Sietse Fliege said:
About UPX:
There has been a very usefull discussion once, here in a.c.f.
http://tinyurl.com/2sy4l
<
http://groups.google.com/[email protected]>
I'm glad you bring this up. There is a common misunderstanding around,
about PE file sizes. People praise an exe's file size and compare it with
others, without taking into account whether they're viewing it at its native
size - or instead a compressed version of it. The conclusion of Marek's post
in that thread, it is similar to what he notes in is FAQ for KeyNote.
| That said, I'll eventually start compressing my applications with UPX,
| because of the number of questions and complaints I see regarding file
| size. Whenever one of my apps gets compared to App X and App X is
| smaller, I download it and see that App X has been compressed. Every
| time. Pure illusion, pure marketing, pure perception, no real gain at
| all, but there you are
It was not that long back, less than a couple of years ago, when I'd become
aware of the issues surrounding compressed sizes. I did some amount of
searching and reading on the subject. My general conclusion is that there
are two kinds of cases in which it would be to your advantage to have your
local PE's compressed. One is for floppy disk use (limited storage space)
and the other is in network server-client setup (I read that performance
actually improves in this scenario, with a compressed program).
Other than that, you'll either barely break even, or you'll lose, as far
as memory use. If you run multiple instances of program, or it is big, then
that is when you especially should not want to use a compressed version
of it.
Now, the thread you mention, especially Marek's post, it makes for
particularly valuable reading for me. It addresses the subject of measuring
the memory hit difference when running a compressed instance of a program,
compared to one that is in native form. As a non-programmer sort, there is
a measure of shallowness in my comprehensions in this realm. Such that I
could never have written on the subject as he did. At the same time, the
thoughtful explanations in his article bring for me good light on the
picture.
.. . .
All right, despite the complexities involved with measuring, I've still
been satisfied with some simple output results, on those various occasions
when I checked. The most recent time was when I uncompressed Irfanview's
executable. The memory use is reduced to 80%.
Memload readout for Irfanview (w/ no file loaded).
IrV uncompressed: -4.5mb
IrV compressed: -5.4mb
IrV uncompressed, run 3 instances: -13.4mb
IrV compressed, run 3 instances: -16.1mb
It is common now for folks to have a great deal of RAM, so perhaps results
like the above seem trivial to them. Yet it doesn't change the point, that
using the PE in compressed state generally comes at some measure of cost.
I note in passing that there are corollary issues, beyond RAM use, such as
the time spent for the whole compressed executable to decompress each time
it is called up for launch (or when it is being scanned by an AV). Here
again, I do not have adequate depth of comprehension to much speak long on
the subject. It's instead those insightful programmers - as those in the
referenced thread - who are able to discuss with authority the subject of
the things that go on when a compressed PE is run....
.. . .
Also, I came across FindUPX [22k exe]
http://fromwithin.com/software.html
"A Win32 command-line program to search through a bunch of files and
report any files that have been compressed with the UPX executable
compressor. I needed this because I compressed a bunch of windows DLLs
which then stopped compiled windows help files from displaying any more.
I couldn't find the DLL that I had compressed, so wrote this to find
it."
Thanks, Sietse, I'll have to download and check it out.
Another. Not a tiny, UPX-specific tool like the one above. But a larger
utility that includes similar ability. Scanning a path for compressed
PEa's. It's "PE Tools."
http://www.uinc.ru/files/neox/PE_Tools.shtml
I really value this one. I have it on my context menu, and use it quite
often for a quick read on what language a program is written in, or else
what PE compressor was used.
When the v1.5 version added the directory scan feature, I was really
pleased. Below is a truncated excerpt from a directory scan (options
include saving to text file):
| D:\EDZ\npads\txt\TT\SDI\cooljot\CoolJot.exe - [Microsoft Visual Basic v5.0]
| D:\EDZ\npads\txt\TT\SDI\ed2x\2xEditor.exe - [Microsoft Visual C++ v5.0/v6.0 (MFC)]
| D:\EDZ\npads\txt\TT\SDI\gun\gun.exe - [UPX v0.80 - v0.84]
| D:\EDZ\npads\txt\TT\SDI\misc\ed99\editor.exe - [Microsoft Visual C++ v5.0/v6.0 (MFC)]
| D:\EDZ\npads\txt\TT\SDI\misc\eq\eq.exe - [Microsoft Visual Basic v5.0]
| D:\EDZ\npads\txt\TT\SDI\misc\NotePare\NotePare.exe - [Unknown]
| D:\EDZ\npads\txt\TT\SDI\misc\expad\ExtremePad.exe - [Borland C++ for Win32 1995]
| D:\EDZ\npads\txt\TT\SDI\misc\gplite\GPlite.exe - [UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub]
| D:\EDZ\npads\txt\TT\SDI\misc\bpp\bpp.exe - [Microsoft Visual Basic v5.0]
| D:\EDZ\npads\txt\TT\SDI\np2\NP2.exe - [Microsoft Visual C++ v5.0/v6.0 (MFC)]
| D:\EDZ\npads\txt\TT\SDI\notehalf\NoteHalf.exe - [Microsoft Visual Basic v5.0]
| D:\EDZ\npads\txt\TT\SDI\pitpad\PitPad.exe - [Unknown]
| D:\EDZ\npads\txt\TT\SDI\pronotes\ProNotes32.exe - [Unknown]
| D:\EDZ\npads\txt\TT\SDI\ted\Ted.exe - [ASPack v2.12]
| D:\EDZ\npads\txt\TT\SDI\ted\Lgi.dll - [ASPack v2.12]
| D:\EDZ\npads\txt\TT\SDI\notex\notex.exe - [Unknown]
| D:\EDZ\npads\txt\TT\SDI\edxor\edxor.exe - [UPX v0.80 - v0.84]
| D:\EDZ\npads\txt\TT\SDI\edxor\zip\edxor_setup.exe - [UPX v0.80 - v0.84]
.. . .
You might guess from my directory scan here, I haven't decompressed much.
Which I could - with UPX (and I also have an ASPack decompresser). It's
in part a matter of spending the time; and in other part, a matter of
considering how my dupes searches, and related, would be affected.
Sometimes, though, I do, pointedly, decompress an exe. Irfanview was my
most recent. These programs are compressed in the first place only for that
certain motive, that their "small size" can be praised.