with wdasm. Then i've done a loader by using CreateProcess/WriteProcessMemory and it' ok now.

Thanks you for your help,
regards