可执行文件压缩 (Executable compression)+UPX
UPX介绍
UPX（Ultimate Packer for eXecutables）是一个流行的可执行文件压缩工具，专门用于减小可执行文件的大小，从而减少磁盘占用空间和加快文件传输速度。UPX支持多种平台，包括Windows、Linux、macOS等。
UPX使用一系列压缩算法，其中包括LZMA（Lempel-Ziv-Markov chain-Algorithm）和其它一些变种。UPX通过在文件静态存储时进行压缩，生成包含压缩后的可执行文件的新文件。这个新文件可以被传输、存储，并在需要时解压缩以执行。但是由于UPX的特性，一些反病毒软件可能会将使用UPX压缩的文件标记为潜在的恶意软件。
使用
安装 UPX
# 在 Linux 上：
# sudo apt-get install upx
# 在 Windows 上：下载 UPX 并添加到系统路径
$ gcc -o square sq.cpp
$ ./square
Enter a number: 3
Square of 3.00 is 9.00
$ upx -h
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2017
UPX 3.94 Markus Oberhumer, Laszlo Molnar & John Reiser May 12th 2017
Usage: upx [-123456789dlthVL] [-qvfk] [-o file] file..
Commands:
-1 compress faster -9 compress better
--best compress best (can be slow for big files)
-d decompress -l list compressed file
-t test compressed file -V display version number
-h give this help -L display software license
Options:
-q be quiet -v be verbose
-oFILE write output to 'FILE'
-f force compression of suspicious files
--no-color, --mono, --color, --no-progress change look
Compression tuning options:
--brute try all available compression methods & filters [slow]
--ultra-brute try even more compression variants [very slow]
Backup options:
-k, --backup keep backup files
--no-backup no backup files [default]
Overlay options:
--overlay=copy copy any extra data attached to the file [default]
--overlay=strip strip any extra data attached to the file [DANGEROUS]
--overlay=skip don't compress a file with an overlay
Options for djgpp2/coff:
--coff produce COFF output [default: EXE]
Options for dos/com:
--8086 make compressed com work on any 8086
Options for dos/exe:
--8086 make compressed exe work on any 8086
--no-reloc put no relocations in to the exe header
Options for dos/sys:
--8086 make compressed sys work on any 8086
Options for ps1/exe:
--8-bit uses 8 bit size compression [default: 32 bit]
--8mib-ram 8 megabyte memory limit [default: 2 MiB]
--boot-only disables client/host transfer compatibility
--no-align don't align to 2048 bytes [enables: --console-run]
Options for watcom/le:
--le produce LE output [default: EXE]
Options for win32/pe, win64/pe, rtm32/pe & arm/pe:
--compress-exports=0 do not compress the export section
--compress-exports=1 compress the export section [default]
--compress-icons=0 do not compress any icons
--compress-icons=1 compress all but the first icon
--compress-icons=2 compress all but the first icon directory [default]
--compress-icons=3 compress all icons
--compress-resources=0 do not compress any resources at all
--keep-resource=list do not compress resources specified by list
--strip-relocs=0 do not strip relocations
--strip-relocs=1 strip relocations [default]
Options for linux/elf:
--preserve-build-id copy .gnu.note.build-id to compressed output
file.. executables to (de)compress
This version supports:
amd64-darwin.macho macho/amd64
amd64-linux.elf linux/amd64
amd64-linux.kernel.vmlinux vmlinux/amd64
amd64-win64.pe win64/pe
arm-darwin.macho macho/arm
arm-linux.elf linux/arm
arm-linux.kernel.vmlinux vmlinux/arm
arm-linux.kernel.vmlinuz vmlinuz/arm
arm-wince.pe arm/pe
arm64-linux.elf linux/arm64
armeb-linux.elf linux/armeb
armeb-linux.kernel.vmlinux vmlinux/armeb
fat-darwin.macho macho/fat
i086-dos16.com dos/com
i086-dos16.exe dos/exe
i086-dos16.sys dos/sys
i386-bsd.elf.execve bsd.exec/i386
i386-darwin.macho macho/i386
i386-dos32.djgpp2.coff djgpp2/coff
i386-dos32.tmt.adam tmt/adam
i386-dos32.watcom.le watcom/le
i386-freebsd.elf freebsd/i386
i386-linux.elf linux/i386
i386-linux.elf.execve linux.exec/i386
i386-linux.elf.shell linux.sh/i386
i386-linux.kernel.bvmlinuz bvmlinuz/i386
i386-linux.kernel.vmlinux vmlinux/i386
i386-linux.kernel.vmlinuz vmlinuz/i386
i386-netbsd.elf netbsd/i386
i386-openbsd.elf openbsd/i386
i386-win32.pe win32/pe
m68k-atari.tos atari/tos
mips-linux.elf linux/mips
mipsel-linux.elf linux/mipsel
mipsel.r3000-ps1 ps1/exe
powerpc-darwin.macho macho/ppc32
powerpc-linux.elf linux/ppc32
powerpc-linux.kernel.vmlinux vmlinux/ppc32
powerpc64le-darwin.macho macho/ppc64le
powerpc64le-linux.elf linux/ppc64le
powerpc64le-linux.kernel.vmlinux vmlinux/ppc64le
UPX comes with ABSOLUTELY NO WARRANTY; for details visit https://upx.github.io
1.创建一个可执行程序
#include gcc -static -o square mytest.c得到-rwxrwxr-x 1 ubuntu ubuntu 8.5M 12月 29 19:26 square
2. 使用 UPX 压缩可执行文件
$ upx -9 ./square
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2017
UPX 3.94 Markus Oberhumer, Laszlo Molnar & John Reiser May 12th 2017
File size Ratio Format Name
-------------------- ------ ----------- -----------
8852192 -> 340236 3.84% linux/amd64 square
Packed 1 file.
$ ls -ahl
-rwxrwxr-x 1 ubuntu ubuntu 333K 12月 29 19:26 square
- 如果文件太小会报错：
$ upx -9 square
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2017
UPX 3.94 Markus Oberhumer, Laszlo Molnar & John Reiser May 12th 2017
File size Ratio Format Name
-------------------- ------ ----------- -----------
upx: square: NotCompressibleException
Packed 1 file: 0 ok, 1 error.
3.直接执行处理后的文件
$ ./square
Enter a number: 3
Square of 3.00 is 9.00
CG
- https://www.mattkc.com/etc/snakeqr/
- https://resources.infosecinstitute.com/topics/malware-analysis/what-are-packed-executables/
- strip my_program
- Crinkler 是 Windows 的压缩链接器，专门针对大小仅为几千字节的可执行文件。它的主要目的是作为制作小型演示场景制作的工具。
- https://github.com/OpenNMT