UPX最好的压缩方法是什么
我最近一直在尝试不同的 EXE 加壳器。我尝试了 ASPack、UPX、mPress 等。在尝试了六种加壳程序时，我发现大多数加壳的 EXE 都会触发错误的病毒签名。就连UPX也不例外。尽管如此，我的选择还是UPX。有人可以建议我 UPX 中可用的最佳压缩/打包方法是什么吗？
我对 UPX 相当满意 --lzma myEXE.eXE 尽管如此，我还是很想听听你们的意见。 我对 UPX --ultra --brute myEXE.EXE 不太满意，因为它要花几个小时才能完成这个任务。
I Have been trying out different EXE packers recently. I tried out ASPack, UPX, mPress etc.. While trying out half a dozen packers, i observed that most of the packed EXE's can trigger false virus signatures. Even UPX is no exception. Still, my choice is UPX. Can anybody, please, suggest me what is the best possible compression / packing method available in UPX.?
I am quite satisfied with UPX --lzma myEXE.eXE
still, would love to hear for you people on this.
I am not comfortable with UPX --ultra --brute myEXE.EXE since it eats up hours to do the trick.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我用过很多UPX，版本之间没有太大区别。
最新的
--lzma设置产生了非常好的效果，而--ultra --brute确实不值得花费时间。最好的情况是 1% 的更好压缩率...您应该更好地对内部位图进行二次采样或重构代码。但是，特别是对于 Delphi 应用程序，我不再使用 UPX。您谈到防病毒软件误报，这是一个大问题。例如，听起来好像某些“廉价”防病毒软件引入了非常简单（且错误）的启发式模式，例如“UPX+Delphi=潜在恶意软件”或“Delphi+size<300KB=潜在恶意软件”。
如果您尝试将此类可执行文件提交到 http://virustotal.com，您会发现大约 8% 的防病毒引擎正在做这样错误的猜测。
因此，我看到我的一些网站被标记为“恶意软件 URI”。我看到一些客户抱怨我的交货感染了他们的计算机。不值得。
因此，为了减少可执行文件的大小，我更依赖于：
I used UPX a lot, and there was not a big difference between the versions.
The latest
--lzmasetting produces very good results, and--ultra --bruteis indeed not worth the time spent. At best, 1% of better compression rate... you should better subsample your internal bitmaps or refactorize the code.But, especially with Delphi applications, I do not use UPX any more. You spoke about anti-virus software false positive, and it is a huge problem. For instance, it sounds like if some "cheap" anti-virus software introduced very simple (and false) heuristic patterns, like "UPX+Delphi=potential malware" or "Delphi+size<300KB=potential malware".
If you try to submit such executable files to http://virustotal.com, you'll find out that about 8% of the anti-virus engines are doing such wrong guess.
I've seen some of my web sites flagged as "malware URI", because of this. I've seen some customers complaining about my deliveries to be infecting their computers. Not worth it.
To reduce the executable size, I therefore rely rather: