Luigi Auriemma

Hello,
Looking for a little bit of help as i suck at compression methods, heh. i am currently only assuming the data is compressed given the information i see in the file, but i could be wrong. Any help figuring things out would be appreciated. Also if you know of any good resources or tips on picking out compression methods, that would be useful.



Also what method do you usually use to extract usable code directly from a disassembled executable?

Thanks in advance.

I already saw that topic on xentax but no, there are no news.
not much luck using the comtype scanner of quickbms with the data starting from offset 0x38.

for the "compression" I can't help at all.

while for ripping the function you need to have some knowledge of reversing and assembly and most depends by the function itself.
a simple function or a set of functions (all the calls are relative so it's the same as one function) without static buffers is a joke to dump and use on the fly.
while a function with static references (mov eax, dword[00123456+eax*4]) requires a bit of more time and some function could use particular arguments that differ from the usual "input input_size output output_size" or even make usage of calls to ReadFile.

Ah, ok. wasn't aware you had already seen it. apologies in that regard then.

i usually end up just re-implementing the method by hand from looking at the disassembled code, as it is often easier to maintain than a direct assembly code dump.

Well, thanks for even taking the time to look into it. i will have to see what i can make out from the ppc assembly from the main executable. The way it references memory can be a pain to step through at times as even ida cant always make out the references if they are redirected through other registers or the rtoc table. x86 and mips are far easier in this regard.

ah ok, if it's not x86 then the "function dumping" idea can't be applied.