UPX?

[Dels]

i have heard about UPX exe compressor, but i get some confuse, how that things actually work? so we compress all exe we have and each time we execute them it will automatically extracted and run? and how about memory this application use?

thanks

Link :

http://upx.sourceforge.net/

http://www.upx.org/

[Albuquerque]

I mentioned UPX in a WindowsPE thread. Essentially, any file you compress with UPX will "automatically uncompress" itself when run. You do not need to take any other actions...

When talking about the individual application, memory utilization doesn't really increase by a noteable amount. However, notice how I bolded individual? UPX-compressed files cannot be "instanced" within RAM; a great example is SHELL32.DLL. If you compress SHELL32.DLL, your system will suddenly start hogging 40+ MB more memory...

Why? It's not because the individual app is taking more, but because Windows by default loads the module once and then references that once-loaded module multiple times for all its needs. When you compress it with UPX, Windows can no longer use it that way and must load it again and again every time an instance is required.

The result is, SHELL32.DLL gets loaded into ram dozens of times, and as such takes up seriously more ram. The lesson to be learned is -- while most files can be compressed, you should perform testing to ensure they should be compressed.