EXEPACK
(Sample files) |
|||
| Line 9: | Line 9: | ||
It was a part of some development SDKs, and was not a separate product. The compression can be done by the EXEPACK.EXE program, or by a feature integrated into the LINK.EXE program. | It was a part of some development SDKs, and was not a separate product. The compression can be done by the EXEPACK.EXE program, or by a feature integrated into the LINK.EXE program. | ||
| − | |||
| − | |||
Some of the EXE files included with some versions of [[MS-DOS]] were compressed with EXEPACK. | Some of the EXE files included with some versions of [[MS-DOS]] were compressed with EXEPACK. | ||
| + | |||
| + | == Format details == | ||
| + | There seem to be five common versions of EXEPACK-compressed format, made by Microsoft's tools. Some additional rare and patched variants exist. | ||
| + | |||
| + | The size in bytes of the decoder's boilerplate code, measured from the end of the "RB" signature to the end of the "<code>Packed file is corrupt</code>" string, is different in each of the common versions, so it can help to distinguish them. It is 258, 277, 279, 283, or 290. The decoder's bytes are exactly identical for every file of a given common version. | ||
| + | |||
| + | But again, rare variants exist, and the docoder size is not unique when they are taken into account. | ||
| + | |||
| + | See the Identification section below for information that may help to figure out the decoder size. | ||
== Identification == | == Identification == | ||
| Line 21: | Line 28: | ||
The ASCII signature "{{magic|RB}}" appears immediately preceding the start-of-execution point in the file (refer to [[MS-DOS EXE#Special file positions]]). | The ASCII signature "{{magic|RB}}" appears immediately preceding the start-of-execution point in the file (refer to [[MS-DOS EXE#Special file positions]]). | ||
| − | The characteristic error message "{{magic|Packed file is corrupt}}" appears | + | The characteristic error message "{{magic|Packed file is corrupt}}" normally appears 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. The byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the <code>cd 21</code> sequence and the error message. |
== See also == | == See also == | ||
Revision as of 19:30, 28 January 2025
EXEPACK is an executable compression utility by Microsoft. It compresses DOS EXE files using run-length encoding. It was originally written by Reuben Borman.
It was a part of some development SDKs, and was not a separate product. The compression can be done by the EXEPACK.EXE program, or by a feature integrated into the LINK.EXE program.
Some of the EXE files included with some versions of MS-DOS were compressed with EXEPACK.
Contents[hide] |
Format details
There seem to be five common versions of EXEPACK-compressed format, made by Microsoft's tools. Some additional rare and patched variants exist.
The size in bytes of the decoder's boilerplate code, measured from the end of the "RB" signature to the end of the "Packed file is corrupt" string, is different in each of the common versions, so it can help to distinguish them. It is 258, 277, 279, 283, or 290. The decoder's bytes are exactly identical for every file of a given common version.
But again, rare variants exist, and the docoder size is not unique when they are taken into account.
See the Identification section below for information that may help to figure out the decoder size.
Identification
Apparently, bytes 80 00 always appear at offset 16. In other words, the SP field is 128 (refer to MS-DOS EXE#Header structure).
Bytes 10 00 or 12 00 appear at offset 20. In other words, the IP field is 16 or 18.
The ASCII signature "RB" appears immediately preceding the start-of-execution point in the file (refer to MS-DOS EXE#Special file positions).
The characteristic error message "Packed file is corrupt" normally appears 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. The byte sequence cd 21 b8 ff 4c cd 21 that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the cd 21 sequence and the error message.
See also
Software
Compression:
- Microsoft's EXEPACK.EXE (or LINK.EXE with /E or /EXEPACK option) - Included with some development SDKs.
- ANORMAL's DOSEXE collections → Executable Tools Pack → packers/exepack.*
- Microsoft Macro Assembler v5.1 - Includes EXEPACK 4.06 (on Disk 2)
- David Fifield's exepack
Decompression, general:
- unEXEPACK by Samuel Chevet
- David Fifield's exepack
- UNEXEPACK from openKB
- Deark
Decompression, for DOS:
- See Executable compression#Decompression software for some multi-format utilities that support EXEPACK.
- UNEXEPAC by Dan Norstedt. Includes source code.
- UPACKEXE by Fabrice Bellard - Included with LZEXE.
- UnPack (archived) by Tenth Planet Software / Clive Turvey
Patchers:
Sample files
Links
- ModdingWiki: Microsoft EXEPACK
- Website for David Fifield's exepack
- EXEPACK and the A20-Gate, from the OS/2 Museum
