upx man page on Kali

Man page or keyword search:  
man Server   9211 pages
apropos Keyword Search (all sections)
Output format
Kali logo
[printable version]

UPX(1)									UPX(1)

NAME
       upx - compress or expand executable files

SYNOPSIS
       upx [ command ] [ options ] filename...

ABSTRACT
			   The Ultimate Packer for eXecutables
	  Copyright (c) 1996-2017 Markus Oberhumer, Laszlo Molnar & John Reiser
			       http://upx.sourceforge.net

       UPX is a portable, extendable, high-performance executable packer for
       several different executable formats. It achieves an excellent
       compression ratio and offers *very* fast decompression. Your
       executables suffer no memory overhead or other drawbacks for most of
       the formats supported, because of in-place decompression.

       While you may use UPX freely for both non-commercial and commercial
       executables (for details see the file
       /usr/share/doc/upx-ucl/copyright), we would highly appreciate if you
       credit UPX and ourselves in the documentation, possibly including a
       reference to the UPX home page. Thanks.

       [ Using UPX in non-OpenSource applications without proper credits is
       considered not politically correct ;-) ]

DISCLAIMER
       UPX comes with ABSOLUTELY NO WARRANTY; for details see the file
       /usr/share/doc/upx-ucl/copyright.

       This is the first production quality release, and we plan that future
       1.xx releases will be backward compatible with this version.

       Please report all problems or suggestions to the authors. Thanks.

DESCRIPTION
       UPX is a versatile executable packer with the following features:

	 - excellent compression ratio: compresses better than zip/gzip,
	     use UPX to decrease the size of your distribution !

	 - very fast decompression: about 10 MiB/sec on an ancient Pentium 133,
	     about 200 MiB/sec on an Athlon XP 2000+.

	 - no memory overhead for your compressed executables for most of the
	     supported formats

	 - safe: you can list, test and unpack your executables
	     Also, a checksum of both the compressed and uncompressed file is
	     maintained internally.

	 - universal: UPX can pack a number of executable formats:
	     * atari/tos
	     * bvmlinuz/386    [bootable Linux kernel]
	     * djgpp2/coff
	     * dos/com
	     * dos/exe
	     * dos/sys
	     * linux/386
	     * linux/elf386
	     * linux/sh386
	     * ps1/exe
	     * rtm32/pe
	     * tmt/adam
	     * vmlinuz/386     [bootable Linux kernel]
	     * vmlinux/386
	     * watcom/le (supporting DOS4G, PMODE/W, DOS32a and CauseWay)
	     * win32/pe (exe and dll)
	     * win64/pe (exe and dll)
	     * arm/pe (exe and dll)
	     * linux/elfamd64
	     * linux/elfppc32
	     * mach/elfppc32

	 - portable: UPX is written in portable endian-neutral C++

	 - extendable: because of the class layout it's very easy to support
	     new executable formats or add new compression algorithms

	 - free: UPX can be distributed and used freely. And from version 0.99
	     the full source code of UPX is released under the GNU General Public
	     License (GPL) !

       You probably understand now why we call UPX the "ultimate" executable
       packer.

COMMANDS
   Compress
       This is the default operation, eg. upx yourfile.exe will compress the
       file specified on the command line.

   Decompress
       All UPX supported file formats can be unpacked using the -d switch, eg.
       upx -d yourfile.exe will uncompress the file you've just compressed.

   Test
       The -t command tests the integrity of the compressed and uncompressed
       data, eg. upx -t yourfile.exe check whether your file can be safely
       decompressed. Note, that this command doesn't check the whole file,
       only the part that will be uncompressed during program execution. This
       means that you should not use this command instead of a virus checker.

   List
       The -l command prints out some information about the compressed files
       specified on the command line as parameters, eg upx -l yourfile.exe
       shows the compressed / uncompressed size and the compression ratio of
       yourfile.exe.

OPTIONS
       -q: be quiet, suppress warnings

       -q -q (or -qq): be very quiet, suppress errors

       -q -q -q (or -qqq): produce no output at all

       --help: prints the help

       --version: print the version of UPX

       --exact: when compressing, require to be able to get a byte-identical
       file after decompression with option -d. [NOTE: this is work in
       progress and is not supported for all formats yet. If you do care, as a
       workaround you can compress and then decompress your program a first
       time - any further compress-decompress steps should then yield byte-
       identical results as compared to the first decompressed version.]

       [ ...to be written... - type `upx --help' for now ]

COMPRESSION LEVELS & TUNING
       UPX offers ten different compression levels from -1 to -9, and --best.
       The default compression level is -8 for files smaller than 512 KiB, and
       -7 otherwise.

       ·   Compression levels 1, 2 and 3 are pretty fast.

       ·   Compression levels 4, 5 and 6 achieve a good time/ratio
	   performance.

       ·   Compression levels 7, 8 and 9 favor compression ratio over speed.

       ·   Compression level --best may take a long time.

       Note that compression level --best can be somewhat slow for large
       files, but you definitely should use it when releasing a final version
       of your program.

       Quick info for achieving the best compression ratio:

       ·   Try upx --brute myfile.exe or even upx --ultra-brute myfile.exe.

       ·   Try if --overlay=strip works.

       ·   For win32/pe programs there's --strip-relocs=0. See notes below.

OVERLAY HANDLING OPTIONS
       Info: An "overlay" means auxiliary data attached after the logical end
       of an executable, and it often contains application specific data (this
       is a common practice to avoid an extra data file, though it would be
       better to use resource sections).

       UPX handles overlays like many other executable packers do: it simply
       copies the overlay after the compressed image. This works with some
       files, but doesn't work with others, depending on how an application
       actually accesses this overlayed data.

	 --overlay=copy	   Copy any extra data attached to the file. [DEFAULT]

	 --overlay=strip   Strip any overlay from the program instead of
			   copying it. Be warned, this may make the compressed
			   program crash or otherwise unusable.

	 --overlay=skip	   Refuse to compress any program which has an overlay.

ENVIRONMENT
       The environment variable UPX can hold a set of default options for UPX.
       These options are interpreted first and can be overwritten by explicit
       command line parameters.	 For example:

	   for DOS/Windows:   set UPX=-9 --compress-icons#0
	   for sh/ksh/zsh:    UPX="-9 --compress-icons=0"; export UPX
	   for csh/tcsh:      setenv UPX "-9 --compress-icons=0"

       Under DOS/Windows you must use '#' instead of '=' when setting the
       environment variable because of a COMMAND.COM limitation.

       Not all of the options are valid in the environment variable - UPX will
       tell you.

       You can explicitly use the --no-env option to ignore the environment
       variable.

NOTES FOR THE SUPPORTED EXECUTABLE FORMATS
   NOTES FOR ATARI/TOS
       This is the executable format used by the Atari ST/TT, a Motorola 68000
       based personal computer which was popular in the late '80s. Support of
       this format is only because of nostalgic feelings of one of the authors
       and serves no practical purpose :-).  See http://www.freemint.de for
       more info.

       Packed programs will be byte-identical to the original after
       uncompression.  All debug information will be stripped, though.

       Extra options available for this executable format:

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

   NOTES FOR BVMLINUZ/I386
       Same as vmlinuz/i386.

   NOTES FOR DOS/COM
       Obviously UPX won't work with executables that want to read data from
       themselves (like some commandline utilities that ship with
       Win95/98/ME).

       Compressed programs only work on a 286+.

       Packed programs will be byte-identical to the original after
       uncompression.

       Maximum uncompressed size: ~65100 bytes.

       Extra options available for this executable format:

	 --8086		     Create an executable that works on any 8086 CPU.

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

   NOTES FOR DOS/EXE
       dos/exe stands for all "normal" 16-bit DOS executables.

       Obviously UPX won't work with executables that want to read data from
       themselves (like some command line utilities that ship with
       Win95/98/ME).

       Compressed programs only work on a 286+.

       Extra options available for this executable format:

	 --8086		     Create an executable that works on any 8086 CPU.

	 --no-reloc	     Use no relocation records in the exe header.

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

   NOTES FOR DOS/SYS
       Compressed programs only work on a 286+.

       Packed programs will be byte-identical to the original after
       uncompression.

       Maximum uncompressed size: ~65350 bytes.

       Extra options available for this executable format:

	 --8086		     Create an executable that works on any 8086 CPU.

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

   NOTES FOR DJGPP2/COFF
       First of all, it is recommended to use UPX *instead* of strip. strip
       has the very bad habit of replacing your stub with its own (outdated)
       version.	 Additionally UPX corrects a bug/feature in strip v2.8.x: it
       will fix the 4 KiB alignment of the stub.

       UPX includes the full functionality of stubify. This means it will
       automatically stubify your COFF files. Use the option --coff to disable
       this functionality (see below).

       UPX automatically handles Allegro packfiles.

       The DLM format (a rather exotic shared library extension) is not
       supported.

       Packed programs will be byte-identical to the original after
       uncompression.  All debug information and trailing garbage will be
       stripped, though.

       Extra options available for this executable format:

	 --coff		     Produce COFF output instead of EXE. By default
			     UPX keeps your current stub.

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

   NOTES FOR LINUX [general]
       Introduction

	 Linux/386 support in UPX consists of 3 different executable formats,
	 one optimized for ELF executables ("linux/elf386"), one optimized
	 for shell scripts ("linux/sh386"), and one generic format
	 ("linux/386").

	 We will start with a general discussion first, but please
	 also read the relevant docs for each of the individual formats.

	 Also, there is special support for bootable kernels - see the
	 description of the vmlinuz/386 format.

       General user's overview

	 Running a compressed executable program trades less space on a
	 ``permanent'' storage medium (such as a hard disk, floppy disk,
	 CD-ROM, flash memory, EPROM, etc.) for more space in one or more
	 ``temporary'' storage media (such as RAM, swap space, /tmp, etc.).
	 Running a compressed executable also requires some additional CPU
	 cycles to generate the compressed executable in the first place,
	 and to decompress it at each invocation.

	 How much space is traded?  It depends on the executable, but many
	 programs save 30% to 50% of permanent disk space.  How much CPU
	 overhead is there?  Again, it depends on the executable, but
	 decompression speed generally is at least many megabytes per second,
	 and frequently is limited by the speed of the underlying disk
	 or network I/O.

	 Depending on the statistics of usage and access, and the relative
	 speeds of CPU, RAM, swap space, /tmp, and file system storage, then
	 invoking and running a compressed executable can be faster than
	 directly running the corresponding uncompressed program.
	 The operating system might perform fewer expensive I/O operations
	 to invoke the compressed program.  Paging to or from swap space
	 or /tmp might be faster than paging from the general file system.
	 ``Medium-sized'' programs which access about 1/3 to 1/2 of their
	 stored program bytes can do particularly well with compression.
	 Small programs tend not to benefit as much because the absolute
	 savings is less.  Big programs tend not to benefit proportionally
	 because each invocation may use only a small fraction of the program,
	 yet UPX decompresses the entire program before invoking it.
	 But in environments where disk or flash memory storage is limited,
	 then compression may win anyway.

	 Currently, executables compressed by UPX do not share RAM at runtime
	 in the way that executables mapped from a file system do.  As a
	 result, if the same program is run simultaneously by more than one
	 process, then using the compressed version will require more RAM and/or
	 swap space.  So, shell programs (bash, csh, etc.)  and ``make''
	 might not be good candidates for compression.

	 UPX recognizes three executable formats for Linux: Linux/elf386,
	 Linux/sh386, and Linux/386.  Linux/386 is the most generic format;
	 it accommodates any file that can be executed.	 At runtime, the UPX
	 decompression stub re-creates in /tmp a copy of the original file,
	 and then the copy is (re-)executed with the same arguments.
	 ELF binary executables prefer the Linux/elf386 format by default,
	 because UPX decompresses them directly into RAM, uses only one
	 exec, does not use space in /tmp, and does not use /proc.
	 Shell scripts where the underlying shell accepts a ``-c'' argument
	 can use the Linux/sh386 format.  UPX decompresses the shell script
	 into low memory, then maps the shell and passes the entire text of the
	 script as an argument with a leading ``-c''.

       General benefits:

	 - UPX can compress all executables, be it AOUT, ELF, libc4, libc5,
	   libc6, Shell/Perl/Python/... scripts, standalone Java .class
	   binaries, or whatever...
	   All scripts and programs will work just as before.

	 - Compressed programs are completely self-contained. No need for
	   any external program.

	 - UPX keeps your original program untouched. This means that
	   after decompression you will have a byte-identical version,
	   and you can use UPX as a file compressor just like gzip.
	   [ Note that UPX maintains a checksum of the file internally,
	     so it is indeed a reliable alternative. ]

	 - As the stub only uses syscalls and isn't linked against libc it
	   should run under any Linux configuration that can run ELF
	   binaries.

	 - For the same reason compressed executables should run under
	   FreeBSD and other systems which can run Linux binaries.
	   [ Please send feedback on this topic ]

       General drawbacks:

	 - It is not advisable to compress programs which usually have many
	   instances running (like `sh' or `make') because the common segments of
	   compressed programs won't be shared any longer between different
	   processes.

	 - `ldd' and `size' won't show anything useful because all they
	   see is the statically linked stub.  Since version 0.82 the section
	   headers are stripped from the UPX stub and `size' doesn't even
	   recognize the file format.  The file patches/patch-elfcode.h has a
	   patch to fix this bug in `size' and other programs which use GNU BFD.

       General notes:

	 - As UPX leaves your original program untouched it is advantageous
	   to strip it before compression.

	 - If you compress a script you will lose platform independence -
	   this could be a problem if you are using NFS mounted disks.

	 - Compression of suid, guid and sticky-bit programs is rejected
	   because of possible security implications.

	 - For the same reason there is no sense in making any compressed
	   program suid.

	 - Obviously UPX won't work with executables that want to read data
	   from themselves. E.g., this might be a problem for Perl scripts
	   which access their __DATA__ lines.

	 - In case of internal errors the stub will abort with exitcode 127.
	   Typical reasons for this to happen are that the program has somehow
	   been modified after compression.
	   Running `strace -o strace.log compressed_file' will tell you more.

   NOTES FOR LINUX/ELF386
       Please read the general Linux description first.

       The linux/elf386 format decompresses directly into RAM, uses only one
       exec, does not use space in /tmp, and does not use /proc.

       Linux/elf386 is automatically selected for Linux ELF executables.

       Packed programs will be byte-identical to the original after
       uncompression.

       How it works:

	 For ELF executables, UPX decompresses directly to memory, simulating
	 the mapping that the operating system kernel uses during exec(),
	 including the PT_INTERP program interpreter (if any).
	 The brk() is set by a special PT_LOAD segment in the compressed
	 executable itself.  UPX then wipes the stack clean except for
	 arguments, environment variables, and Elf_auxv entries (this is
	 required by bugs in the startup code of /lib/ld-linux.so as of
	 May 2000), and transfers control to the program interpreter or
	 the e_entry address of the original executable.

	 The UPX stub is about 1700 bytes long, partly written in assembler
	 and only uses kernel syscalls. It is not linked against any libc.

       Specific drawbacks:

	 - For linux/elf386 and linux/sh386 formats, you will be relying on
	   RAM and swap space to hold all of the decompressed program during
	   the lifetime of the process.	 If you already use most of your swap
	   space, then you may run out.	 A system that is "out of memory"
	   can become fragile.	Many programs do not react gracefully when
	   malloc() returns 0.	With newer Linux kernels, the kernel
	   may decide to kill some processes to regain memory, and you
	   may not like the kernel's choice of which to kill.  Running
	   /usr/bin/top is one way to check on the usage of swap space.

       Extra options available for this executable format:

	 (none)

   NOTES FOR LINUX/SH386
       Please read the general Linux description first.

       Shell scripts where the underling shell accepts a ``-c'' argument can
       use the Linux/sh386 format.  UPX decompresses the shell script into low
       memory, then maps the shell and passes the entire text of the script as
       an argument with a leading ``-c''.  It does not use space in /tmp, and
       does not use /proc.

       Linux/sh386 is automatically selected for shell scripts that use a
       known shell.

       Packed programs will be byte-identical to the original after
       uncompression.

       How it works:

	 For shell script executables (files beginning with "#!/" or "#! /")
	 where the shell is known to accept "-c <command>", UPX decompresses
	 the file into low memory, then maps the shell (and its PT_INTERP),
	 and passes control to the shell with the entire decompressed file
	 as the argument after "-c".  Known shells are sh, ash, bash, bsh, csh,
	 ksh, tcsh, pdksh.  Restriction: UPX cannot use this method
	 for shell scripts which use the one optional string argument after
	 the shell name in the script (example: "#! /bin/sh option3\n".)

	 The UPX stub is about 1700 bytes long, partly written in assembler
	 and only uses kernel syscalls. It is not linked against any libc.

       Specific drawbacks:

	 - For linux/elf386 and linux/sh386 formats, you will be relying on
	   RAM and swap space to hold all of the decompressed program during
	   the lifetime of the process.	 If you already use most of your swap
	   space, then you may run out.	 A system that is "out of memory"
	   can become fragile.	Many programs do not react gracefully when
	   malloc() returns 0.	With newer Linux kernels, the kernel
	   may decide to kill some processes to regain memory, and you
	   may not like the kernel's choice of which to kill.  Running
	   /usr/bin/top is one way to check on the usage of swap space.

       Extra options available for this executable format:

	 (none)

   NOTES FOR LINUX/386
       Please read the general Linux description first.

       The generic linux/386 format decompresses to /tmp and needs /proc file
       system support. It starts the decompressed program via the execve()
       syscall.

       Linux/386 is only selected if the specialized linux/elf386 and
       linux/sh386 won't recognize a file.

       Packed programs will be byte-identical to the original after
       uncompression.

       How it works:

	 For files which are not ELF and not a script for a known "-c" shell,
	 UPX uses kernel execve(), which first requires decompressing to a
	 temporary file in the file system.  Interestingly -
	 because of the good memory management of the Linux kernel - this
	 often does not introduce a noticeable delay, and in fact there
	 will be no disk access at all if you have enough free memory as
	 the entire process takes places within the file system buffers.

	 A compressed executable consists of the UPX stub and an overlay
	 which contains the original program in a compressed form.

	 The UPX stub is a statically linked ELF executable and does
	 the following at program startup:

	   1) decompress the overlay to a temporary location in /tmp
	   2) open the temporary file for reading
	   3) try to delete the temporary file and start (execve)
	      the uncompressed program in /tmp using /proc/<pid>/fd/X as
	      attained by step 2)
	   4) if that fails, fork off a subprocess to clean up and
	      start the program in /tmp in the meantime

	 The UPX stub is about 1700 bytes long, partly written in assembler
	 and only uses kernel syscalls. It is not linked against any libc.

       Specific drawbacks:

	 - You need additional free disk space for the uncompressed program
	   in your /tmp directory. This program is deleted immediately after
	   decompression, but you still need it for the full execution time
	   of the program.

	 - You must have /proc file system support as the stub wants to open
	   /proc/<pid>/exe and needs /proc/<pid>/fd/X. This also means that you
	   cannot compress programs that are used during the boot sequence
	   before /proc is mounted.

	 - Utilities like `top' will display numerical values in the process
	   name field. This is because Linux computes the process name from
	   the first argument of the last execve syscall (which is typically
	   something like /proc/<pid>/fd/3).

	 - Because of temporary decompression to disk the decompression speed
	   is not as fast as with the other executable formats. Still, I can see
	   no noticeable delay when starting programs like my ~3 MiB emacs (which
	   is less than 1 MiB when compressed :-).

       Extra options available for this executable format:

	 --force-execve	     Force the use of the generic linux/386 "execve"
			     format, i.e. do not try the linux/elf386 and
			     linux/sh386 formats.

   NOTES FOR PS1/EXE
       This is the executable format used by the Sony PlayStation (PSone), a
       Mips R3000 based gaming console which is popular since the late '90s.
       Support of this format is very similar to the Atari one, because of
       nostalgic feelings of one of the authors.

       Packed programs will be byte-identical to the original after
       uncompression, until further notice.

       Maximum uncompressed size: ~1.89 / ~7.60 MiB.

       Notes:

	 - UPX creates as default a suitable executable for CD-Mastering
	   and console transfer. For a CD-Master main executable you could also try
	   the special option "--boot-only" as described below.
	   It has been reported that upx packed executables are fully compatible with
	   the Sony PlayStation 2 (PS2, PStwo) and Sony PlayStation Portable (PSP) in
	   Sony PlayStation (PSone) emulation mode.

	 - Normally the packed files use the same memory areas like the uncompressed
	   versions, so they will not override other memory areas while unpacking.
	   If this isn't possible UPX will abort showing a 'packed data overlap'
	   error. With the "--force" option UPX will relocate the loading address
	   for the packed file, but this isn't a real problem if it is a single or
	   the main executable.

       Extra options available for this executable format:

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --8-bit	     Uses 8 bit size compression [default: 32 bit]

	 --8mib-ram	     PSone has 8 MiB ram available [default: 2 MiB]

	 --boot-only	     This format is for main exes and CD-Mastering only !
			     It may slightly improve the compression ratio,
			     decompression routines are faster than default ones.
			     But it cannot be used for console transfer !

	 --no-align	     This option disables CD mode 2 data sector format
			     alignment. May slightly improves the compression ratio,
			     but the compressed executable will not boot from a CD.
			     Use it for console transfer only !

   NOTES FOR RTM32/PE and ARM/PE
       Same as win32/pe.

   NOTES FOR TMT/ADAM
       This format is used by the TMT Pascal compiler - see
       http://www.tmt.com/ .

       Extra options available for this executable format:

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

   NOTES FOR VMLINUZ/386
       The vmlinuz/386 and bvmlinuz/386 formats take a gzip-compressed
       bootable Linux kernel image ("vmlinuz", "zImage", "bzImage"), gzip-
       decompress it and re-compress it with the UPX compression method.

       vmlinuz/386 is completely unrelated to the other Linux executable
       formats, and it does not share any of their drawbacks.

       Notes:

	 - Be sure that "vmlinuz/386" or "bvmlinuz/386" is displayed
	 during compression - otherwise a wrong executable format
	 may have been used, and the kernel won't boot.

       Benefits:

	 - Better compression (but note that the kernel was already compressed,
	 so the improvement is not as large as with other formats).
	 Still, the bytes saved may be essential for special needs like
	 boot disks.

	    For example, this is what I get for my 2.2.16 kernel:
	       1589708	vmlinux
		641073	bzImage	       [original]
		560755	bzImage.upx    [compressed by "upx -9"]

	 - Much faster decompression at kernel boot time (but kernel
	   decompression speed is not really an issue these days).

       Drawbacks:

	 (none)

       Extra options available for this executable format:

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

   NOTES FOR WATCOM/LE
       UPX has been successfully tested with the following extenders:
	 DOS4G, DOS4GW, PMODE/W, DOS32a, CauseWay.
	 The WDOS/X extender is partly supported (for details
	 see the file bugs BUGS).

       DLLs and the LX format are not supported.

       Extra options available for this executable format:

	 --le		     Produce an unbound LE output instead of
			     keeping the current stub.

   NOTES FOR WIN32/PE
       The PE support in UPX is quite stable now, but probably there are still
       some incompatibilities with some files.

       Because of the way UPX (and other packers for this format) works, you
       can see increased memory usage of your compressed files because the
       whole program is loaded into memory at startup.	If you start several
       instances of huge compressed programs you're wasting memory because the
       common segments of the program won't get shared across the instances.
       On the other hand if you're compressing only smaller programs, or
       running only one instance of larger programs, then this penalty is
       smaller, but it's still there.

       If you're running executables from network, then compressed programs
       will load faster, and require less bandwidth during execution.

       DLLs are supported. But UPX compressed DLLs can not share common data
       and code when they got used by multiple applications. So compressing
       msvcrt.dll is a waste of memory, but compressing the dll plugins of a
       particular application may be a better idea.

       Screensavers are supported, with the restriction that the filename must
       end with ".scr" (as screensavers are handled slightly different than
       normal exe files).

       UPX compressed PE files have some minor memory overhead (usually in the
       10 - 30 KiB range) which can be seen by specifying the "-i" command
       line switch during compression.

       Extra options available for this executable format:

	--compress-exports=0 Don't compress the export section.
			     Use this if you plan to run the compressed
			     program under Wine.
	--compress-exports=1 Compress the export section. [DEFAULT]
			     Compression of the export section can improve the
			     compression ratio quite a bit but may not work
			     with all programs (like winword.exe).
			     UPX never compresses the export section of a DLL
			     regardless of this option.

	 --compress-icons=0  Don't compress any icons.
	 --compress-icons=1  Compress all but the first icon.
	 --compress-icons=2  Compress all icons which are not in the
			     first icon directory. [DEFAULT]
	 --compress-icons=3  Compress all icons.

	 --compress-resources=0	 Don't compress any resources at all.

	 --keep-resource=list Don't compress resources specified by the list.
			     The members of the list are separated by commas.
			     A list member has the following format: I<type[/name]>.
			     I<Type> is the type of the resource. Standard types
			     must be specified as decimal numbers, user types can be
			     specified by decimal IDs or strings. I<Name> is the
			     identifier of the resource. It can be a decimal number
			     or a string. For example:

			     --keep-resource=2/MYBITMAP,5,6/12345

			     UPX won't compress the named bitmap resource "MYBITMAP",
			     it leaves every dialog (5) resource uncompressed, and
			     it won't touch the string table resource with identifier
			     12345.

	 --force	     Force compression even when there is an
			     unexpected value in a header field.
			     Use with care.

	 --strip-relocs=0    Don't strip relocation records.
	 --strip-relocs=1    Strip relocation records. [DEFAULT]
			     This option only works on executables with base
			     address greater or equal to 0x400000. Usually the
			     compressed files becomes smaller, but some files
			     may become larger. Note that the resulting file will
			     not work under Windows 3.x (Win32s).
			     UPX never strips relocations from a DLL
			     regardless of this option.

	 --all-methods	     Compress the program several times, using all
			     available compression methods. This may improve
			     the compression ratio in some cases, but usually
			     the default method gives the best results anyway.

	 --all-filters	     Compress the program several times, using all
			     available preprocessing filters. This may improve
			     the compression ratio in some cases, but usually
			     the default filter gives the best results anyway.

DIAGNOSTICS
       Exit status is normally 0; if an error occurs, exit status is 1. If a
       warning occurs, exit status is 2.

       UPX's diagnostics are intended to be self-explanatory.

BUGS
       Please report all bugs immediately to the authors.

AUTHORS
	Markus F.X.J. Oberhumer <markus@oberhumer.com>
	http://www.oberhumer.com

	Laszlo Molnar <ezerotven+github@gmail.com>

	John F. Reiser <jreiser@BitWagon.com>

	Jens Medoch <jssg@users.sourceforge.net>

COPYRIGHT
       Copyright (C) 1996-2017 Markus Franz Xaver Johannes Oberhumer

       Copyright (C) 1996-2017 Laszlo Molnar

       Copyright (C) 2000-2017 John F. Reiser

       Copyright (C) 2002-2017 Jens Medoch

       This program may be used freely, and you are welcome to redistribute it
       under certain conditions.

       This program is distributed in the hope that it will be useful, but
       WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the UPX
       License Agreement for more details.

       You should have received a copy of the UPX License Agreement along with
       this program; see the file /usr/share/doc/upx-ucl/copyright. If not,
       visit the UPX home page.

upx 3.94			  2017-05-12				UPX(1)
[top]

List of man pages available for Kali

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net