Written by Ben Castricum
January 26, 1995
This is the documentation belonging to and explaining the use of:
Executable file restore utility
TABLE OF CONTENTS:
WHAT IS UNP ?
HOW TO USE UNP
BUGS OF WHICH UNP IS ABLE TO FIX
NOTES ON COMPRESSORS
HEY! UNP IS COMPRESSED!
WHAT UNP CAN REMOVE
WHAT UNP CANNOT REMOVE
Under NO circumstances I can be held responsible for any damage caused by
files in this or any other package containing programs written by me.
(That should do it 🙂
What is UNP ?
UNP's main purpose is to restore executable files to their original state.
However it can do more than that. UNP can optimise EXE-headers, remove
debug information, convert files from one structure to the other, scan
directories for compressed files, reveal hidden viruses and even make files
that didn't run anymore run again.
Before you start using UNP, I would like to point out a few things which you
might take into consideration.
Compressed EXE files containing an overlay may not work correctly after they
have been decompressed. Decompression expands the code size of the EXE file
which also means that the overlay moves up. Some programs do not check where
the overlay currently is but just use a constant to get the overlay. If this
is the case, most anything can happen.
When you use UNP to convert a file to another structure, please take into
consideration that the converted program never runs under the exact same
conditions as it did before. Though these differences are likely not to
cause any problems with most programs, there are always programs which expect
just that what is changed by conversion.
UNP can do just about anything with files. This definately includes messing
up your files.For that reason it is always a good idea to have a backup of
the files your are going to process. Someone suggested to let the -b
(create backup) option turned on by default. Although this is a good idea,
it's still not 100% reliable.
UNP is not case sensitve in anyway, nor does it care about extensions. This
however does not mean that it is possible to convert files which are reported
by UNP to be "binary (.COM)" can all be converted to .EXE files. Files which
are not really .COM files (e.g. .BAT or .GIF) will not run or view the
picture when converted and executed.
How to use UNP
If you type UNP without any parameters then you will get the built-in help
screen of UNP which is explained below.
- Commands - These are 1 character long and only one can be specified on the
command line. It does not really matter where you put it. If no command is
specified, the E command is used.
c = convert to COM file
Some .EXE files can be converted to .COM files. You can do this by using
this command. Please note that the resulting file will not automaticly
have a .COM extention. You should only convert a file when you know
exactly what you are doing (see general info section).
d = make current options default
Using this command enables you to specify the default options yourself.
Simply type the options on the commandline you would like to have as
default and use this command. UNP will modify itself to the settings
as default. For example to let UNP always create a backup use
UNP d -b+
e = expand compressed file (default)
This command expands the compressed file. If you do not specify a
command, UNP will use this by default. Using this command without a
filename will result in unpacking all files in the current directory
i = show info only
If you just want some information about the file, this is the command to
use. UNP will show all information like the E command but will not
decompress or write the file back.
l = load and save
This command loads a .COM or .EXE file but does not expand it. It will be
written back just like a decompressed file would be written back. This is
useful in case you want to remove an overlay, irrelevant header data or
optimize the relocation items.
m = MarkEXE, insert a file in header
MarkEXE is a small utility supplied with PROTECT! EXE/COM V5.0. This
program can add a piece of text to an EXE file in such a way that when the
file is shown on screen the user can see that piece of text. The 'M'
command does not exactly do the same as MarkEXE. First it inserts the
file before the relocation items, this way any EOF markers in the
relocation items won't screw it up. Second, UNP does not place the same
piece of text at the end of the code, since I see this as more or less
screwing up the file.
o = copy overlay
A new (and probably rarely used) command is the overlay copy command.
With this you can get the overlay from some .EXE file and append to some
other .EXE file. The idea behind this is that when you use LZEXE as
compressor, the overlay is removed from the file. With this command you
can place the overlay back.
s = search for compressed files
When you use this command, only a small list of compressed files matching
the Infile wildcard will be generated. To save some space on the screen,
the pathname of the file will not be show. But since UNP does not work
recursive, it should not be a problem.
t = trace executable
My first attempt to a general unpacker can be found in this command.
Actually there are 2 different implemtations. The implementation used for
.COM files will single-step through a program and checking every
instruction if the original program has been restored. If UNP thinks it
has, it will stop and write the file back. Unfortunately this is a very
slow process. The .EXE implementation also single-steps through the file
but it checks every step to see if a known packer has been revealed. If
it has found one, it will remove it and write it the resulting file back.
If the program has not been compressed with a known packer, sooner or
later some interrupt will be used which UNP will detect and abort the
x = convert to EXE file
Some compressors can only compress .EXE files (like LZEXE).With this
command you can convert a .COM file to an .EXE file. The resulting file
will not be written back with an .EXE extension by default.As with the
.EXE to .COM conversion, be sure you know what you're doing. Not all
programs can be converted.
- Options - Even more fun can be achieved with specifying options on the
command line. Options can be passed sepparated (like -a -b -c) but can also
be combined (like -abc). After each option there can be one of the
characters "-", "+" or "?". The first turns switches off, the second turns
them on and the third.. well it turns them on as well. But the real purpose
of the question mark is to force UNP to ask if it should do something.
Currently only the -K switch supports this. Options which are not followed
by one of the mentioned characters work as toggles, which means that using an
option twice will undo the previous (eg. -a -a has no result). However once
an option has been turned on with the question mark (like -a?) then you can
only turn it off by appending a - (like -a-). Still got it? 🙂
-? = help (this screen)
Suprisingly enough, this switch will let UNP show the built-in helpscreen.
Any other switch or command used on the same line will be ignored.
-a = automatic retry
It is possible that some files have been processed with some program more
than once. This switch will make UNP to process the file again when it
was changed. Useful when you want to uncompress a file which also has
been Immunized by CPAV.
-b = make backup .BAK file of original
If you want to keep a backup of your original file (very wise) use this
switch. The original file will be renamed to a file with a .BAK
-c = ask for confirmation before action
This will force UNP to ask you if you want to remove the routine UNP found
on the file each time it has recognized some program's work.
-f = optimise fixups (like HDROPT.EXE)
Relocation items, also known as fixups, are stored in the .EXE header in
two parts; 16 bits for the segment value and another 16 bits for offset.
Since DOS only uses 20 bits for addressing, the fixups may contain some
redundant data. Optimising the fixups does some arithmetic stuff which
will move as much as possible of the address into the offset and fills the
segment value with zeros. This is the same as the program HDROPT.EXE
supplied with PKLITE does.
-g = merge overlay into image
This dirty switch allows you to merge an overlay into the image of an .EXE
file. I can't think of any reason why someone should use it but it's
-h = remove irrelevant header data
Most linkers add useless data to the .EXE header. This switch removes all
such useless information, thus shrinking the header size. This switch
also skips the header rebuilding code with files like PKLITE.
-i = interception of I/O interrupts
By default UNP watches several DOS interrupt to check if the program is
running as expected. Any unexpected call to such an interrupt will make
UNP abort the process. If you have any weird TSRs resident you might have
to use this switch.
-k = pklite signature handling; - = don't add, + = add always, ? = ask
With this switch you can handle the pklite signature. There are 3
-k- = don't add
The pklite signature will not be added, this will also be the case if
you only use -k (to stay dislite compatible).
-k+ = add always
Always add the pklite signature, this is the default of UNP so you can
just as well leave the -k switch away if you want this.
-k? = ask
When you use this, UNP will ask you each time it has found a signature
(like UNP V3.01 or earlier did).
-l = use large memoryblock
When UNP loads a program it allocates a block with a size of the
required memory with about 32k extra for safety. Some programs require
even much more memory than they tell DOS they need.If such a file is
decompressed by UNP it definately will go wrong. Two things can happen
in such a case. The program detects the absence of enough memory and
will attempt to notify the user by writing a message on screen. This
will probably result in a "(INT 21) Unexepected call to DOS" error
(see messages) and UNP will abort gracefully. Or worse, the program
does not check and will try to decompress anyway. This will probably
result in a system crash or a memory allocation error. If you have got
a file which requires more memory than it tells DOS, use this switch.
After identifying the compressed program, UNP will increase the
allocated memory block to 15/16 of the maximum size of that block.
-m = MORE alike output
On request this switch has been added. It should pause about every screen
full of information similar like DOS's MORE.EXE.
-n = numbered Outfiles
Also on request is the possibility the have UNP remove several routines
in one run but keeping a copy of every version. This switch will assign a
number to the files it writes the new file to. If the file already is
numbered, it will increment that number. If not, the number 1, possibly
with leading underscores,will be assigned to it.
-o = overwrite output file if it exists
If you want to have the destination file overwritten, you can avoid the
question for permission by specifying this switch on the command line.
-p = align header data on a page
It is said that .EXE files with a header size that is a multiple of 512
bytes load faster (this could make sense since a sector is also 512
bytes). This switch will expand the header to the nearest multiple of 512
bytes, filling it with zeros.
-r = remove overlay data
If something is appended to an .EXE it is called an overlay. This switch
will let the file size of the outfile be the same as the load image. So
anything that was appended to the file will be thrown away.An overlay
can be used for all kinds of data, so removing this can result in
throwing away something useful.
-u = update file time/date
By default UNP sets the time/date of the destination file to the same
time/date as the original source file. If you want to have it updated to
the current time/date use this switch.
-v = verbose
When you use this switch UNP will give you some additional information. I
added this switch for debugging purposes.
-- = program's commandline
Anything after this switch will be passed to the program to be
decompressed. This way you can pass along any required parameters (like
passwords) for the Tracing command.
UNP has 6 kinds of messages other than the usual information it can display:
- Questions - Even with new smart routines programmed into UNP4 it still
needs to ask a few things now and then. Who said that computers are smarter
than you? Anyway, you can expect the following questions:
Add code to fake PKLITE decompression (y/n)?
This question arises when UNP detects that a signature has been placed
into the program's PSP and the -K switch has the '?' value. (for more
info, read the "notes on compressors" part)
When UNP considers a program abnormal it wil display a warning with the
reason why it thinks so and will ask you if you want to continue anyway.
Remove this routine from file (y/n)?
You have requested confirmation for each action UNP takes (see -C option)
and this is the result.
Program is protected, please enter password:
Some programs have the ability to scramble executable files with a
password. Unfortunately I have not succeeded in breaking all protection
schemes using this. So for certain programs you might be prompted for
File FILENAME.EXT already exists. Overwrite (y/n)?
When UNP wants to write to the destination file and discovers the file
already exists, it will ask if you want to overwrite the file. You can
avoid this question by using the overwrite option (see -O option).
- Informal messages - By placing UNP in verbose mode (see -V option) UNP will
display additional information about anything that might be interesting. Note
that informal messages allways start with "INFO -".
DOS Version X.XX[, running under Windows.]
Some system information, this has no effect on UNP.
Commandline = ...
This indicates what options are passed for the Init procudere the the main
module. This is influenced by UNP's commandline.
Program's commandline = "...".
If you have specified anything for the program's commandline
(see -- option), it will be echoed here.
Using FILENAME.EXT as temp file.
The name of the temporary file UNP will use. This is composed of the TEMP
environment variable and some constant defined in UNP.
Anti-virus program TbScanX detected.
UNP has detected the resident anti-virus program TbScanX and will use it
to scan the files before it loads them (also see -s switch).
Wildcard matches X filename(s), stored at XXXXh.
The wildcard specified on the commandline is resolved to a number of files
and these names has been stored at the specified segment.
Program loaded at XXXXh, largest free memory block: X bytes.
Indicates at which segment UNP is loaded and how large the largest
available memoryblock is.
Adding 'PK' signature to fake PKLITE decompression.
When UNP automaticly adds the code to fake PKLITE decompression
(see -K option), it will display this message.
Increasing program''s blocksize to X bytes.
In certain cases UNP will increase the memory given to the program which
UNP wants to decompress. This can solve problems with programs which
do not check if they have enough memory. This can be forced with the -L
option (see -L option).
- Warnings - These messages indicate something is wrong but UNP can live with
it. Warnings will always start with "WARNING -".
Infile and Outfile are same, Outfile ignored.
After UNP has resolved the wildcard it has found out the the file to be
processed is the same as the destionation file. Since this is the default
operation of UNP it will ignore the destination file.
Outfile specified, -B option ignored.'
When you have specified a destination file you can't create a backup. This
is because the backup is created by renaming the original file. When the
destination file is also specified there would be no original program
-N option overrules -B option, -B option ignored
You can't number your files and have a backup created as well. It's about
the same reason as mentioned above.
Invalid or missing stored header information.
Some files store the original header somewhere inside the compressed file.
When UNP has detected this and the info does not seem to be correct it
will display this warning.
- Errors - UNP has discovered something wrong and cannot continue with the
current action. It will continue with the next file (when available).
(INT 10h) Unexpected use of video interrupt, action failed.
(INT 20h) Unexpected program termination, action failed.
(INT 21h) Unexpected call to DOS, action failed.
UNP watches several interrupts to ensure things are going as expected.
When UNP loses control it will sooner or later detect one of the
interrupts it watches and abort the current action. If you think nothing
went wrong and you got this message anyway, you can disable the interrupt
watching (see -i switch).
Cannot convert, file already is a COM file.
Cannot convert, file has relocation items.
Cannot convert, initial CS:IP not FFF0:0100.
Cannot convert, file is too large for COM.
Cannot convert, file contains internal overlay.
Convertion of a .EXE file to .COM file has to meet several conditions.
When one of these is not met the program will show which one and abort the
- Dos error - Your operating system does not allow something UNP would like
to do. Simple things like a read-only file or disk full will cause such a
error. UNP will quit if such an error is encountered. These messages start
with "DOS ERROR - " and end with the DOS error code.
unable to open file ... (error x)
unable to create file ... (error x)
unable to read from file ... (error x)
unable to write to file ... (error x)
- Fatal errors - Something seriously wrong has happened. The program will
abort. These messages will start with "FATAL ERROR - ".
No files found matching
UNP could not resolve the wildcard you specified on the commandline to any
file. You might want to check the filenames.
Decompressing many files into one.
The Infile wildcard matches more than one file and you have also given a
destination filename on the commandline.
Output path/file must not contain '*' or '?'.
You can't use wildcards in the destination filename.
Outfile required for specified command.
The command you specified requires 2 filenames and you only gave one.
Specified command does not require filenames.
The command you specified does not allow any filenames at all!
(INT 00h) Divide overflow generated by CPU.
(INT 23h) Ctrl-C or Ctrl-Break pressed by user.
These interrupts are considered very important and UNP will quit as fast
as possible when one of these occur.
Not enough memory to ...
UNP could not allocate enough memory for something.
Memory Control Blocks destroyed.
UNP now checks for this special memory error since this error is probably
caused by a progam that has been giving too few memory. UNP will abort but
the system will most likely halt immediately after that. You might want
to try giving the program more memory (see -l switch).
Bugs of which UNP is able to fix
This program does not really contain a bug but more an incompatibility
error.On 486s, programs compressed with this version of COMPACK will crash.
This is a result of the self-modifying code COMPACK uses. Somewhere at the
end of the decompression routine of COMPACKed programs there is a far jump to
the decompressed program. Initially this jump points to 0:0 but is adjusted
not much earlier before the execution of this instruction. On 386s or lower
the prefetch queue is small enough to allow this self-modifying code. On
486s however, the read-ahead buffer is much larger so the jmp has already
been read when the adjustment takes place. The result on 486s is that the
jmp 0:0 is actually executed, most likely causing a system crash. UNP places
a breakpoint before the execution of this instruction which flushes the
read-ahead buffer and the program can be saved with the correct entrypoint.
Ever got the message "Packed file is corrupt"? Then you are probably
using a memory manager and have lots of conventional memory free.
Microsoft's EXEPACK requires to have atleast one segment (64k) below it to be
able to unpack the program into memory. If you have a lot of free memory,
let's say above 600k, then programs can be partially loaded in the first
segment. This causes EXEPACK to generate this error. UNP loads an exepacked
file high enough to unpack it and can decompress it without any trouble.
Although this program is probably rarely used, I implemented some code
that fixes a bug that appears in this version of PKLITE only. When certain
programs are compressed, PKLITE moves the last 512 bytes of the image into an
overlay. Compressed programs will be decompressed by UNP and checked for an
overlay of 512 bytes. If such an overlay has been found, UNP includes the
overlay into the newly created image. This has the same result of what would
have happened when "PKLITE -x" would have been used to restore to program.
This compressor is a bad implementation of Run Length compression. It
contains two bugs of which one is in the decompression routine. Both bugs
are triggered when the file to be compressed contains all 256 bytes. I have
written my own decompression routine for this compressor that is able to
avoid one bug.The other bug is that the last byte of the compressed file is
thrown away making it impossible to fully rebuild the file. If this is the
case, UNP will display a warning. It is always better to decompress it, even
if the last byte is missing.
Notes on compressors
There are a few things about compressors that might usefull to know:
PKLITE V1.14+ Professional
These versions of PKLITE have some small piece of code in the
decompression routine that adds a so called signature into the PSP. This
allows programs to check if they are still compressed with PKLITE. When such
a program is unpacked UNP by default adds a small piece of code into the PSP
to fake the decompression. One of the programs that check for such a
signature is the PKZIP V2.04g program. (see also -k switch)
Having tried several forms of registration for UNP, I have decided to use the
following registration method.First, since a lot of support has come from
the low end user I decided to release UNP as cardware to the public domain.
It's always nice to know your program is appreciated, and what's the price of
a simple card compared to the registration fees asked by several others? So
if you're a happy user of UNP fill in your registration postcard of
something in your neighbourhood today.However, I have spend a lot of hours
on this program and since it can be useful for commercial purposes I decided
that for commercial use a registration of $1 per copy is required. Why so
cheap you might wonder. Well, I don't want the price to prevent you from
registering. I do not have to make profit out of it, I am just a student who
has written a program to teach myself more about DOS. I just as well could
have been writing viruses but instead I have chosen this. Please note that
non-commercial users are allowed to send me money anyway! If it is enough to
buy and mail a disk, you can expect a free special registered version!
Hey! Unp is compressed!
Yes, starting with V4.10 of UNP I will use a compressor to make sure lamers
won't just change the version number and upload it to some BBS just to get
their ratio higher. UNP is compressed with DIET V1.45f and processed with a
program I call DSHIELD to prevent decompressing. The traps used are not too
difficult to figure out, but the idea behind it was just the prevent the
lamers from hacking. If you succeed in unpacking it, then you are probably
an experienced programmer. I am sorry but the protection seems to be
Due to this protection it might be possible that some anti-virus programs
which use heuristic scanning consider UNP infected by a new or unknown virus.
What UNP can remove
Quite a lot actually. A list follows:
CENTRAL POINT ANTI-VIRUS V1, V1.1
COMPACK V4.4, V4.5
DIET V1.00, V1.00d, V1.02b, V1.10a, V1.20, V1.44, V1.45f
EPW V1.2, V1.21, V1.30
EXEPACK V4.00, V4.03, V4.05, V4.06
IMPLODE V1.0 Alpha
LINK /EXEPACK V3.60, V3.64, V3.65, V3.69, V5.01.21
LZEXE V0.90, V0.91, V1.00a
MCLOCK V1.2, V1.3
MEGALITE V1.18a, V1.20a
PGMPAK V0.13, V0.14, V0.15
PKLITE V1.00, V1.00, V1.03, V1.05, V1.12, V1.13, V1.14, V1.15, V1.20
PRO-PACK V2.08, V2.14
PROTECT! EXE/COM V1.0, V1.1, V2.0, V3.0, V3.1, V4.0, V5.0
SCRNCH V1.00, V1.02
TINYPROG V1.0, V3.0, V3.3, V3.6, V3.8, V3.9
TURBO ANTI-VIRUS V7.02A
USERNAME V2.00, V2.10, V3.00
WWPACK V3.00, V3.01
I have left out a couple of names not really worth mentioning.
What UNP cannot remove
EPW V1.2, V1.21, V1.30, EXE only
Please note that registrations must be send to my home adress, not to my
E-mail adress.A card really is a card, not a scanned picture or some
piece of text.
Van Loenenlaan 10
1945 TX Beverwijk
E-Mail: valid until june '95[email protected]
-- End of UNP V4.10 documentation --