EXEpack multiple version handling

[w4kfu]

It seems that there are mutiple version of exepack with different headers.

The game Sid-Meiers-Railroad-Tycoon does not have the field skip_len in its header.

Update the tools so that every version is supported

[w4kfu]

Current hack:

36c36
<       unsigned short skip_len;
---
>       //unsigned short skip_len;
138c138,139
<       reloc_length = eh->exepack_size - strlen("Packed file is corrupt") - sizeof (struct exepack_header) - 0x105; /* Unpacker Length */
---
>       //reloc_length = eh->exepack_size - strlen("Packed file is corrupt") - sizeof (struct exepack_header) - 0x105; /* Unpacker Length */
>     reloc_length = eh->exepack_size - strlen("Packed file is corrupt") - sizeof (struct exepack_header) - 0xFF; /* Unpacker Length */
146c147,148
<       reloc = buf_load + ((dh->e_cparhdr + dh->e_cs) * 16 - (eh->skip_len - 1) * 16) + sizeof (struct exepack_header) + 0x105;
---
>       //reloc = buf_load + ((dh->e_cparhdr + dh->e_cs) * 16 - (eh->skip_len - 1) * 16) + sizeof (struct exepack_header) + 0x105;
>     reloc = buf_load + ((dh->e_cparhdr + dh->e_cs) * 16) + sizeof (struct exepack_header) + 0xFF;
244c246,247
<       packed_data_end = exepack_offset - (eh->skip_len - 1) * 16;
---
>       //packed_data_end = exepack_offset - (eh->skip_len - 1) * 16;
>     packed_data_end = exepack_offset;

[Spork-Schivago]

The patch, for me, gets the unpacker to run further, but displays the following output:

SizeFile = 1207A
Header exepack = 111E0
PackedDataStart = 200
PackedDataEnd = 111E0
PackedDataLen = 10FE0
UnpackedDataLen = 18C00
OFFSET = 111DF
UNPACKED
Cannot find string "Packed file is corrupt", is it really EXEPACK ?

I open the exe with HxD and I can find the string, "Packed file is corrupt".

I use Detect-It Easy 2.01 to detect that it is EXEPACKed. Detect-It Easy 2.01 displays the packer as:

EXEPACK(3.69).

I can share the EXE with you if you'd like to investigate further...

[w4kfu]

Yes can you please share it, thx

[w4kfu]

@Spork-Schivago, issue should be fixed, could you please test on your binary? thx!