PeCompact 2.X unpacking problem

[robson]

Hi everybody,

I have this problem and I hope that somebody more experienced will be able to point me in the right direction.
I successfully unpacked program on Windows XP packed with PECompact 2.X. Unpacked program runs on Windows XP fine, no issues. I copied it to Windows 7 32 bit and it fails to run there. After some investigation, I realized that the problem is that Image Base changes and invalidates some memory references in the program and causes unhandled exceptions. I tried to change the image base using LordPE editor to be what I believe it suppose to be, but when the program is loaded into memory it doesn’t use this image base as I would expect.

Please can somebody tell me how to fix this particular issue I am dealing with? How come it does work on Windows XP but not on Windows 7?

Thank you for your help.
Robson

[Kayaker]

Assuming that the unpacked file isn't using XP hardcoded IAT addresses, you can try turning ASLR off. Open the file in CFF Explorer or other and under Optional Header/Dll Characteristics uncheck 'Dll can move'. It should then load at 0x400000.
Otherwise it could be a .reloc issue, see here for example
http://www.woodmann.com/forum/showthread.php?14494-Pointers-in-unpacked-file-don-t-get-rebased

[robson]

Assuming that the unpacked file isn't using XP hardcoded IAT addresses, you can try turning ASLR off. Open the file in CFF Explorer or other and under Optional Header/Dll Characteristics uncheck 'Dll can move'. It should then load at 0x400000.
Otherwise it could be a .reloc issue, see here for example
http://www.woodmann.com/forum/showthread.php?14494-Pointers-in-unpacked-file-don-t-get-rebased

I unchecked 'Dll can move', saved the updated application binary and the application works like a charm. Thank you.