#1
|
||||
|
||||
final unpacked size
i have unpacked asome file packed with aspack now when i dump it it take 120mb ;o i seen that the rawsize of data section its huge! the problem that i cannot cut that section cuz it needed and realign wont work i need to set corret raw size ... but how can i calculate?
|
#2
|
||||
|
||||
Have you tried lordpe's rebuild function? It may be an easy solution to the problem. If you need to calculate the size of the section manually, simply subtract the section's beginning offset from the last byte in the section +1. If there is a section following this one, you can simply subtract the first section's offset from the from the following section's offset. LordPe is the best tool to do this. Just open the section editor and use the built in hex editor to determine what the last byte is. Once you have calculated the size, just use lordpe to change the value.
If you need a video explanation, the following video for protectionPlus unpacking shows you how to calculate raw size manually: Code:
http://tuts4you.com/download.php?view.2115
__________________
"As the island of our knowledge grows, so does the shore of our ignorance." John Wheeler |
#3
|
||||
|
||||
Please could I have a link to download the target (via private message)?
__________________
http://arteam.accessroot.com |
#4
|
||||
|
||||
In very rare cases, ASProtect has an anti-dump which can cause this. Not Aspack, though.
|
#5
|
||||
|
||||
some one know how to deal that anti-dump?
its not first time i see that;o |
#6
|
||||
|
||||
Here is a quick unpack and rebuild of the exe. It seems to work correctly here. I do not have all of the dependencies, so I cannot thoroughly test it though.
Code:
http://rghost.net/43506225
__________________
"As the island of our knowledge grows, so does the shore of our ignorance." John Wheeler Last edited by chessgod101; 02-03-2013 at 08:29. |
The Following User Gave Reputation+1 to chessgod101 For This Useful Post: | ||
Dreamer (02-03-2013) |
#7
|
||||
|
||||
Here is my unpacked.
I have just removed ASPack wrapper, you have got the executable previous to the ASPack compression: HTML Code:
http://www.sendspace.com/file/zr9ura
__________________
http://arteam.accessroot.com |
#8
|
||||
|
||||
Quote:
|
#9
|
||||
|
||||
Most of that huge size is filled with zeroes after dump. So you can decrease raw size in every section to the minimum value multiple of FileAlignment that does not contain exclusively zero bytes...
Of course you have to update also this new raw size in the PE header.
__________________
http://arteam.accessroot.com |
#10
|
||||
|
||||
Quote:
|
#11
|
||||
|
||||
Which 'strange Windows error' are you referring to?
__________________
http://arteam.accessroot.com |
#12
|
||||
|
||||
Quote:
__________________
"As the island of our knowledge grows, so does the shore of our ignorance." John Wheeler |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
minimizng application size | DMichael | General Discussion | 6 | 08-30-2012 12:37 |
Instruction Size | visu | General Discussion | 9 | 05-16-2005 18:23 |
How to reduce the size of dumped exe | atest | General Discussion | 5 | 09-28-2003 18:41 |