upx.1

Cracker终结者——提供最优秀的软件保护技术

.rn '' }`
''' $RCSfile$$Revision$$Date$
'''
''' $Log$
'''
.de Sh
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp
.if t .sp .5v
.if n .sp
..
.de Ip
.br
.ie \\n(.$>=3 .ne \\$3
.el .ne 3
.IP "\\$1" \\$2
..
.de Vb
.ft CW
.nf
.ne \\$1
..
.de Ve
.ft R

.fi
..
'''
'''
'''     Set up \*(-- to give an unbreakable dash;
'''     string Tr holds user defined translation string.
'''     Bell System Logo is used as a dummy character.
'''
.tr \(*W-|\(bv\*(Tr
.ie n \{\
.ds -- \(*W-
.ds PI pi
.if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
.ds L" ""
.ds R" ""
'''   \*(M", \*(S", \*(N" and \*(T" are the equivalent of
'''   \*(L" and \*(R", except that they are used on ".xx" lines,
'''   such as .IP and .SH, which do another additional levels of
'''   double-quote interpretation
.ds M" """
.ds S" """
.ds N" """""
.ds T" """""
.ds L' '
.ds R' '
.ds M' '
.ds S' '
.ds N' '
.ds T' '
'br\}
.el\{\
.ds -- \(em\|
.tr \*(Tr
.ds L" ``
.ds R" ''
.ds M" ``
.ds S" ''
.ds N" ``
.ds T" ''
.ds L' `
.ds R' '
.ds M' `
.ds S' '
.ds N' `
.ds T' '
.ds PI \(*p
'br\}
.\"	If the F register is turned on, we'll generate
.\"	index entries out stderr for the following things:
.\"		TH	Title
.\"		SH	Header
.\"		Sh	Subsection
.\"		Ip	Item
.\"		X<>	Xref  (embedded
.\"	Of course, you have to process the output yourself
.\"	in some meaninful fashion.
.if \nF \{
.de IX
.tm Index:\\$1\t\\n%\t"\\$2"
..
.nr % 0
.rr F
.\}
.TH UPX 1 "upx 1.01" "09 Apr 2000" " "
.UC
.if n .hy 0
.if n .na
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.de CQ          \" put $1 in typewriter font
.ft CW
'if n "\c
'if t \\&\\$1\c
'if n \\&\\$1\c
'if n \&"
\\&\\$2 \\$3 \\$4 \\$5 \\$6 \\$7
'.ft R
..
.\" @(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2
.	\" AM - accent mark definitions
.bd B 3
.	\" fudge factors for nroff and troff
.if n \{\
.	ds #H 0
.	ds #V .8m
.	ds #F .3m
.	ds #[ \f1
.	ds #] \fP
.\}
.if t \{\
.	ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.	ds #V .6m
.	ds #F 0
.	ds #[ \&
.	ds #] \&
.\}
.	\" simple accents for nroff and troff
.if n \{\
.	ds ' \&
.	ds ` \&
.	ds ^ \&
.	ds , \&
.	ds ~ ~
.	ds ? ?
.	ds ! !
.	ds /
.	ds q
.\}
.if t \{\
.	ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.	ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.	ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.	ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.	ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.	ds ? \s-2c\h'-\w'c'u*7/10'\u\h'\*(#H'\zi\d\s+2\h'\w'c'u*8/10'
.	ds ! \s-2\(or\s+2\h'-\w'\(or'u'\v'-.8m'.\v'.8m'
.	ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.	ds q o\h'-\w'o'u*8/10'\s-4\v'.4m'\z\(*i\v'-.4m'\s+4\h'\w'o'u*8/10'
.\}
.	\" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds v \\k:\h'-(\\n(.wu*9/10-\*(#H)'\v'-\*(#V'\*(#[\s-4v\s0\v'\*(#V'\h'|\\n:u'\*(#]
.ds _ \\k:\h'-(\\n(.wu*9/10-\*(#H+(\*(#F*2/3))'\v'-.4m'\z\(hy\v'.4m'\h'|\\n:u'
.ds . \\k:\h'-(\\n(.wu*8/10)'\v'\*(#V*4/10'\z.\v'-\*(#V*4/10'\h'|\\n:u'
.ds 3 \*(#[\v'.2m'\s-2\&3\s0\v'-.2m'\*(#]
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.ds oe o\h'-(\w'o'u*4/10)'e
.ds Oe O\h'-(\w'O'u*4/10)'E
.	\" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.	\" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.	ds : e
.	ds 8 ss
.	ds v \h'-1'\o'\(aa\(ga'
.	ds _ \h'-1'^
.	ds . \h'-1'.
.	ds 3 3
.	ds o a
.	ds d- d\h'-1'\(ga
.	ds D- D\h'-1'\(hy
.	ds th \o'bp'
.	ds Th \o'LP'
.	ds ae ae
.	ds Ae AE
.	ds oe oe
.	ds Oe OE
.\}
.rm #[ #] #H #V #F C
.SH "NAME"
upx \- compress or expand executable files
.SH "SYNOPSIS"
\fBupx\fR [\ \fIcommand\fR\ ] [\ \fIoptions\fR\ ] \fIfilename\fR...
.SH "ABSTRACT"
.PP
.Vb 5
\&            The Ultimate Packer for eXecutables
\&  Copyright (c) 1996-2000 Markus Oberhumer & Laszlo Molnar
\&       http://wildsau.idv.uni-linz.ac.at/mfx/upx.html
\&                  http://www.nexus.hu/upx
\&                    http://upx.tsx.org
.Ve
\fBUPX\fR is a portable, extendable, high-performance executable packer for
several different executable formats. It achieves an excellent compression
ratio and offers \fI*very*\fR fast decompression. Your executables suffer
no memory overhead or other drawbacks for most of the formats supported.
.PP
While you may use UPX freely for both non-commercial and commercial
executables (for details see the file LICENSE), we would highly
appreciate if you credit UPX and ourselves in the documentation,
possibly including a reference to the UPX home page. Thanks.
.PP
[ Using UPX in non-OpenSource applications without proper credits
is considered not politically correct ;\-) ]
.SH "DISCLAIMER"
UPX comes with ABSOLUTELY NO WARRANTY; for details see the file LICENSE.
.PP
Having said that, we think that UPX is quite stable now. Indeed we
have compressed lots of files without any problems. Also, the
current version has undergone several months of beta testing \-
actually it's almost 2 years since our first public beta.
.PP
This is the first production quality release, and we plan that future 1.xx
releases will be backward compatible with this version.
.PP
Please report all problems or suggestions to the authors. Thanks.
.SH "DESCRIPTION"
\fBUPX\fR is a versatile executable packer with the following features:
.PP
.Vb 2
\&  - excellent compression ratio: compresses better than zip/gzip,
\&      use UPX to decrease the size of your distribution !
.Ve
.Vb 1
\&  - very fast decompression: about 10 MB/sec even on my old Pentium 133
.Ve
.Vb 2
\&  - no memory overhead for your compressed executables for most of the
\&      supported formats
.Ve
.Vb 3
\&  - safe: you can list, test and unpack your executables
\&      Also, a checksum of both the compressed and uncompressed file is
\&      maintained internally.
.Ve
.Vb 11
\&  - universal: UPX can pack a number of executable formats:
\&      * dos/exe
\&      * dos/sys
\&      * dos/com
\&      * djgpp2/coff
\&      * watcom/le (supporting DOS4G, PMODE/W, DOS32a and CauseWay)
\&      * win32/pe
\&      * rtm32/pe
\&      * tmt/adam
\&      * linux/i386
\&      * atari/tos
.Ve
.Vb 1
\&  - portable: UPX is written in portable endian-neutral C++
.Ve
.Vb 2
\&  - extendable: because of the class layout it's very easy to support
\&      new executable formats or add new compression algorithms
.Ve
.Vb 3
\&  - free: UPX can be distributed and used freely. And from version 0.99
\&      the full source code of UPX is released under the GNU General Public
\&      License (GPL) !
.Ve
You probably understand now why we call UPX the \*(L"\fIultimate\fR\*(R"
executable packer.
.SH "COMMANDS"
.Sh "Compress"
This is the default operation, eg. \fBupx yourfile.exe\fR will compress the file
specified on the command line.
.Sh "Decompress"
All \s-1UPX\s0 supported file formats can be unpacked using the \fB\-d\fR switch, eg.
\fBupx \-d yourfile.exe\fR will uncompress the file you've just compressed.
.Sh "Test"
The \fB\-t\fR command tests the integrity of the compressed and uncompressed
data, eg. \fBupx \-t yourfile.exe\fR check whether your file can be safely
decompressed. Note, that this command doesn't check the whole file, only
the part that will be uncompressed during program execution. This means
that you should not use this command instead of a virus checker.
.Sh "List"
The \fB\-l\fR command prints out some information about the compressed files
specified on the command line as parameters, eg \fBupx \-l yourfile.exe\fR
shows the compressed / uncompressed size and the compression ratio of
\fIyourfile.exe\fR.
.SH "OPTIONS"
\fB\-q\fR: be quiet, suppress warnings
.PP
\fB\-q \-q\fR (or \fB\-qq\fR): be very quiet, suppress errors
.PP
\fB\-q \-q \-q\fR (or \fB\-qqq\fR): produce no output at all
.PP
\fB--help\fR: prints the help
.PP
\fB--version\fR: print the version of UPX
.PP
\fB--stdout\fR: writes all output to stdout
.PP
[ ...to be written... \- type `\fBupx --help\fR\*(R' for now ]
.SH "COMPRESSION LEVELS & TUNING"
\fBUPX\fR offers ten different compression levels from \fB\-1\fR to \fB\-9\fR,
and \fB--best\fR.  The default compression level is \fB\-7\fR.
.Ip "\(bu" 4
Compression levels 1, 2 and 3 are pretty fast.
.Ip "\(bu" 4
Compression levels 4, 5 and 6 achieve a good time/ratio performance.
.Ip "\(bu" 4
Compression levels 7, 8 and 9 favor compression ratio over speed.
.Ip "\(bu" 4
Compression level \fB--best\fR may take a very long time.
.PP
Note that compression level \fB\-9\fR can be quite slow for some large
files, but you definitely should use it when releasing a final version
of your program. (E.g. it took about 20 minutes to compress the almost
5 \s-1MB\s0 \s-1MAME\s0 0.34 with \fB\-9\fR on my Pentium 133, but the resulting executable
was still ~65 kB smaller than when using \fB\-7\fR.)
.PP
Since \s-1UPX\s0 0.70 there is also an extra compression level \fB--best\fR which
squeezes out even some more compression ratio. While it is usually fine
to use this option with your favorite .com file it may take several hours
to compress a multi-megabyte program. You have been warned.
.PP
Tips for even better compression:
.Ip "\(bu" 4
Try if \fB--overlay=strip\fR works.
.Ip "\(bu" 4
For win32/pe programs there's \fB--strip-relocs=0\fR. See notes below.
.SH "OVERLAY HANDLING OPTIONS"
\fBUPX\fR handles overlays like many other executable packers do: it simply
copies the overlay after the compressed image. This works with some
files, but doesn't work with others.
.PP
Since version 0.90 UPX defaults to \fB--overlay=copy\fR for
all executable formats.
.PP
.Vb 1
\&  --overlay=copy    Copy any extra data attached to the file. [DEFAULT]
.Ve
.Vb 3
\&  --overlay=strip   Strip any overlay from the program instead of
\&                    copying it. Be warned, this may make the compressed
\&                    program crash or otherwise unusable.
.Ve
.Vb 1
\&  --overlay=skip    Refuse to compress any program which has an overlay.
.Ve
.SH "ENVIRONMENT"
The environment variable \fBUPX\fR can hold a set of default
options for UPX. These options are interpreted first and
can be overwritten by explicit command line parameters.
For example:
.PP
.Vb 3
\&    for DOS/Windows:   set UPX=-9 --compress-icons#1
\&    for sh/ksh/zsh:    UPX="-9 --compress-icons=1"; export UPX
\&    for csh/tcsh:      setenv UPX "-9 --compress-icons=1"
.Ve
Under DOS/Windows you must use \*(L'#\*(R' instead of \*(L'=\*(R' when setting the
environment variable because of a command.com limitiation.
.PP
On Vax/VMS, the name of the environment variable is
UPX_OPT, to avoid a conflict with the symbol set for
invocation of the program.
.PP
Not all of the options are valid in the environment variable \-
UPX will tell you.
.PP
You can use the \fB--no-env\fR option to turn this support off.
.SH "NOTES FOR THE SUPPORTED EXECUTABLE FORMATS"
.Sh "\s-1NOTES\s0 \s-1FOR\s0 \s-1ATARI/TOS\s0"
This is the executable format used by the Atari \s-1ST\s0, a 68000 based
personal computer which was popular in the late \*(L'80s. Support
of this format is only because of nostalgic feelings of one of
the authors and serves no practical purpose :\-).
.PP
Packed programs will be byte-identical to the original after uncompression.
All debug information will be stripped, though.
.PP
Extra options available for this executable format:
.PP
.Vb 1
\&  (none)
.Ve
.Sh "\s-1NOTES\s0 \s-1FOR\s0 \s-1DOS/COM\s0"
Obviously \s-1UPX\s0 won't work with executables that want to read data from
themselves (like some commandline utilities that ship with Win95/98).
.PP
Compressed programs only work on a 286+.
.PP
Packed programs will be byte-identical to the original after uncompression.
.PP
Maximum uncompressed size: ~65100 bytes.
.PP