UPX

Infobox Software
name = UPX
"the Ultimate Packer for eXecutables"



caption =
collapsible =
author =
developer =
released = May 26, 1998
latest release version = 3.03
latest release date = April 27, 2008
latest preview version =
latest preview date =
frequently updated =
programming language =
operating system = Windows, Linux, DOS, Atari
platform =
language =
status =
genre = Executable compression
license = GPL
website = [http://upx.sourceforge.net upx.sf.net]

UPX, "the Ultimate Packer for eXecutables", is a free and open source executable packer supporting a number of file formats from different operating systems.

Compression

UPX uses a compression algorithm called UCL, which is a free implementation of the proprietary NRV, "Not Really Vanished", algorithm.

UCL has been designed to be simple enough that a decompressor can be implemented in just a few hundred bytes of code. UCL requires no additional memory to be allocated for decompression, a considerable advantage that means that a UPX packed executable requires no additional memory.

UPX (3.0) can use LZMA on 32/64-bit platforms.

Decompression

UPX supports two mechanisms for decompression, an in-place technique, and extraction to temporary file.

The in-place technique, which decompresses the executable into memory, is not possible on all supported platforms. The rest use extraction to temporary file. This procedure involves additional overhead and other disadvantages; however, it allows any executable file format to be packed. The executable is extracted to a temporary location, and then open() is used to obtain a file descriptor.

Once a file descriptor is obtained, the temporary file can be unlink()ed, the stub then uses execve() on the file handle (via /proc) to overwrite the stub with the executable image of the temporary file.

The extraction to temporary file method has several disadvantages:
* special permissions are ignored, such as suid.
* [Command line interface#Anatomy of a CLI|argv [0] will not be meaningful.
* applications will be unable to share common segments.

Unmodified UPX packing is often detected and unpacked by anti-virus scanners. UPX also has a built-in feature for unpacking unmodified executables packed with itself.

Supported formats

* ARM/pe
* atari/tos
* *BSD/i386
* djgpp2/coff
* dos/com
* dos/exe
* dos/sys
* linux/i386 a.out
* linux/ELF on i386, amd64, ARM, powerpc
* linux/kernel on i386, amd64 and ARM
* mach/ppc32, mach/i386
* rtm32/pe
* tmt/adam
* ps1/exe
* watcom/le
* win32/pe (excluding files built using the .NET Framework)

External links

* [http://upx.sourceforge.net UPX: the Ultimate Packer for eXecutables]
*
* [http://freshmeat.net/projects/upx/ UPX] at Freshmeat