Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UPX – Ultimate Packer for Executables

upx.github.io

Post reply on HN
Print view View original

11–20 of 82 posts

Re: UPX – Ultimate Packer for Executables

#11

Post by pmoriarty »

I used to use this a lot, back in the bad old days, when drive space was at a premium.

These days I struggle to fill my hard drives no matter how wasteful I am with downloading videos and not bothering to clean up afterwards... and the amount of hard drive space you can buy per dollar keeps growing faster than I can fill my disks.

Much trickier issues to tackle are speed (unless you go with SSD's, but then you run in to space issues again, and reliability issues), backups, and data integrity. All of these issues are made much harder by the sheer amounts of data we're storing these days. Executables usually account for only a relatively small fraction of that space.

Re: UPX – Ultimate Packer for Executables

#12

Post by andrewstuart2 »

hannob wrote: post #2

Surprised this still exists. A little walk down memory lane: I once ran the exe mailing list for exe packers and protection tools. There was a whole scene of people in the 90s writing such tools and writing unpackers and removal tools for such things. UPX was one of the later ones that still existed when most of this scene vanished.

Not only does it exist, but it's insanely good at packing go static binaries. I don't remember the compression ratio, but I think it's something like 20% of the original size.

Re: UPX – Ultimate Packer for Executables

#13

Post by vetinari »

mitchty wrote: post #6
kichik wrote: post #3

Earlier quoted context omitted.

Exists and maintained . They even keep adding support for more formats. That's pretty amazing after almost 20 years.

I use it for static binaries I use where I don't care about startup times being slower. You'd be suprised at how much of an elf binary is all 0's.

Compressing them this way however makes situation worse for memory manager.

If you use uncompressed (or transparently compressed by the filesystem) binary, your process has mmaped the memory pages, which can be discarded and then reloaded, as needed.

If you use self-extractor, your process has dirty pages that it itself wrote, that cannot be discarded, but must be moved to swap if needed.

The more you use the same executable for multiple processes, the worse the effect is. The ro mmaped pages are shared among them all, the written pages are private to each process.

Re: UPX – Ultimate Packer for Executables

#14

Post by bruno2223 »

UPX was also good to protect the code, not only for compacting:

1. I used UPX to compact my Delphi EXE file.

2. Then I openned up any HEXA editor

3. looked for "UPX" string and changed to "222x"

Doing this, the UPX unpack tool didn't work and crackers could not easily see or edit my source code with Assembly (as UPX mess with everything!)

Thanks UPX :-)

Re: UPX – Ultimate Packer for Executables

#16

Post by slezyr »

bruno2223 wrote: post #14

UPX was also good to protect the code, not only for compacting: 1. I used UPX to compact my Delphi EXE file. 2. Then I openned up any HEXA editor 3. looked for "UPX" string and changed to "222x" Doing this, the UPX unpack tool didn't work and crackers could not easily see or edit my source code with Assembly (as UPX mess with everything!) Thanks UPX :-)

That's interesting. The UPX string is most likely a name of section in PE file. It's first UPX string you will find in the file.

How did UPX loader managed to find the section in which packed content is stored?

UPD. It's REALLY easy to "hack" this protection. You simply need to attach a debugger and you will see unprotected exe file in the memory. There are tools to convert loaded unprotected exe file into regular exe file on the disk. So... No one really tried to hack you. Sorry.

Re: UPX – Ultimate Packer for Executables

#18

Post by slezyr »

steeve wrote: post #15

UPX still works great when used with Go executables. We use it heavily to compress some of our Docker image executables [1]. [1] https://github.com/znly/docker-protobuf/blob/master/Dockerfi...

It should work on almost every binary.

The exception are NSIS installers, self-extracting archives (exe rar files), files with IDL interfaces.

When NSIS starts they will try to open it's own exe file and find the section in which it's packed data is stored. But UPX will remove those sections and create .UPX section with compressed data.

Re: UPX – Ultimate Packer for Executables

#19

Post by bruno2223 »

slezyr wrote: post #16
bruno2223 wrote: post #14

UPX was also good to protect the code, not only for compacting: 1. I used UPX to compact my Delphi EXE file. 2. Then I openned up any HEXA editor 3. looked for "UPX" string and changed to "222x" Doing this, the UPX unpack tool didn't work and crackers could not easily see or edit my source code with Assembly (as UPX mess with everything!) Thanks UPX :-)

That's interesting. The UPX string is most likely a name of section in PE file. It's first UPX string you will find in the file. How did UPX loader managed to find the section in which packed content is stored? UPD. It's REALLY easy to "hack" this protection. You simply need to attach a debugger and you will see unprotected exe file in the memory. There are tools to convert loaded unprotected exe file into regular ex…

I dunno know. But this method worked for years!

Re: UPX – Ultimate Packer for Executables

#20

Post by slezyr »

bruno2223 wrote: post #19
slezyr wrote: post #16

Earlier quoted context omitted.

That's interesting. The UPX string is most likely a name of section in PE file. It's first UPX string you will find in the file. How did UPX loader managed to find the section in which packed content is stored? UPD. It's REALLY easy to "hack" this protection. You simply need to attach a debugger and you will see unprotected exe file in the memory. There are tools to convert loaded unprotected exe file into regular ex…

I dunno know. But this method worked for years!

See my update. You could only stop kids, who tried to use UPX unpackers.
Post reply on HN