EXEPACK

From Just Solve the File Format Problem
Jump to: navigation, search
File Format
Name EXEPACK
Ontology
Wikidata ID Q105858233
Released 1985

EXEPACK is an executable compression utility by Microsoft. It compresses DOS EXE files using run-length encoding. It was originally written by Reuben Borman.

It was a part of some development SDKs, and was not a separate product. The compression can be done by the EXEPACK.EXE program, or by a feature integrated into the LINK.EXE program.

Some of the EXE files included with some versions of MS-DOS were compressed with EXEPACK.

Contents

Format details

There seem to be five common versions of EXEPACK-compressed format, made by Microsoft's tools. Some additional rare and patched variants exist.

The size of the decoder's boilerplate code, measured from the end of the "RB" signature to the end of the "Packed file is corrupt" string, is different in each of the common versions, so it can be used to distinguish them. It is 258, 277, 279, 283, or 290 bytes. The decoder's bytes are exactly identical for every file of a given common version.

But again, rare variants exist, and the docoder size is not unique when they are taken into account.

See the Identification section below for information that may help to figure out the decoder size.

Patched files

Files made by most versions of EXEPACK have a bug, related to something called the "A20-Gate". One way to work around the bug is to patch the compressed file. Such patched files seem to be very rare at best, but for what it's worth, some patchers are discussed here. Refer to the Software section for links.

EXEPATCK has a patch for each of the common-{258, 277, 279, 283} versions, so there are essentially four special EXEPATCK-patched versions.

LOWFIX only patches common-283, so there is one special LOWFIX-patched version.

EXPAKFIX apparently replaces the whole decoder, so all EXPAKFIX-patched files have a very similar decoder. There are some minor differences, to fill the space available. It patches common-{258, 277, 279, 283}, and maybe also some rare versions. If the original EXEPACK header was 16 bytes in size, it is increased to 18, reducing the decoder size by 2.

Identification

Apparently, bytes 80 00 always appear at offset 16. In other words, the SP field is 128 (refer to MS-DOS EXE#Header structure).

Bytes 10 00 or 12 00 appear at offset 20. In other words, the IP field is 16 or 18.

The ASCII signature "RB" appears immediately preceding the start-of-execution point in the file (refer to MS-DOS EXE#Special file positions).

The characteristic error message "Packed file is corrupt" normally appears 200 to 300 bytes after the signature. In rare cases, this message may be translated or erased. The byte sequence cd 21 b8 ff 4c cd 21 that precedes the error message is a more reliable thing to look for, though this is not a very distinctive byte sequence in EXE files in general. Also, though EXPAKFIX-patched files are rare, they can complicate analysis because they contain extra padding or signature bytes between the cd 21 sequence and the error message.

See also

Software

Compression:

Decompression, general:

Decompression, for DOS:

Patchers:

Sample files

Assorted versions:

Common versions:

Rare or modified versions:

Links

Retrieved from "http://fileformats.archiveteam.org/index.php?title=EXEPACK&oldid=49965"
Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox