Hi folks,
after some emails asking help to find out a good binary packer for OS X, I decided to write a little post on the topic.
Of course there are many binary packers out there, but today I am going to write about UPX (Ultimate Packer for eXecutables) for two main reasons: first of all because it supports many different executables formats as shown in the following table:
And second it offers a great compressing ratio, for example Netscape 4.06 (Window/PE) uncompressed is 2866KB while compressed becomes 1098KB a great ratio of 0.38. The following table shows some more results on its compression ratio
Last but not least it’s an open-source project that runs perfectly on MAC platforms. Before compiling the source code you need UCL (UCL is a portable lossless data compression library written in ANSI C) installed on your MAC. MAC port helps us, so just type: sudo port install ucl it will be enough ;). After that just type make and sudo make install. Some people had troubles in compiling the libraries, in-fact some errors due to missing libraries could happen even if officially it depends only from UCL. So If you have trouble with the compiling process you can download UPX-FOR-MAC directly here.
Once you’ve compiled it (or downloaded from here ) you may try to test it in the following way:
1) Lets compress itself and see what happens
2) Lets give back executable rights to the resulting file (typing: chmod +x upx-compressed). We now are able to execute the macho file even if compressed. BTW we discussed about how it is possible that a compressed executable can still be executed in previous posts, but anyway, the compression process puts in the “top” of the execution chain a stub able to decompress the remaining data during runtime (of course the execution time will be little bit longer since the decompression procedure).
3) Lets compare the sizes. The above picture shows the different size of both macho files: the compressed executable 707K and the uncompressed one 3.2M. Well, what cha we say if not good job UPX folks !
It cannot have effect in reality, that is what I think.