EXEPACK - Revision history

Jsummers: /* Identification */

2025-08-18T11:59:32Z

‎Identification

Jsummers: /* Identification */

2025-08-16T12:15:10Z

‎Identification

Jsummers: /* Sample files */

2025-03-22T12:09:18Z

‎Sample files

Jsummers at 15:14, 2 February 2025

2025-02-02T15:14:00Z

Jsummers: /* Sample files */

2025-01-31T18:32:52Z

‎Sample files

Jsummers at 19:30, 28 January 2025

2025-01-28T19:30:17Z

Sembiance: Sample files

2024-05-14T23:53:18Z

Sample files

Jsummers: /* Software */

2023-10-28T13:56:01Z

‎Software

Parchivist: /* Software */

2023-10-16T13:28:48Z

‎Software

Jsummers: /* Identification */

2022-07-03T21:29:08Z

‎Identification

@@ Line 37: / Line 37: @@
 (The two characteristics above seem to do a good job of distinguishing EXEPACK files from other EXE files. Information below is not as reliable -- EXEPACK was so widely used that there's an exception to just about every rule.)
-Almost always, bytes {{magic|80 00}} always appear at offset 16. In other words, the ''SP'' field is 128.
+Almost always, bytes {{magic|80 00}} appear at offset 16. In other words, the ''SP'' field is 128.
-The characteristic error message "{{magic|Packed file is corrupt}}" normally appears 200 to 300 bytes after the signature. In rare cases, this message is translated or erased. The byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the <code>cd 21</code> sequence and the error message.
+The characteristic error message "{{magic|Packed file is corrupt}}" normally appears 200 to 300 bytes after the <code>RB</code> signature. In rare cases, this message is translated or erased. The byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the <code>cd 21</code> sequence and the error message.
 == See also ==

@@ Line 31: / Line 31: @@
 == Identification ==
-Apparently, bytes <code>80 00</code> always appear at offset 16. In other words, the ''SP'' field is 128 (refer to [[MS-DOS EXE#Header structure]]).
+Bytes {{magic|10 00}} or {{magic|12 00}} appear at offset 20. In other words, the ''IP'' field is 16 or 18 (refer to [[MS-DOS EXE#Header structure]]).
-−
-Bytes <code>10 00</code> or <code>12 00</code> appear at offset 20. In other words, the ''IP'' field is 16 or 18.
 The ASCII signature "{{magic|RB}}" appears immediately preceding the start-of-execution point in the file (refer to [[MS-DOS EXE#Special file positions]]).
-The characteristic error message "{{magic|Packed file is corrupt}}" normally appears 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. The byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the <code>cd 21</code> sequence and the error message.
+(The two characteristics above seem to do a good job of distinguishing EXEPACK files from other EXE files. Information below is not as reliable -- EXEPACK was so widely used that there's an exception to just about every rule.)
 == See also ==

@@ Line 96: / Line 96: @@
 ** {{CdTextfiles|smsharew/UTIL2/TESTXT33.ZIP|TESTXT33.ZIP}}
 ** {{CdTextfiles|640swstudio/MAIL/VP407.ZIP|VP407.ZIP}}
-* Unidentified 291-byte version
+* "Artisoft/LANtastic" 291-byte version
 ** {{CdTextfiles|640swstudio/LAN/KBFIX.ZIP|KBFIX.ZIP}} → KBFIX.EXE
 ** {{CdTextfiles|tigershareware/x19/lancache.zip|lancache.zip}}

@@ Line 15: / Line 15: @@
 There seem to be five common versions of EXEPACK-compressed format, made by Microsoft's tools. Some additional rare and patched variants exist.
-The size in bytes of the decoder's boilerplate code, measured from the end of the "RB" signature to the end of the "<code>Packed file is corrupt</code>" string, is different in each of the common versions, so it can help to distinguish them. It is 258, 277, 279, 283, or 290. The decoder's bytes are exactly identical for every file of a given common version.
+The size of the decoder's boilerplate code, measured from the end of the "<code>RB</code>" signature to the end of the "<code>Packed file is corrupt</code>" string, is different in each of the common versions, so it can be used to distinguish them. It is 258, 277, 279, 283, or 290 bytes. The decoder's bytes are exactly identical for every file of a given common version.
 But again, rare variants exist, and the docoder size is not unique when they are taken into account.
 See the Identification section below for information that may help to figure out the decoder size.
 == Identification ==
@@ Line 90: / Line 99: @@
 ** {{CdTextfiles|640swstudio/LAN/KBFIX.ZIP|KBFIX.ZIP}} → KBFIX.EXE
 ** {{CdTextfiles|tigershareware/x19/lancache.zip|lancache.zip}}
 == Links ==

@@ Line 58: / Line 58: @@
 == Sample files ==
 * {{DexvertSamples|archive/exePackPacked}}
 == Links ==

@@ Line 9: / Line 9: @@
 It was a part of some development SDKs, and was not a separate product. The compression can be done by the EXEPACK.EXE program, or by a feature integrated into the LINK.EXE program.
 Some of the EXE files included with some versions of [[MS-DOS]] were compressed with EXEPACK.
 == Identification ==
@@ Line 21: / Line 28: @@
 The ASCII signature "{{magic|RB}}" appears immediately preceding the start-of-execution point in the file (refer to [[MS-DOS EXE#Special file positions]]).
-The characteristic error message "{{magic|Packed file is corrupt}}" appears about 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. D. Fifield suggests searching for the byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that immediately precedes the error message.
+The characteristic error message "{{magic|Packed file is corrupt}}" normally appears 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. The byte sequence {{magic|cd 21 b8 ff 4c cd 21}} that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the <code>cd 21</code> sequence and the error message.
 == See also ==

@@ Line 49: / Line 49: @@
 * {{CdTextfiles|simtel/simtel20/MSDOS/EXECOMP/EXPAKFX1.ZIP|EXPAKFIX}} by Alan Modra
 * {{CdTextfiles|simtel/simtel20/MSDOS/EXECOMP/LOWFIX.ZIP|LOWFIX}} by Steve Burg
 == Links ==

@@ Line 37: / Line 37: @@
 * [https://www.bamsoftware.com/software/exepack/ David Fifield's exepack]
 * [https://sourceforge.net/p/openkb/code/ci/master/tree/src/tools/unexepack.c UNEXEPACK from openKB]
 Decompression, for DOS: