Packing executables

One of the biggest challenges with embedding platforms is the limitation related to file sizes. Here is the hint how to make executables smaller - strip them and pack them:

  • strip is a tool from GNU binutils, it discards symbols. Usually the platform toolchain has one.
  • upx is an excellent executable packer. Can be downloaded as binary or sources from the UPX sf.net site.

As an example, I'll show you the packing of Python 2.6.7 binary:

$ ls -s --block-size=KB python
6493kB python
$ strip -s python
$ ls -s --block-size=KB python
1696kB python
$ upx --best python
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2010
UPX 3.05        Markus Oberhumer, Laszlo Molnar & John Reiser   Apr 27th 2010

         File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   1692400 ->    608896   35.98%  linux/ElfAMD   python

 Packed 1 file.
$ ls -s --block-size=KB python
611kB python

So, we've got 10:1 ratio, very impressive! :-)

Stripping is a very useful method, it saves a lot of the file size in our case. However, sometimes it doesn't help at all (depending of the executable and the way it was built). So try it before use; and let me show an example of packing without stripping:

$ ls -s --block-size=KB python
6493kB python
$ upx --best python
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2010
UPX 3.05        Markus Oberhumer, Laszlo Molnar & John Reiser   Apr 27th 2010

         File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
   6489682 ->   2029592   31.27%  linux/ElfAMD   python

 Packed 1 file.
$ ls -s --block-size=KB python
2032kB python

The ratio is not so good, and it was really slower. So please consider various ways to pack your files. Also don't forget to check the Wikipedia page "Executable compression".

P.S. Please note that packing executables can break its functionality. For example (from my experience), upx sometimes breaks applications which use frozen Python modules.

Comments

Post a Comment

Popular posts from this blog

Web application framework comparison by memory consumption

Memory consumption is slightly specific to my area of software development now, but I did some research recently and maybe these results can be useful for others. Of course, I know that precious comparison is very difficult to carry out, but actually I needed only overall picture. And let me admit that results are pretty interesting and even frustrated (at least for me). As a basis I took so-starving project, and measured initial RSS (Resident Set Size) of the each process (local development webservers). Platform: x86_64 Linux (latest Ubuntu with all updates). As a reference, here is the RSS of the interpreters in interactive console mode: Interpreter Version RSS (kB) stackless python 2.6.4 3916 ruby (via irb) 1.8.7 4664 python 2.7.1 5624 php 5.3.5 6924 v8 (via node.js shell) 2.5.9.9 8796 One more reference - the most simplest WSGI app ( example  in the Python documentation). It's RSS: 7336 Kb , so I assume it's almost impossible to consume l
Read more

Trac Ticket Workflow

Trac is the wiki and issue tracking system that is the most used for my software development projects. Let me share few hints about its ticket workflow, especially about the statuses, the roles of the participants, and let me give an example of the workflow config. But if you are interested in other things like Trac plugins, source browser, customizing, etc, let me know. All the information given below regards the workflow described at the end of the article. The original Trac workflow is missed vital features like the support for ticket verifying, or the required ticket statuses range, so I do not use it in my projects. The description of the main statuses: new - the ticket has been created; in-progress - the developer has began to work with the ticket; fixed - the ticket is fixed (the problem issued in the ticket is solved); verified - the ticket is verified (tester or PM has verified that the ticket is fixed correctly); closed - the ticket is closed (it's not
Read more

Shellcode detection using libemu

Shellcode can be seen as a list of instructions that has been developed in a manner that allows it to be injected in an application during runtime. Each security researcher face the shellcodes during their work, and in this article I'll show how to detect shellcodes using Python (via libemu Python binding). Few words about libemu : libemu is a small library written in C offering basic x86 emulation and shellcode detection using GetPC heuristics. Intended use is within network intrusion/prevention detections and honeypots. The information on the site is not actual in some places, so I'll give direct and clear instruction how to get and install libemu. Clone the git repository: $ git clone git://git.carnivore.it/libemu.git Firstly, configure, make and install libemu itself (without binding): $ autoreconf -v -i $ ./configure --prefix=/opt/libemu $ make $ sudo make install If you set up prefix as shown above, you have to add the library path to /etc/ld.so.conf file
Read more