final unpacked size

[chessgod101]

Here is a quick unpack and rebuild of the exe. It seems to work correctly here. I do not have all of the dependencies, so I cannot thoroughly test it though.

http://rghost.net/43506225

The file was packed with something else prior to the aspack. The mackt section was added when the previous person fixed the IAT after unpacking. Since the new aspack, adata and old mackt sections were no longer needed, I deleted them from the dump and realigned the file with lordpe's rebuilder. Afterwards, I fixed the IAT with scylla 0.8.

[Nacho_dj]

Here is my unpacked.

I have just removed ASPack wrapper, you have got the executable previous to the ASPack compression:

http://www.sendspace.com/file/zr9ura

Note that resources have been rebuilt, now reshacker tool can read them succesfully...

[DMichael]

Originally Posted by chessgod101

Here is a quick unpack and rebuild of the exe. It seems to work correctly here. I do not have all of the dependencies, so I cannot thoroughly test it though.

http://rghost.net/43506225

The file was packed with something else prior to the aspack. The mackt section was added when the previous person fixed the IAT after unpacking. Since the new aspack, adata and old mackt sections were no longer needed, I deleted them from the dump and realigned the file with lordpe's rebuilder. Afterwards, I fixed the IAT with scylla 0.8.

Originally Posted by Nacho_dj

Here is my unpacked.

I have just removed ASPack wrapper, you have got the executable previous to the ASPack compression:

http://www.sendspace.com/file/zr9ura

Note that resources have been rebuilt, now reshacker tool can read them succesfully...

but how you fix the 120mb?

[Nacho_dj]

Most of that huge size is filled with zeroes after dump. So you can decrease raw size in every section to the minimum value multiple of FileAlignment that does not contain exclusively zero bytes...

Of course you have to update also this new raw size in the PE header.

[DMichael]

Originally Posted by Nacho_dj

Most of that huge size is filled with zeroes after dump. So you can decrease raw size in every section to the minimum value multiple of FileAlignment that does not contain exclusively zero bytes...

Of course you have to update also this new raw size in the PE header.

tryed that but my exe got some strange windows error cannot write and read from process ;o