Posted By
gerliczer
on 2015-01-02
01:50:03
|  Re: Finding packed starting addresses
Unfortunately, there is no better way than tracing the depacker and finding the actual entry point. Sometimes packers do some sort of BASIC warm reset, so if you familiarise with the Commodore BASIC V3.5 startup procedure it might help identifying the entry point.
Edit:
Maybe it would be the best course of action if you write a depacker identifier and entry point finder tool. You know, like if we have in the memory at given location a signature byte sequence, than entry call must be at address $XXXX; if there is the expected content, you are ready, if not then you have an unidentified depacker. Although, I don't think this would be the bottleneck in your NSTC fixing efforts.
|
