Coder's Guild Mailing List

Re: compressed executables

Posted by Bernie Siegrist on 2001-01-02

> Date: Sun, 31 Dec 2000 19:13:01 -0500
 > From: "Frank Hale" <frankhale@xxxxxxxx.xxx>
 >
 > I've got a small 3k DOS COM file which I think is compressed. Is there
 > anyway to tell by looking at it in a Hex Editor?

Most compressors have some human-readable signature in their decompression 
code. Ofcourse you have to know most of the signatures in order to "see" 
them. :-)
Alternatively you might want to try an unpacker or something. A good place 
to start is http://www.suddendischarge.com. Or, if it's a one-time problem, 
send me the file and I'll try my best.
If you're stuck to a hex editor (for whatever reason), check if the file 
contains any clear-text messages, or search it for code that is likely to 
occur, e.g. "B4 ** CD 21" (the asterisks denoting an unknown byte). Don't 
check the first 256..512 bytes (<--decompression code).