Is there a way to identify UPX'd exe files?

[grannyGeek]

Kind of an odd question I know, but ---

I know some developers pack their files to optimize file size.

I just stubbed my toes on something while using JauntePE, and am hoping someone can tell me a way to identify files that have been packed with UPX or other exe "packers".

thanks in advance for any input.

grannyGeek
Antique Newb

[m^(2)]

Google peid.

[M@tty]

Try to use Universal Extractor, it will tell you it can not be extracted but ask if you would like to unpack it.

Alternatively, try to unpack it using UPX (or one of the GUIs for it) directly, and see if it throws an error or not.

EDIT: Or as m^(2) said (1 second post time difference ), PEID. This is actually the tool that universal extractor uses to determine the type of executable, but Universal Extractor does the work for you. Your choice really.

[grannyGeek]

thanks, guys.
that will get me back on the right track.

[zikarus]

In addition to what has already been said:

Or you may simply try to UPX a file - if it does not change in size it most likely has been UPXed before (or cannot be UPXed):-)

[M@tty]

Or you may simply try to UPX a file - if it does not change in size it most likely has been UPXed before (or cannot be UPXed):-)

Trying to unpack it using UPX is a more surefire hit than this, as it removes the "Cannot be UPXed" possibilty - such as Thinstall'ed executables.

[redllar]

Two truly-geeky ways:

1) Open the executable with a hex editor, e.g. PSPad, scroll down a few lines, and you'll see UPX0 and UPX1 if it's upx'd, otherwise not.

2) Use a text extracting filter on the command line and then grep for 'UPX'.