Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UPX – Ultimate Packer for Executables

upx.github.io

Post reply on HN
Print view View original

41–50 of 82 posts

Re: UPX – Ultimate Packer for Executables

#41

Post by jamesrom »

davexunit wrote: post #40
bruno2223 wrote: post #14

UPX was also good to protect the code, not only for compacting: 1. I used UPX to compact my Delphi EXE file. 2. Then I openned up any HEXA editor 3. looked for "UPX" string and changed to "222x" Doing this, the UPX unpack tool didn't work and crackers could not easily see or edit my source code with Assembly (as UPX mess with everything!) Thanks UPX :-)

What a malicious thing to do. Computer users deserve to be able to inspect the code running on their machines.

Of course you can inspect it. Understanding it, however...

Re: UPX – Ultimate Packer for Executables

#43

Post by MichaelBurge »

foobarchu wrote: post #38
beagle3 wrote: post #31

People who compress their go binaries (or any other binaries, really) - please be aware that thus doing, you stop the OS from being able to page out your executable (rarely a big loss), and also to be unable to share executable pages (not a huge loss for a 2MB executable, a huge loss for a 100MB executable). If there's only one copy of a program running, it won't matter - but if you are running hundreds of copies (ev…

I'm curious, why did you feel the need to call out go specifically? Does this apply more to go than other source languages?

Many go programmers statically compile their code, which should make the paging problem worse.

Re: UPX – Ultimate Packer for Executables

#44

Post by interfixus »

I do most of my web-dev in Nim these days. Meaning my ELFs are ultimately produced by GCC og Clang. Everyting statically linked - and I mean everything: For clib I use Musl. And then I UPX the bejesus out of them.

It's simply nice to ship a fully working app, with SQLite* and everything, which will basically run anywhere with a Linux kernel, in a single executable far below 2 MB.

*) Yes, the vast majority of the world's websites need nothing fancier than SQLite to keep them happy. And manageable.

Re: UPX – Ultimate Packer for Executables

#45

Post by userbinator »

bruno2223 wrote: post #14

UPX was also good to protect the code, not only for compacting: 1. I used UPX to compact my Delphi EXE file. 2. Then I openned up any HEXA editor 3. looked for "UPX" string and changed to "222x" Doing this, the UPX unpack tool didn't work and crackers could not easily see or edit my source code with Assembly (as UPX mess with everything!) Thanks UPX :-)

As someone "on the other side ;-)", I don't think you protected much. UPX is pretty much the classic "Hello World" of unpacking manually, and tools like PEid will still be able to tell it's UPX from the decompressor stub alone.

It's been years since I unpacked a UPX manually, but I still remember what it looks like: a PUSHA at the start to save all the registers, a lot of decompression code, and finally a POPA and a JMP to the OEP. Incidentally this general pattern is also shared by a bunch of other simple packers (more focused on compression than anti-RE) so unpacking them follows the same process.

Re: UPX – Ultimate Packer for Executables

#46

Post by userbinator »

modeless wrote: post #30

Warning: although UPX is awesome, be wary of using it to distribute software to a wide audience as it seems to trigger false positives in some antivirus software.

I'm surprised to hear that --- I can and have seen it happening with more advanced/obscure/protective packers, but UPX is so common and very easily unpacked (and thus scanned by AVs) that I'd say any AV which gets confused by UPX is not worth using at all.

Re: UPX – Ultimate Packer for Executables

#47

Post by userbinator »

hannob wrote: post #2

Surprised this still exists. A little walk down memory lane: I once ran the exe mailing list for exe packers and protection tools. There was a whole scene of people in the 90s writing such tools and writing unpackers and removal tools for such things. UPX was one of the later ones that still existed when most of this scene vanished.

The demoscene continues to make extensive use of packers, more for achieving even better compression than for protection against RE:

https://in4k.github.io/wiki/exe-packers-tweakers-and-linkers

(Incidentally, these advanced packers also tend to frustrate RE to some extent, since the same tricks they use to increase compression ratios can often greatly confuse RE tools.)

Re: UPX – Ultimate Packer for Executables

#49

Post by pilif »

userbinator wrote: post #46
modeless wrote: post #30

Warning: although UPX is awesome, be wary of using it to distribute software to a wide audience as it seems to trigger false positives in some antivirus software.

I'm surprised to hear that --- I can and have seen it happening with more advanced/obscure/protective packers, but UPX is so common and very easily unpacked (and thus scanned by AVs) that I'd say any AV which gets confused by UPX is not worth using at all.

And yet... in our case, the false-positive rate went from about one a month to one a year when we stopped using UPX. For a binary that didn’t change, mind you.

You'd think that after reporting a false positive once, an AV vendor would whitelist the hash of the binary, but no. Some of them were re-detecting malware time and time again. Until we stopped using UPX.

Re: UPX – Ultimate Packer for Executables

#50

Post by analognoise »

spapas82 wrote: post #9

I used it to compress a Lazarus (open source Delphi clone) executable. The results were great (executable size reduced by more than 50%, iirc from 2 mb to around 800 kB). Offering a sub MB executable in the era of 100 MB electron apps is totally pioneer :)

I've done the same thing! Shout out to Lazarus/FPC!!!
Post reply on HN