I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and lots of problems, such "sp-analysis failed" and virtual addresses pointed to nowhere. IDA Unpacker plugin swamps me with warnings. I tried to analyse HEADER. Sections have wrong bounds: pointer to raw data and size of raw data seems correct, but some virtual addresses IDA cannot resolve, and in "Program Segmentation" window some sections are missed. Most of instruction in file looks like this:
___:00401000 dd 9D3DBCCBh, 0DB7776EAh, 1F6BE17Bh, 0ADFBB803h, 4673D4B7h ___:00401000 dd 903ADB7Ch, 0B03DACBAh, 0CA4C9D26h, 0ECFF17BBh, 0AFC80EE6h ___:00401000 dd 0AE3EAEA3h, 5C244E1Ch, 8F68FA9Bh, 5671677Eh, 8C3CEC8Fh ___:00401000 dd 0F56291C8h, 3D050237h, 9543FF95h, 0DA02686Ch, 6BB1A7EBh ___:00401000 dd 32F012EAh, 99D0F3D3h, 8A8E08A5h, 1280ECB4h, 4B4ACACEh ___:00401000 dd 0FFB892h, 5E01507Bh, 94087230h, 969DCCDBh, 8DD0AB9Bh
So what would be right approach? Should I create segments manual, and somehow say IDA to interpret it as code/data, or analyse entry point and "start" function that IDA found (with sp-analyse problem at the end)? Or it's better to try make IDA Unpacker plugin work?