3 ms·
Does UPX still trigger virus scanners, though? As much as I like the idea of tinier binaries, the chance that your user's endpoint security is going to freak ou
by Karunamon 6y ago
Does UPX still trigger virus scanners, though? As much as I like the idea of tinier binaries, the chance that your user's endpoint security is going to freak out makes it not worth the hassle.
- alternatetwo 6y agoNever mind that, startup times are atrocious with such a huge upx packed binary ...
- distortedsignal 6y agoThat's an interesting point. I hadn't tested the startup times of the upx binary before, so I just did by running `time $binary_name --help`. For my binary, this should print a simple help message and quit. Big: 0.04s user 0.01s system 101% cpu 0.054 total Med: 0.04s user 0.01s system 99% cpu 0.048 total Sm : 0.14s user 0.02s system 99% cpu 0.163 total So you're right - it makes execution time take about 3x as long. However, in my case, 3x slower is a fine trade off to make.
- devonkim 6y agoUPX binaries throw off most endpoint security models and so we have a chicken and egg problem where its more common use is for malware authors than commercial software vendors. But once UPX binary signatures are in significantly wider use new models can be developed to better score legit binaries.
- distortedsignal 6y agoI don't think UPX triggers (my) virus scanner. The McAfee daemon on my work laptop barfs at the EICAR Test File (https://kc.mcafee.com/corporate/index?page=content&id=KB59742 https://kc.mcafee.com/corporate/index?page=content&id=KB5974...) but it ignores the UPX binary right next to it.
- readams 6y agoVirus scanners just treat UPX as a compressed file format and scan the binary inside.
- corty 6y agoSome scanners also treat UPX as generally malicious.