Plz help - which installer using this icon...

[micmic]

As in attachment.

Thanks for support!

800.ico

[totoymola]

Hi. I saw some exe's that use that icon before. Why do you need to know? I have a suggestion for you. Download PEiD.

[micmic]

Thank you for tip!

Will try it for sure and looks this tool can help!

I want to unpack patch for "Silent Hunter III" game which is made with this unknown 'yellow icon installer'. ) As patch not leave even short log - unpack is what I need to see what is inside - just to make simply uninstaller for patch.

I knew you know the answer on this forum!

Thanks again totoymola.

I put icon as screenshot too.

Edit:

I test it with with PEiD and get Microsoft Visual C++ 6.0 [Overlay].

Hmmm how to interpret it? How unpack?

[totoymola]

Hi again.

I have a very little knowledge about unpacking, patching, and assembly. Sorry.

Unpacking - This means removing the protection or compression of a PE file (Portable Executable). Some PE files are packed for two major reasons. One is for protection (to help prevent reversing), and the second is to make the file size smaller. There are a lot of packagers/compressors available. Petite and UPX are freewares, and files protected by these tools can be unpacked easily. PECompact, Aspack, Molebox, FSG and others are not free, and you can't easily unpack files protected by them.

Patching - In most cases, this means modifying the PE file. Changing some bytes to fix a bug, or to add/remove a feature. Sometimes it also modifies registry entries. Not all patches work the same.

1. Some patches simply modify the existing file.

2. Some delete the existing and replace it with a new one. (Like Microsoft's patches and hotfixes)

I don't know that game, and I don't know the patch you are using, but I think it modifies the existing file directly. Unfortunately, there is no way to uninstall the patch you applied.

If I were you, this is what I will do.

1. Create a back-up of the original main executable file of the game. (Most patches modifies the main executable)

2. Apply the patch.

3. Download WinHex, install it, and use it to compare the patched and the original file. It will show you the differences between the two files (if there's any).

I test it with with PEiD and get Microsoft Visual C++ 6.0 [Overlay].

Hmmm how to interpret it? How unpack?

You don't have to unpack it, because it's not packed.

Tip:

Download RegMon and FileMon from systeminternals and use them to monitor the changes made by the patch.

[micmic]

Thanks again for ideas. I'll try with Regmon & Filemon and will look what files was altered. Well - finally I found which aplication make this patch!

It is called "Patch Maker" from Clickteam company.

http://www.clickteam.com/English/index.php

http://www.clickteam.com/English/patch_maker.htm

Program (really tiny) make installers/patchers and do it very well... It use some kind of compression (unfortunately it is not public known as I understood on their forum) + its exe can be highly restricted (about checking existing files, paths etc). Dunno nothing about command line - maybe there is syntax for force unpack. The worst is for me, as they mention - their program can change only part of patched file. And in that case files are useless for my purpose... But maybe devteams not using this ability. Dunno. Have to check this, but can only when unpack this patch.

And - as I'm not deep into those things too - I was prolly misunderstand before. By unpack I mean only files which are in patcher. All I want is to get all those files (some tga pictures, cfg, txt etc) that are packed into installer. Nothing more. I'm not reverse engineer or something and my knowledge is really poor.

Well - if u want to try yourself and help me, than please try to get files which are packed inside this file:

http://patches.ubi.com/silent_hunter_3/sil...vd_1.3_emea.exe

it is 15,5 MB

[totoymola]

Yeah!! I know that patch! Alcohol Soft uses that to patch Alcohol 120%.

I really want to try it and help you out, but I don't have the game.