UPX works kinda like a winzip self extractor. The header of the exe is the UPX stub. It reads the rest of the exe file, and uncompresses it into memory. Then the exe sets the execution pointer to the point in memory where it extracted the infromation.

The only problem with UPX is that many anti virus programs flags UPX compressed EXEs becasue UPX is often used to hide virus's and trojans key signatures.

Last edited by basicer; 15/06/06 11:51 PM.