upx

Compress executable

$ upx [path/to/file]

$ upx -d [path/to/file]

$ upx --help

upx [options] <filenames>...

-o <file>
    Write output to the specified file instead of modifying the original.

-d
    Decompress the specified UPX-compressed files.

-l
    List information about UPX-compressed files without decompressing them.

-t
    Test the integrity of UPX-compressed files.

-9 (or --best)
    Apply the best possible compression ratio, which can be slower but results in smaller files.

-0 (or --no-compress)
    Do not compress; simply copy the files. Useful for testing or changing formats.

--help
    Display the help message and exit.

--version
    Show the UPX version information and exit.

-k (or --keep-section-info)
    Keep additional section information, which can be useful for debugging purposes but slightly increases file size.

-f (or --force)
    Force overwriting existing files without prompting.

-q (or --quiet)
    Suppress most output messages during operation.

-v (or --verbose)
    Enable verbose output, showing more details about the compression/decompression process.

-V (or --very-verbose)
    Enable very verbose output, providing even more detailed information.

--ultra-fast
    Use the fastest compression method available, sacrificing some compression ratio for speed.

--ultra-brute
    Try all available compression methods to achieve the highest possible compression, which can be extremely slow.

-c <method>
    Select a specific compression method, e.g., lzma, NRV, zlib.

UPX, the Ultimate Packer for eXecutables, is a free, portable, and high-performance executable packer.

It employs a unique decompression method that allows executables to be compressed without requiring any runtime libraries or temporary files. When an UPX-compressed program starts, it rapidly decompresses itself directly into memory, ensuring fast startup times. This tool is widely used to significantly reduce the size of executables, often by 50-80%, which is beneficial for distribution, reducing download times, and saving disk space.

UPX supports a broad array of executable formats across various operating systems, including Linux, Windows, macOS, and DOS, making it a versatile utility for developers and system administrators.

Antivirus Flagging: UPX-compressed executables can sometimes be flagged by antivirus software as suspicious due to their runtime self-decompression mechanism, which is also utilized by some malware.

Debugging Challenges: Debugging an UPX-packed executable can be more challenging. Debuggers initially see the compressed code, potentially requiring special tools or manual unpacking.

Platform/Format Specificity: While highly versatile, UPX does not support every single executable format or platform permutation. Always test compressed binaries thoroughly on target systems.

Performance Overhead: Although UPX's decompression overhead is minimal, for extremely small and frequently executed programs, it could theoretically introduce a negligible performance impact during startup.

UPX operates by compressing the executable code and data, then appending a small decompression stub to the beginning of the modified file. When the packed executable is run, this stub takes control, decompresses the original executable data directly into memory, and then transfers control to the original entry point. This entire process is self-contained, meaning no temporary files are created on disk, and no external decompression libraries are needed. The executable remains fully functional and directly runnable after compression.

UPX supports a wide variety of executable formats across different operating systems and architectures. Key examples include:

• ELF (Executable and Linkable Format) for Linux and Unix-like systems.
• PE (Portable Executable) for Windows operating systems.
• Mach-O for macOS.
• Various DOS formats (COM, EXE, SYS).

UPX was originally created by Markus Oberhumer and Laszlo Molnar, with its first public release in 1999.

It quickly gained popularity for its exceptionally high compression ratios and extremely fast in-memory decompression, even on older hardware. UPX's design eliminated the need for a separate decompressor or runtime library, making it a highly desirable tool for reducing executable sizes for distribution and storage. The project continues to be actively maintained and updated, supporting new executable formats and operating systems.

gzip(1): General-purpose file compression utility., tar(1): Archiving utility often used in conjunction with compression tools., objdump(1): Displays information from object files., readelf(1): Displays information about ELF format files.