Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 08-22-2004, 22:38
c0d4r
 
Posts: n/a
any one know this packer?

i use peid and it display:
Nullsoft PiMP Stub [Nullsoft PiMP SFX] *

is there unpacker for this?
who knows?

i think it is packed with Nullsoft NSIS-Installer.
so how to decompile a nullsoft installer?
someone tell me "it is
impossible to decompile and assemble it",is it true??

more info:
i want to make "kav5.0.149.4_personalen.exe" install on 2k/2k3 server,so.....

Last edited by c0d4r; 08-23-2004 at 16:05.
Reply With Quote
  #2  
Old 08-22-2004, 23:41
2late 2late is offline
Friend
 
Join Date: Nov 2003
Posts: 50
Rept. Given: 5
Rept. Rcvd 6 Times in 3 Posts
Thanks Given: 16
Thanks Rcvd at 12 Times in 10 Posts
2late Reputation: 6
umm

NSIS = Nullsoft Scriptable Install System is a free installer with sources (available at sourceforge.net). Install (or uninstall) exe files made with NSIS have the stub that's shown by PEID ---> Nullsoft PiMP Stub [Nullsoft PiMP SFX] *

As far as I know NSIS itself offers no protection during installation, though uses several selectable compression methods to reduce the size. Hence, I'm a bit curious, why are you trying to unpack it?

Cheers
Reply With Quote
  #3  
Old 08-23-2004, 15:07
taos's Avatar
taos taos is offline
The Art Of Silence
 
Join Date: Aug 2004
Location: In front of my screen
Posts: 580
Rept. Given: 65
Rept. Rcvd 54 Times in 19 Posts
Thanks Given: 69
Thanks Rcvd at 134 Times in 36 Posts
taos Reputation: 54
why do you want decompile a nullsoft install?
Tell us more information...
If you want to get the password for a installation package, download the Nullsoft package (it's free) and study how it's implementing the input of the password and then uses a debugger on the API call's.
Reply With Quote
  #4  
Old 08-24-2004, 05:33
Pibe
 
Posts: n/a
There are voices who tell that it's impossible. But this is not true at all: the truth is just that there isn't a nsis automatic decompiler out there.
This is what Scott told me:
"You can't decompile an NSIS installer, at present, because the decompiler would have to understand all of the different types of binary headers from all of the different versions of NSIS, as well as know how to identify any of them that have had their source modified (since its open source), so, nobody has yet to write this psychic program."

Honestly I think he's right, nobody would write such a general program, but everyone who is interested in reversing a nsis package should examinate the sources and understand how the installer is done.

Well, the only thing that you should discover is the registry and/or config files modifications during the install process, because the files that are copied are clearly available to you after a complete installation, isn't it?

So here's what I'd do, if I were you: I would extract all files simply installing the program on my HD; then I'd take trace of all config changes made during installation, including new or modified registry keys; finally I would use myself the NSIS installer package to re-package everything
Reply With Quote
  #5  
Old 08-24-2004, 22:56
QuickeneR
 
Posts: n/a
Did you try InstallExplorer?
http://plugring.farmanager.com/downld/files/instexpl_v0.3.rar (needs FAR - http://farmanager.com/). It works quite well most of the time.
Reply With Quote
  #6  
Old 09-10-2004, 00:21
JVDB
 
Posts: n/a
Nope. Won't work. Just tried it myself
Reply With Quote
  #7  
Old 09-10-2004, 00:50
QuickeneR
 
Posts: n/a
I'm afraid it's the only unpacker available. As I said, it works most of the time. But it won't handle protected files, especially since NSIS is open source and even contains a comment describing the lines you need to change to make an unpacker's life harder. But if you take the source, a debugger, and a disassembler, it might be possible to unpack the file.
Reply With Quote
  #8  
Old 06-09-2008, 12:26
Molasar Molasar is offline
VIP
 
Join Date: May 2002
Posts: 146
Rept. Given: 176
Rept. Rcvd 13 Times in 9 Posts
Thanks Given: 50
Thanks Rcvd at 10 Times in 8 Posts
Molasar Reputation: 13
Sorry for reviving this old post, but this info can be useful to someone:

Most of the installers made with NSIS can be opened (and extracted) with 7ZIP.
Reply With Quote
The Following 2 Users Say Thank You to Molasar For This Useful Post:
val2032 (01-28-2017)
  #9  
Old 06-14-2008, 13:07
timer
 
Posts: n/a
SFX , some more
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
sys packer emptyHook General Discussion 6 07-24-2012 19:46
New Packer Kyrios General Discussion 3 11-11-2005 16:00
First .NET packer? SystemeD General Discussion 16 06-05-2005 15:15
What packer would you use Fade General Discussion 35 04-03-2004 12:01


All times are GMT +8. The time now is 12:00.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )