Back to home page

DOS ain't dead

Forum index page

Log in | Register

Search:  
Back to the forum
Board view  Mix view

speedsys.exe packed (Users)

posted by ecm Homepage E-mail, Düsseldorf, Germany, 13.04.2025, 14:32

> > You mentioned that the executable that you've used is
> > packed:
> >
> > > Now I'd like to know how to patch (skip)
> > > this IO access at runtime by some TSR or
> > > loader as I cannot patch the EXE coz it's
> > > encrypted or packed by unknown exe
> > > packer... Speedsys checks for V86 mode and
> > > complains about it (can run but very
> > > limitest tests available)
> >
> > If it's created by
> >
> speedin1
> > then it's just a DOS/EXE UPX with the "UPX!" signature (offset 55h) and
> the
> > depacked size (offset 6Bh) hacked. You can restore the signature
> manually
> > then adjust the checksum (offset 6Fh).
> > UPXDUMP can tell
> you
> > the current and expected checksum. After hacking the size and checksum
> to
> > mirror the speedin1 modification I was able to unpack an executable
> using
> > upx-ucl -d test.exe, despite the wrong size field.
>
> Hmm, the speedsys.exe file in
> https://www.philscomputerlab.com/dos-benchmark-pack.html isn't packed in
> this way.
I did try to hack 55h to "UPX!" and then adjusted the checksum at offset 6Fh and it seems to depack using upx-ucl -d. I didn't run the resulting executable but it seems fine. So maybe it is packed the same way after all, just different garbage in the hacked fields?

---
l

Post reply
 

Complete thread:

Back to the forum
Board view  Mix view
22477 Postings in 2087 Threads, 400 registered users, 123 users online (0 registered, 123 guests)
DOS ain't dead | Admin contact
RSS Feed
powered by my little forum