UPX — The Ultimate Packer for Executables

Introduction

UPX (Ultimate Packer for eXecutables) is a free, open-source executable compressor that works on Linux, macOS, and Windows binaries. It reduces binary size by 50-70% while keeping the output directly executable — no unpacking step or installer is needed. UPX is widely used in container images, embedded systems, and CLI tool distribution to shrink binary artifacts.

What UPX Does

• Compresses ELF, PE, Mach-O, and other executable formats in place
• Produces self-decompressing executables that run without an extraction step
• Supports multiple compression algorithms including LZMA, NRV, and zstd
• Preserves executable permissions and can decompress back to the original
• Works on static and dynamically linked binaries across architectures

Architecture Overview

UPX applies a compression stub to the front of the binary and stores the compressed payload after it. At runtime the stub decompresses the payload into memory and transfers control to the original entry point. The decompression overhead is typically a few milliseconds. UPX itself is written in C++ and uses the UCL compression library plus optional LZMA.

Self-Hosting & Configuration

• Install via package managers (apt, brew, choco) or download static binaries from GitHub releases
• No configuration files; all options are command-line flags
• Use --best for maximum compression or --ultra-brute for exhaustive optimization
• Add --strip-relocs to strip relocation records on Linux ELF binaries
• Integrate into Dockerfiles with a simple RUN upx --best /app to shrink final images

Key Features

• In-place compression — the output replaces the input file
• Decompression support with upx -d to restore the original binary
• Cross-platform: Linux (ELF), Windows (PE), macOS (Mach-O), DOS, and more
• No runtime dependency or library required on the target system
• Deterministic output when given the same input and flags

Comparison with Similar Tools

• strip — removes debug symbols but does not compress code; UPX compresses the entire binary
• Brotli/zstd — general-purpose compressors that produce archives; UPX produces runnable executables
• Docker multi-stage builds — reduce image layers; UPX further shrinks the binary inside the layer
• Go ldflags -s -w — strips debug info at compile time; UPX compresses on top of that
• Cosmopolitan — produces polyglot binaries; UPX focuses purely on size reduction

FAQ

Q: Does UPX slow down application startup? A: Decompression adds a few milliseconds. For long-running processes the overhead is negligible.

Q: Can I compress Go, Rust, or C++ binaries? A: Yes. UPX works on statically linked Go and Rust binaries. Dynamically linked C++ binaries work if the loader can map the decompressed segments.

Q: Is UPX safe for production containers? A: Yes. Many teams use UPX in Docker multi-stage builds to shrink final images by 50%+.

Q: Does UPX modify the binary signature? A: Yes. Code-signed binaries will lose their signature after compression. Re-sign after packing if needed.

Sources

• https://github.com/upx/upx
• https://upx.github.io