0
There are tools, such as UPX, that can compress executables (EXEs, DLLs, etc..). Aside from a reduced size footprint, are there any advantages (or disadvantages) to such compressed binaries? For example, will a 15 MB executable load faster or slower into memory after being compressed to 5 MB?
Will the reduced size footprint make the executable load faster?
Will the reduced size footprint cause a "decompression overhead" thus making the executable load slower?
None/Both of the above?
Makaveli84
Posted 2018-01-31T09:59:20.227
Reputation: 11
1It can't be faster except your disk is really slow and will probably be slower because of decompressing, but not in the range you will notice. – allo – 2018-01-31T10:02:50.263
The compressed EXE need to be decompressed in a temporary directory and after that it will be executed - how can it be faster than directly to execute the EXE? – duDE – 2018-01-31T10:15:59.977
1@duDE not all decompressors require temporary files to work. The whole point of UPX would be to decompress "in memory". Typically this is done by a "lazy loading" method whereby the actual executable part of the extractor is loaded without the compressed executable (probably <50Kb) and this decompressor then stream-decompresses the payload directly from disk into RAM and then jumps into the decompressed executable (in RAM) directly. No extra disk reads or writes and the only things limiting speed is the disk read speed and decompressor speed. Typically disk speed is the slower of the two. – Mokubai – 2018-01-31T12:45:34.900
The problem is in determining whether or not having the disk reading the uncompressed contents is actually slower than reading a smaller amount of data and then also decompressing it. The only real answer is going to be "it depends". Many modern programs probably will not be completely loaded into RAM (they get sections loaded "on demand") so potentially decompressing the entire executable is a waste of both time and memory and so is slower. Again... "it depends". Unless you know compression will help you I would assume it is a waste on modern systems. – Mokubai – 2018-01-31T13:11:13.643
@Mokubai: Clear and insightful. I was already leaning towards compression being "a waste" nowadays. I am more convinced now. – Makaveli84 – 2018-01-31T20:16:02.440
@duDE: As Mokubai mentioned, there is no disk reading overhead with UPX. Decompression is not performed on-disk nor are temporary directories involved. – Makaveli84 – 2018-01-31T20:18:31.260
@Mokubai Wow, never stop learning :) Thank you, very nice and educational info, maybe worth to be an answer instead of comment? – duDE – 2018-02-01T10:11:03.090