686 lines
30 KiB
Plaintext
686 lines
30 KiB
Plaintext
³
|
|
|
|
³
|
|
Ä ÄÅÄ Ä
|
|
°°Ý °°Ý °°°°°°Ý °°°°°°Ý °°Ý °°Ý °°Ý °°Ý³
|
|
°°Ý °°Ý °°Ý °°Ý °°Ý °°Ý °°Ý °°Ý °°°Ý °°°Ý
|
|
°°Ý °°Ý °°Ý °°Ý °°°°°°Ý °°°°°°Ý °°Ý °°Ý³
|
|
°°Ý °°Ý °°Ý °°Ý °°Ý °°Ý °°Ý °°Ý
|
|
°°°°°°Ý °°Ý °°Ý °°Ý °°Ý °Ý °°°°°°Ý °°°°°°Ý
|
|
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
|
|
|
|
|
|
Written by Ben Castricum
|
|
|
|
May 30, 1995
|
|
|
|
|
|
|
|
This is the documentation belonging to and explaining the use of:
|
|
|
|
|
|
UNP V4.11
|
|
|
|
|
|
Executable file restore utility
|
|
|
|
|
|
|
|
|
|
TABLE OF CONTENTS:
|
|
|
|
DISCLAIMER
|
|
WHAT IS UNP ?
|
|
GENERAL INFO
|
|
HOW TO USE UNP
|
|
MESSAGES
|
|
NOTES ON COMPRESSORS
|
|
REGISTERING UNP
|
|
HEY! UNP IS COMPRESSED!
|
|
WHAT UNP CAN REMOVE
|
|
WHAT UNP CANNOT REMOVE
|
|
CONTACTING ME
|
|
|
|
|
|
Disclaimer
|
|
----------
|
|
Under NO circumstances I can be held responsible for any damage caused by
|
|
files in this or any other package containing programs written by me.
|
|
(That should do it :-)
|
|
|
|
|
|
What is UNP ?
|
|
-------------
|
|
UNP's main purpose is to restore executable files to their original state.
|
|
However it can do more than that. UNP can optimise EXE-headers, remove
|
|
debug information, convert files from one structure to the other, scan
|
|
directories for compressed files, reveal hidden viruses and even make files
|
|
that didn't run anymore run again.
|
|
|
|
|
|
General info
|
|
------------
|
|
Before you start using UNP, I would like to point out a few things which you
|
|
might take into consideration.
|
|
|
|
Compressed EXE files containing an overlay may not work correctly after they
|
|
have been decompressed. Decompression expands the code size of the EXE file
|
|
which also means that the overlay moves up. Some programs do not check where
|
|
the overlay currently is but just use a constant to get the overlay. If this
|
|
is the case, most anything can happen.
|
|
|
|
When you use UNP to convert a file to another structure, please take into
|
|
consideration that the converted program never runs under the exact same
|
|
conditions as it did before. Though these differences are likely not to
|
|
cause any problems with most programs, there are always programs which expect
|
|
just that what is changed by conversion.
|
|
|
|
UNP can do just about anything with files. This definately includes messing
|
|
up your files. For that reason it is always a good idea to have a backup of
|
|
the files your are going to process. Someone suggested to let the -b
|
|
(create backup) option turned on by default. Although this is a good idea,
|
|
it's still not 100% reliable.
|
|
|
|
UNP is not case sensitive in anyway, nor does it care about extensions. This
|
|
however does not mean that it is possible to convert files which are reported
|
|
by UNP to be "binary (.COM)" can all be converted to .EXE files. Files which
|
|
are not really .COM files (e.g. .BAT or .GIF) will not run or view the
|
|
picture when converted and executed.
|
|
|
|
|
|
How to use UNP
|
|
--------------
|
|
If you type UNP without any parameters then you will get the built-in help
|
|
screen of UNP which is explained below.
|
|
|
|
- Commands - These are 1 character long and only one can be specified on the
|
|
command line. It does not really matter where you put it. If no command is
|
|
specified, the E command is used.
|
|
|
|
c = convert to COM file
|
|
Some .EXE files can be converted to .COM files. You can do this by using
|
|
this command. Please note that the resulting file will not automaticly
|
|
have a .COM extention. You should only convert a file when you know
|
|
exactly what you are doing (see general info section).
|
|
|
|
d = make current options default
|
|
Using this command enables you to specify the default options yourself.
|
|
Simply type the options on the commandline you would like to have as
|
|
default and use this command. UNP will modify itself to the settings
|
|
as default. For example to let UNP always create a backup use
|
|
UNP d -b+
|
|
UNP stores the new settings in itself, which means that UNP is self-
|
|
modifying. With most anti-virus programs, this causes some alarm to go
|
|
off. Check your anti-virus program documentation on how to solve this
|
|
problem (see also: Hey! UNP is compressed!)
|
|
|
|
e = expand compressed file (default)
|
|
This command expands the compressed file. If you do not specify a
|
|
command, UNP will use this by default. Using this command without a
|
|
filename will result in unpacking all files in the current directory
|
|
|
|
i = show info only
|
|
If you just want some information about the file, this is the command to
|
|
use. UNP will show all information like the E command but will not
|
|
decompress or write the file back.
|
|
|
|
l = load and save
|
|
This command loads a .COM or .EXE file but does not expand it. It will be
|
|
written back just like a decompressed file would be written back. This is
|
|
useful in case you want to remove an overlay, irrelevant header data or
|
|
optimize the relocation items.
|
|
|
|
m = MarkEXE, insert a file in header
|
|
MarkEXE is a small utility supplied with PROTECT! EXE/COM V5.0. This
|
|
program can add a piece of text to an EXE file in such a way that when the
|
|
file is shown on screen the user can see that piece of text. The 'M'
|
|
command does not exactly do the same as MarkEXE. First it inserts the
|
|
file before the relocation items, this way any EOF markers in the
|
|
relocation items won't screw it up. Second, UNP does not place the same
|
|
piece of text at the end of the code, since I see this as more or less
|
|
screwing up the file.
|
|
|
|
o = copy overlay
|
|
A new (and probably rarely used) command is the overlay copy command.
|
|
With this you can get the overlay from some .EXE file and append to some
|
|
other .EXE file. The idea behind this is that when you use LZEXE as
|
|
compressor, the overlay is removed from the file. With this command you
|
|
can place the overlay back.
|
|
|
|
s = search for compressed files
|
|
When you use this command, only a small list of compressed files matching
|
|
the Infile wildcard will be generated. To save some space on the screen,
|
|
the pathname of the file will not be show. But since UNP does not work
|
|
recursive, it should not be a problem.
|
|
|
|
t = trace executable
|
|
My first attempt to a general unpacker can be found in this command.
|
|
Actually there are 2 different implemtations. The implementation used for
|
|
.COM files will single-step through a program and checking every
|
|
instruction if the original program has been restored. If UNP thinks it
|
|
has, it will stop and write the file back. Unfortunately this is a very
|
|
slow process. The .EXE implementation also single-steps through the file
|
|
but it checks every step to see if a known packer has been revealed. If
|
|
it has found one, it will remove it and write it the resulting file back.
|
|
If the program has not been compressed with a known packer, sooner or
|
|
later some interrupt will be used which UNP will detect and abort the
|
|
tracing.
|
|
|
|
x = convert to EXE file
|
|
Some compressors can only compress .EXE files (like LZEXE). With this
|
|
command you can convert a .COM file to an .EXE file. The resulting file
|
|
will not be written back with an .EXE extension by default. As with the
|
|
.EXE to .COM conversion, be sure you know what you're doing. Not all
|
|
programs can be converted.
|
|
|
|
|
|
- Options - Even more fun can be achieved with specifying options on the
|
|
command line. Options can be passed sepparated (like -a -b -c) but can also
|
|
be combined (like -abc). After each option there can be one of the
|
|
characters "-", "+" or "?". The first turns switches off, the second turns
|
|
them on and the third.. well it turns them on as well. But the real purpose
|
|
of the question mark is to force UNP to ask if it should do something.
|
|
Currently only the -K switch supports this. Options which are not followed
|
|
by one of the mentioned characters work as toggles, which means that using an
|
|
option twice will undo the previous (eg. -a -a has no result). However once
|
|
an option has been turned on with the question mark (like -a?) then you can
|
|
only turn it off by appending a - (like -a-). Still got it? :)
|
|
|
|
-? = help (this screen)
|
|
Suprisingly enough, this switch will let UNP show the built-in helpscreen.
|
|
Any other switch or command used on the same line will be ignored.
|
|
|
|
-a = automatic retry
|
|
It is possible that some files have been processed with some program more
|
|
than once. This switch will make UNP to process the file again when it
|
|
was changed. Useful when you want to uncompress a file which also has
|
|
been Immunized by CPAV.
|
|
|
|
-b = make backup .BAK file of original
|
|
If you want to keep a backup of your original file (very wise) use this
|
|
switch. The original file will be renamed to a file with a .BAK
|
|
extension.
|
|
|
|
-c = ask for confirmation before action
|
|
This will force UNP to ask you if you want to remove the routine UNP found
|
|
on the file each time it has recognized some program's work.
|
|
|
|
-f = optimise fixups (like HDROPT.EXE)
|
|
Relocation items, also known as fixups, are stored in the .EXE header in
|
|
two parts; 16 bits for the segment value and another 16 bits for offset.
|
|
Since DOS only uses 20 bits for addressing, the fixups may contain some
|
|
redundant data. Optimising the fixups does some arithmetic stuff which
|
|
will move as much as possible of the address into the offset and fills the
|
|
segment value with zeros. This is the same as the program HDROPT.EXE
|
|
supplied with PKLITE does.
|
|
|
|
-g = merge overlay into image
|
|
This dirty switch allows you to merge an overlay into the image of an .EXE
|
|
file. I can't think of any reason why someone should use it but it's
|
|
here.
|
|
|
|
-h = remove irrelevant header data
|
|
Most linkers add useless data to the .EXE header. This switch removes all
|
|
such useless information, thus shrinking the header size. This switch
|
|
also skips the header rebuilding code with files like PKLITE.
|
|
|
|
-i = interception of I/O interrupts
|
|
By default UNP watches several DOS interrupt to check if the program is
|
|
running as expected. Any unexpected call to such an interrupt will make
|
|
UNP abort the process. If you have any weird TSRs resident you might have
|
|
to use this switch.
|
|
|
|
-k = pklite signature handling; - = don't add, + = add always, ? = ask
|
|
With this switch you can handle the pklite signature. There are 3
|
|
possibilities :
|
|
-k- = don't add
|
|
The pklite signature will not be added, this will also be the case if
|
|
you only use -k (to stay dislite compatible).
|
|
-k+ = add always
|
|
Always add the pklite signature, this is the default of UNP so you can
|
|
just as well leave the -k switch away if you want this.
|
|
-k? = ask
|
|
When you use this, UNP will ask you each time it has found a signature
|
|
(like UNP V3.01 or earlier did).
|
|
|
|
-l = use large memoryblock
|
|
When UNP loads a program it allocates a block with a size of the
|
|
required memory with about 32k extra for safety. Some programs require
|
|
even much more memory than they tell DOS they need. If such a file is
|
|
decompressed by UNP it definately will go wrong. Two things can happen
|
|
in such a case. The program detects the absence of enough memory and
|
|
will attempt to notify the user by writing a message on screen. This
|
|
will probably result in a "(INT 21) Unexepected call to DOS" error
|
|
(see messages) and UNP will abort gracefully. Or worse, the program
|
|
does not check at all and will try to decompress anyway. This will
|
|
probably result in a system crash or a memory allocation error. If you
|
|
have got a file which requires more memory than it tells DOS, use this
|
|
switch. After identifying the compressed program, UNP will increase
|
|
the allocated memory block to 15/16 of the maximum size of that block.
|
|
|
|
-m = MORE alike output
|
|
On request this switch has been added. It should pause about every screen
|
|
full of information similar like DOS's MORE.EXE.
|
|
|
|
-n = numbered Outfiles
|
|
Also on request is the possibility the have UNP remove several routines
|
|
in one run but keeping a copy of every version. This switch will assign a
|
|
number to the files it writes the new file to. If the file already is
|
|
numbered, it will increment that number. If not, the number 1, possibly
|
|
with leading underscores,will be assigned to it.
|
|
|
|
-o = overwrite output file if it exists
|
|
If you want to have the destination file overwritten, you can avoid the
|
|
question for permission by specifying this switch on the command line.
|
|
|
|
-p = align header data on a page
|
|
It is said that .EXE files with a header size that is a multiple of 512
|
|
bytes load faster (this could make sense since a sector is also 512
|
|
bytes). This switch will expand the header to the nearest multiple of 512
|
|
bytes, filling it with zeros.
|
|
|
|
-r = remove overlay data
|
|
If something is appended to an .EXE it is called an overlay. This switch
|
|
will let the file size of the outfile be the same as the load image. So
|
|
anything that was appended to the file will be thrown away. An overlay
|
|
can be used for all kinds of data, so removing this can result in
|
|
throwing away something useful.
|
|
|
|
-u = update file time/date
|
|
By default UNP sets the time/date of the destination file to the same
|
|
time/date as the original source file. If you want to have it updated to
|
|
the current time/date use this switch.
|
|
|
|
-v = verbose
|
|
When you use this switch UNP will give you some additional information. I
|
|
added this switch for debugging purposes.
|
|
|
|
-- = program's commandline
|
|
Anything after this switch will be passed to the program to be
|
|
decompressed. This way you can pass along any required parameters (like
|
|
passwords) for the Tracing command.
|
|
|
|
|
|
Messages
|
|
--------
|
|
UNP has 6 kinds of messages other than the usual information it can display:
|
|
|
|
- Questions - Even with new smart routines programmed into UNP4 it still
|
|
needs to ask a few things now and then. Who said that computers are smarter
|
|
than you? Anyway, you can expect the following questions:
|
|
|
|
Add code to fake PKLITE decompression (y/n)?
|
|
This question arises when UNP detects that a signature has been placed
|
|
into the program's PSP and the -K switch has the '?' value. (for more
|
|
info, read the "notes on compressors" part)
|
|
|
|
Continue (y/n)?
|
|
When UNP considers a program abnormal it wil display a warning with the
|
|
reason why it thinks so and will ask you if you want to continue anyway.
|
|
|
|
Remove this routine from file (y/n)?
|
|
You have requested confirmation for each action UNP takes (see -C option)
|
|
and this is the result.
|
|
|
|
Program is protected, please enter password:
|
|
Some programs have the ability to scramble executable files with a
|
|
password. Unfortunately I have not succeeded in breaking all protection
|
|
schemes using this. So for certain programs you might be prompted for
|
|
the password
|
|
|
|
File FILENAME.EXT already exists. Overwrite (y/n)?
|
|
When UNP wants to write to the destination file and discovers the file
|
|
already exists, it will ask if you want to overwrite the file. You can
|
|
avoid this question by using the overwrite option (see -O option).
|
|
|
|
- Informal messages - By placing UNP in verbose mode (see -V option) UNP will
|
|
display additional information about anything that might be interesting. Note
|
|
that informal messages allways start with "INFO -".
|
|
|
|
DOS Version X.XX[, running under Windows.]
|
|
Some system information, this has no effect on UNP.
|
|
|
|
Commandline = ...
|
|
This indicates what options are passed for the Init procudere the the main
|
|
module. This is influenced by UNP's commandline.
|
|
|
|
Program's commandline = "...".
|
|
If you have specified anything for the program's commandline
|
|
(see -- option), it will be echoed here.
|
|
|
|
Using FILENAME.EXT as temp file.
|
|
The name of the temporary file UNP will use. This is composed of the TEMP
|
|
environment variable and some constant defined in UNP.
|
|
|
|
Anti-virus program TbScanX detected.
|
|
UNP has detected the resident anti-virus program TbScanX and will use it
|
|
to scan the files before it loads them (also see -s switch).
|
|
|
|
Wildcard matches X filename(s), stored at XXXXh.
|
|
The wildcard specified on the commandline is resolved to a number of files
|
|
and these names has been stored at the specified segment.
|
|
|
|
Program loaded at XXXXh, largest free memory block: X bytes.
|
|
Indicates at which segment UNP is loaded and how large the largest
|
|
available memoryblock is.
|
|
|
|
Adding 'PK' signature to fake PKLITE decompression.
|
|
When UNP automaticly adds the code to fake PKLITE decompression
|
|
(see -K option), it will display this message.
|
|
|
|
Increasing program''s blocksize to X bytes.
|
|
In certain cases UNP will increase the memory given to the program which
|
|
UNP wants to decompress. This can solve problems with programs which
|
|
do not check if they have enough memory. This can be forced with the -L
|
|
option (see -L option).
|
|
|
|
- Warnings - These messages indicate something is wrong but UNP can live with
|
|
it. Warnings will always start with "WARNING -".
|
|
|
|
Infile and Outfile are same, Outfile ignored.
|
|
After UNP has resolved the wildcard it has found out the the file to be
|
|
processed is the same as the destionation file. Since this is the default
|
|
operation of UNP it will ignore the destination file.
|
|
|
|
Outfile specified, -B option ignored.'
|
|
When you have specified a destination file you can't create a backup. This
|
|
is because the backup is created by renaming the original file. When the
|
|
destination file is also specified there would be no original program
|
|
left.
|
|
|
|
-N option overrules -B option, -B option ignored
|
|
You can't number your files and have a backup created as well. It's about
|
|
the same reason as mentioned above.
|
|
|
|
Invalid or missing stored header information.
|
|
Some files store the original header somewhere inside the compressed file.
|
|
When UNP has detected this and the info does not seem to be correct it
|
|
will display this warning.
|
|
|
|
- Errors - UNP has discovered something wrong and cannot continue with the
|
|
current action. It will continue with the next file (when available).
|
|
|
|
(INT 10h) Unexpected use of video interrupt, action failed.
|
|
(INT 20h) Unexpected program termination, action failed.
|
|
(INT 21h) Unexpected call to DOS, action failed.
|
|
UNP watches several interrupts to ensure things are going as expected.
|
|
When UNP loses control it will sooner or later detect one of the
|
|
interrupts it watches and abort the current action. If you think nothing
|
|
went wrong and you got this message anyway, you can disable the interrupt
|
|
watching (see -i switch).
|
|
|
|
Cannot convert, file already is a COM file.
|
|
Cannot convert, file has relocation items.
|
|
Cannot convert, initial CS:IP not FFF0:0100.
|
|
Cannot convert, file is too large for COM.
|
|
Cannot convert, file contains internal overlay.
|
|
Convertion of a .EXE file to .COM file has to meet several conditions.
|
|
When one of these is not met the program will show which one and abort the
|
|
action.
|
|
|
|
- Dos error - Your operating system does not allow something UNP would like
|
|
to do. Simple things like a read-only file or disk full will cause such a
|
|
error. UNP will quit if such an error is encountered. These messages start
|
|
with "DOS ERROR - " and end with the DOS error code.
|
|
|
|
unable to open file ... (error x)
|
|
unable to create file ... (error x)
|
|
unable to read from file ... (error x)
|
|
unable to write to file ... (error x)
|
|
|
|
- Fatal errors - Something seriously wrong has happened. The program will
|
|
abort. These messages will start with "FATAL ERROR - ".
|
|
|
|
No files found matching
|
|
UNP could not resolve the wildcard you specified on the commandline to any
|
|
file. You might want to check the filenames.
|
|
|
|
Decompressing many files into one.
|
|
The Infile wildcard matches more than one file and you have also given a
|
|
destination filename on the commandline.
|
|
|
|
Output path/file must not contain '*' or '?'.
|
|
You can't use wildcards in the destination filename.
|
|
|
|
Outfile required for specified command.
|
|
The command you specified requires 2 filenames and you only gave one.
|
|
|
|
Specified command does not require filenames.
|
|
The command you specified does not allow any filenames at all!
|
|
|
|
(INT 00h) Divide overflow generated by CPU.
|
|
(INT 23h) Ctrl-C or Ctrl-Break pressed by user.
|
|
These interrupts are considered very important and UNP will quit as fast
|
|
as possible when one of these occur.
|
|
|
|
Not enough memory to ...
|
|
UNP could not allocate enough memory for something.
|
|
|
|
Memory Control Blocks destroyed.
|
|
UNP now checks for this special memory error since this error is probably
|
|
caused by a progam that has been giving too few memory. UNP will abort but
|
|
the system will most likely halt immediately after that. You might want
|
|
to try giving the program more memory (see -l switch).
|
|
|
|
|
|
Notes on compressors
|
|
--------------------
|
|
There are a few things about compressors that might usefull to know:
|
|
|
|
AVPACK V1.20
|
|
This Russion compressor has many similaritys with PKLITE. The PKLITE
|
|
routines are used to unpack this compressor. However, it is not as good
|
|
as PKLITE. It reports that files with a size which is a multiple of 512
|
|
bytes contains an overlay and also it only stores the first 20h bytes of
|
|
an exeheader making it impossible to do a complete restore. It does have
|
|
some extra option like encryption. UNP can uncompress encrypted files
|
|
like these although it does not recognize them as such. If you know
|
|
you got an encrypted AVPACKed file you can use "UNP T" to unpack.
|
|
|
|
COMPACK V4.4
|
|
This program does not really contain a bug but more an incompatibility
|
|
error. On 486s, programs compressed with this version of COMPACK will
|
|
crash. This is a result of the self-modifying code COMPACK uses.
|
|
Somewhere at the end of the decompression routine of COMPACKed programs
|
|
there is a far jump to the decompressed program. Initially this jump
|
|
points to 0:0 but is adjusted not much earlier before the execution of
|
|
this instruction. On 386s or lower the prefetch queue is small enough
|
|
to allow this self-modifying code. On 486s however, the read-ahead buffer
|
|
is much larger so the jmp has already been read when the adjustment takes
|
|
place. The result on 486s is that the jmp 0:0 is actually executed, most
|
|
likely causing a system crash. UNP places a breakpoint before the
|
|
execution of this instruction which flushes the read-ahead buffer and the
|
|
program can be saved with the correct entrypoint.
|
|
|
|
EXEPACK
|
|
Ever got the message "Packed file is corrupt"? Then you are probably
|
|
using a memory manager and have lots of conventional memory free. Old
|
|
versions of Microsoft's EXEPACK require atleast one segment (64k) below it
|
|
to be able to unpack the program into memory. If you have a lot of free
|
|
memory, let's say above 600k, then programs can be partially loaded in the
|
|
first segment. This causes EXEPACK to generate this error. UNP loads an
|
|
EXEPACKed file high enough to unpack it and can decompress it without any
|
|
trouble.
|
|
|
|
MEGALITE V1.5
|
|
Like AVPACK, this compression looks very much like PKLITE. This version
|
|
however contains an instruction which changes 1 byte in the decompression
|
|
routine. I have not been able to find out what the use of this
|
|
instruction is. All it seems to do is screw up the code. The instruction
|
|
which causes this is: DEC BYTE PTR DS:[SI+012Ch].
|
|
|
|
MR-LITE
|
|
This utility seems to be floating around in certain circuits. It is
|
|
written to reduce the size of PKLITE size even more. All it does is
|
|
simply rewrite the header and leave all useless information away. In
|
|
fact, it does the same as "UNP l -h". Unfortunately it does not do this
|
|
very well. One of the fields in the .EXE header reports the amount of
|
|
memory required by the application. This value is kindly set to 0 by
|
|
MR-LITE. Because DOS by default allocates all memory available, you will
|
|
not immediately detect this bug. But when unpacking it with UNP you
|
|
will very likely get the message "Memory Control Blocks destroyed.". It
|
|
is adviced to unpack such a file with "UNP E -l" and if you want
|
|
recompress it, optionally you can optimize the header with a "UNP L -h".
|
|
(for more info, see -l switch)
|
|
|
|
PKLITE V1.00á
|
|
Although this program is probably rarely used, I implemented some code
|
|
that fixes a bug that appears in this version of PKLITE only. When
|
|
certain programs are compressed, PKLITE moves the last 512 bytes of the
|
|
image into an overlay. Compressed programs will be decompressed by UNP
|
|
and checked for an overlay of 512 bytes. If such an overlay has been
|
|
found, UNP includes the overlay into the newly created image. This has
|
|
the same result of what would have happened when "PKLITE -x" would have
|
|
been used to restore to program.
|
|
|
|
PKLITE V1.14+ Professional
|
|
These versions of PKLITE have some small piece of code in the
|
|
decompression routine that adds a so called signature into the PSP. This
|
|
allows programs to check if they are still compressed with PKLITE. When
|
|
such a program is unpacked UNP by default adds a small piece of code into
|
|
the PSP to fake the decompression. One of the programs that check for such
|
|
a signature is the PKZIP V2.04g program. (see also -k switch)
|
|
|
|
PKLITE V1.15
|
|
This version does not seem to detect OS2 or Windows files anymore and will
|
|
compress them like normal EXE files. Files will however not run
|
|
correctly, even when UNP has uncompressed them again.
|
|
|
|
PKTINY
|
|
A small utility has been written to prevent recognition (and unpacking)
|
|
of TINYPROGed files. The trick this program uses is very simple.
|
|
TINYPROG has the ability to leave some space in the beginning of an .EXE
|
|
file. By filling this space with a PKLITE header and modifing some code
|
|
to let the program still run correctly, it tries to fool unpackers. If
|
|
UNP detects the modified code it tries to get around it and continue with
|
|
the TINYPROG check.
|
|
|
|
SHRINK V1.00
|
|
This compressor uses the basic RLE (Run Lenghth Encoding) compression
|
|
algorithm to decrease the size of a program. Unfortunately the program
|
|
contains (at least) 2 bugs. One of the bugs is when the RLE byte is found
|
|
followed by a 00 while decompressing, a 00 is placed in the program which
|
|
should be the RLE byte. The second bug is that the last byte of the
|
|
compressed file is not written to disk. Both of these bugs are triggered
|
|
when all 256 bytes appear at least one time in the file. UNP is able to
|
|
correct the first bug, causing most program to work again. However the
|
|
second bug is unrecoverable and UNP give a warning if it detects this bug.
|
|
It is always better to decompress it, even if the last byte is missing.
|
|
|
|
|
|
Registering UNP
|
|
---------------
|
|
Having tried several forms of registration for UNP, I have decided to use the
|
|
following registration method. First, since a lot of support has come from
|
|
the low end user I decided to release UNP as cardware to the public domain.
|
|
It's always nice to know your program is appreciated, and what's the price of
|
|
a simple card compared to the registration fees asked by several others? So
|
|
if you're a happy user of UNP fill in your registration postcard of
|
|
something in your neighbourhood today. However, I have spend a lot of hours
|
|
on this program and since it can be useful for commercial purposes I decided
|
|
that for commercial use a registration of $1 per copy is required. Why so
|
|
cheap you might wonder. Well, I don't want the price to prevent you from
|
|
registering. I do not have to make profit out of it, I am just a student who
|
|
has written a program to teach myself more about DOS. I just as well could
|
|
have been writing viruses but instead I have chosen this. Please note that
|
|
non-commercial users are allowed to send me money anyway! If it is enough to
|
|
buy and mail a disk, you can expect a free special registered version!
|
|
|
|
|
|
Hey! Unp is compressed!
|
|
-----------------------
|
|
Yes, starting with V4.11 of UNP I will use a compressor to make sure lamers
|
|
won't just change the version number and upload it to some BBS just to get
|
|
their ratio higher. UNP is compressed with DIET V1.45f and processed with a
|
|
program I call DSHIELD to prevent decompressing. The traps used are not too
|
|
difficult to figure out, but the idea behind it was just the prevent the
|
|
lamers from hacking. If you succeed in unpacking it, then you are probably
|
|
an experienced programmer. I am sorry but the protection seems to be
|
|
neccesary.
|
|
Due to this protection it might be possible that some anti-virus programs
|
|
which use heuristic scanning consider UNP infected by a new or unknown virus.
|
|
If you also use the D command to alter (some of) UNP's default settings,
|
|
you might get a warning as well. The D command causes UNP to alter it's
|
|
own .EXE file. Check your documention that came along with your anti-virus
|
|
software on how to solve this incompatibility.
|
|
|
|
|
|
What UNP can remove
|
|
-------------------
|
|
Quite a lot actually. A list follows:
|
|
|
|
AINEXE V2.1
|
|
ANTIBODY
|
|
AVPACK V1.20
|
|
AXE V2.2
|
|
CENTRAL POINT ANTI-VIRUS V1, V1.1
|
|
COM2CRP V1.0
|
|
COMLOCK V0.10
|
|
COMPACK V4.4, V4.5
|
|
CRYPTA V1.00
|
|
CRYPTCOM
|
|
DELTAPACKER V0.1
|
|
DIET V1.00, V1.00d, V1.02b, V1.10a, V1.20, V1.44, V1.45f
|
|
ENCRCOM V2.0
|
|
EPW V1.2, V1.21, V1.30
|
|
EXELITE V1.00aF
|
|
EXEPACK V4.00, V4.03, V4.05, V4.06
|
|
F-XLOCK V1.16
|
|
ICE V1.00
|
|
IMPLODE V1.0 Alpha
|
|
KVETCH V1.02á
|
|
LINK /EXEPACK V3.60, V3.64, V3.65, V3.69, V5.01.21
|
|
LZEXE V0.90, V0.91, V1.00a
|
|
MCLOCK V1.2, V1.3
|
|
MEGALITE V1.18a, V1.20a
|
|
OPTLINK
|
|
PACKEXE V1.0
|
|
PACKWIN V1.0à
|
|
PASSCOM V2.0
|
|
PGMPAK V0.13, V0.14, V0.15
|
|
PKLITE V1.00á, V1.00, V1.03, V1.05, V1.12, V1.13, V1.14, V1.15, V1.20, V1.50
|
|
POJCOM V1.0
|
|
PRO-PACK V2.08, V2.14
|
|
PROCOMP V0.82
|
|
PROTECT! EXE/COM V1.0, V1.1, V2.0, V3.0, V3.1, V4.0, V5.0
|
|
SELF-DISINFECT V0.90á
|
|
SHRINK V1.0
|
|
SCRNCH V1.00, V1.02
|
|
SYRINGE
|
|
TINYPROG V1.0, V3.0, V3.3, V3.6, V3.8, V3.9
|
|
TURBO ANTI-VIRUS V7.02A, V9.40
|
|
UCEXE V2.3
|
|
USERNAME V2.00, V2.10, V3.00
|
|
WWPACK V3.00, V3.01, V3.02
|
|
|
|
I have left out a couple of names not really worth mentioning.
|
|
|
|
|
|
What UNP cannot remove
|
|
----------------------
|
|
SPACEMAKER V1.03
|
|
EPW V1.2, V1.21, V1.30 - EXE only
|
|
USERNAME V2.00, V2.10, V3.00 - EXE only
|
|
|
|
|
|
CONTACTING ME
|
|
-------------
|
|
Please note that registrations must be send to my home adress, not to my
|
|
E-mail adress. A card really is a card, not a scanned picture or some
|
|
piece of text.
|
|
|
|
My address:
|
|
Ben Castricum
|
|
Van Loenenlaan 10
|
|
1945 TX Beverwijk
|
|
The Netherlands
|
|
|
|
E-Mail: valid until june '95
|
|
benc@htsa.hva.nl
|
|
|
|
I am not sure when exactly my account will be disabled, but I'll try to
|
|
get a new account somewhere as soon as possible.
|
|
|
|
-- End of UNP V4.11 documentation --
|