EXE Compression?

[marxo]

I have and old program and I tried to reshack it but it says it's compressed by an EXE Compressor... How can I see with which one was it compressed (because there are dozen of them)?

Please help ( if you can ) ?

[#rootworm]

PEID, or my favorite PE Tools

if you use PE Tools, go to the Tools menu and choose PE Sniffer.

after you figure out what packed it, you'll need to find a way to unpack it.

if you're lucky it's just UPXed.

Edited November 3, 2006 by #rootworm

[marxo]

It's not UPXed I tested that. Where in PE Tools can I see the compression?

[edit] I found out it was packed by ASPack v2.15 Terror [/edit]

Edited November 3, 2006 by TM0d

[#rootworm]

i've had some pretty good luck with Quick Unpack 1.03, you might give it a try.

the newest version is actually 1.05 so it's hard to track down the 1.03 version, but the older one is much more stable.

the only downside is that it hardly ever finds the correct OEP, so you'll have to figure that out yourself.

(it's pretty much the same OEP detection as PE Tools, so don't rely on that either)

Edited November 3, 2006 by #rootworm

[marxo]

I've found ASPackDie and did the job very nice. So i guess i solved my problem...