Unpack an EXE file
Certain .EXE file may have been packed to prevent disassembling. Packed file when open up in Interactive Disassembler (IDA) may show the following prompt:
The imports segment seems to be destroyed. This MAY mean that the file was packed or modified in order to make it more difficult to analyze. If you want to see the imports segment in the original form, please reload it with the ‘make imports section’ checkbox cleared.
OR
Some imported functions will not visible. This happened because the IAT is located in a non-standard sections. Please reload the input file in the manual mode and load all sections.
To unpack a file packed with PECompact, try Un2Pec. Source code, compiled with MASM32, is also included.
See also:
