Need Help Unpacking Microsoft Visual C++ 6.0 [Overlay]!

[luchardlaw]

Hi guys..i m very new in reverse engineering and i've find myself in trouble unpacking Microsoft Visual C++ 6.0 [Overlay] packed file..can anyone please tell me how to unpack it?which tools do i need to use?

[Git]

You will not unpack it because it is not packed!

Git

[luchardlaw]

i dont get you..what do you mean that the file is not packed?i've scanned it with PEid and it says it is packed with Microsoft Visual C++ 6.0[Overlay]?

[Git]

PEID is telling you that the exe is NOT packed, it is just a straight forward app compiled with Microsoft VC 6.0 and linked in Overlay mode.

Git

[luchardlaw]

i see...then how can i remove the compilation??

[gnerogeem]

Wow, I think you don't even know what your asking rite?
There are some packer such as Crykey that PEiD doesn't identify.
Eventually it will detect it as Microsoft Visual C++ 6.0 [Overlay] packed.

[luchardlaw]

yeah..i m a total newb in reverse engineering...so how do i identified if the file is crypted with Crykey?

[Git]

I have not heard of Crykey. Do you mean CrypKey ?. If so, look for a tool called ckinfo.

Git

[luchardlaw]

erm..is it ok if i post the software here and let you have a look for me?i m not sure whether even the software is packed with Crpkey or not...

[Git]

You need to make some effort yourself first. Go and read tutorials and learn about RE.

Git

[longtruongxuan]

Try detect by "FastScanner v3.0 Final"

[doramide7]

i dont get you..what do you mean that the file is not packed?i've scanned it with PEid and it says it is packed with Microsoft Visual C++ 6.0[Overlay]?

PEID is telling you that the exe is NOT packed, it is just a straight forward app compiled with Microsoft VC 6.0 and linked in Overlay mode.