I have a DOS program that I want to disassemble. IDAFW is telling me it's packed.
Since there are a lot of unpackers, is there a program that can tell me which
one packed it.

Thanks.
Posted on 2004-02-18 12:04:42 by skywalker
you can offen get a clue by looking at the section names.
Posted on 2004-02-18 12:21:05 by ENF
Yup,

Many like PEPack will put their names in the PE file directly after the sections, you have only to open it with a hex editor and check for the name of the packer. Or simply ask the author, if he doesn't mind your disassembling his source he will surely provide the information.
Posted on 2004-02-18 12:34:11 by donkey
And if he does mind you disassembling, you shouldn't be disassembling in the first place ^_^
Posted on 2004-02-18 14:11:53 by f0dder
h**p://download.softpedia.com:8080/UTILE/PEiD.zip
Posted on 2004-02-18 19:19:09 by lingo12
I never seam to be able to get the softpedia pages to load. It just says done in the bottom right of IE.
Posted on 2004-02-18 20:22:19 by ENF
h**p://www.absolutelock.de/construction/files/releases/PEiD.zip
Posted on 2004-02-18 21:48:47 by arkane

h**p://www.absolutelock.de/construction/files/releases/PEiD.zip


Thanks, I should have posted that the packed program is a DOS one that uses a DOS Extender.

PEiD is impressive.
Posted on 2004-02-19 07:18:13 by skywalker

Thanks, I should have posted that the packed program is a DOS one that uses a DOS Extender.

you did post that, but nobody seems to have read it ;)
i'd say check out the utilities section at protools.
Posted on 2004-02-19 11:18:47 by Tola
oops! :grin: Most of the time, I don't read or try to understand the post. I just skim a few lines and random words from the post plus the title and try to make sense with them. I'm really lazy. I believe analysis is sometimes useless and inefficient use of brain cells. :tongue: It makes me feel nerdy and geeky. :grin:

If I found one, I'll let you know. :grin:
Posted on 2004-02-19 11:51:48 by arkane
He wrote DOS, but not 'extender' ^_^ - I think the most used dos extender+packer was pmw/lite (sorry if the name isn't 100% correct, it's been quite a few years), and there's a very well working uncompressed for that floating aorund...
Posted on 2004-02-19 12:16:00 by f0dder


you did post that, but nobody seems to have read it ;)
i'd say check out the utilities section at protools.


Went there. I would like UN-PACK by Snow Panther. 21.IV.2003.
UN-PACK 2.3. but can't find a link to it.

Thanks.
Posted on 2004-02-19 12:26:53 by skywalker
Posted on 2004-02-20 06:45:59 by stormix


Thanks and I liked your saying from Jennifer Anniston.
Posted on 2004-02-20 07:39:01 by skywalker