Home/ Questions/Q 3670806
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T02:24:36+00:00

I’m trying to figure out how to detect whether a binary has been compressed

  • 0

I’m trying to figure out how to detect whether a binary has been compressed with UPX. I am using a simple CRC to detect whether my app was in any way changed and if the CRC failed on the size due to a packer I would like to detect that as OK.

Right now I am starting with UPX.

So, is there any marker on the binary? are there any specific JMP or other instructions that I should search?
This will mainly be tested in Windows, but in the future I might add it to Linux as well.

Any help (and code) is appreciated.

ADDED:

I found that in the 10 binaries I checked the

AddressOfEntryPoint
Import Directory RVA
Resouce Directory RVA

either point to UPX or have an offset that is set by UPX. Any information on this?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You might try checking the section names of the executable. UPX changes them to UPX0, UPX1, UPX2, I believe.

    • 0