Thinstall unpacking

[MANtiCORE]

so ... and what about several exe's and dll's? how it dump? ... I try to unpack Thinstall.exe and get only first .exe file

[N0P]

Originally Posted by MANtiCORE

so ... and what about several exe's and dll's? how it dump? ... I try to unpack Thinstall.exe and get only first .exe file

thinstall create virtual filestystem an hook some function such as CreateFile ReadFile ... you could BPX on it and dump ...

I also unpacked Reason demo, really all you have to do it look thru memory, every file needed is unpacked in memory. PE Files start with "MZ", just keep looking for PE headers, and when you find one, get the PE size, and then select the whole memory block that you need. Them dump it using LordPE. The filename will usually be contained inside the particular EXE / DLL you are dumping as well, so you can name it correctly.

So with Olly or SoftICE (SoftICE might be easier) you can just scroll up thru memory of the Reason process and see each seperate EXE/DLL and dump them one at a time.

-Lunar