TinyLoad
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
v3 is live. the Morphine VM engine we teased is now fully implemented and shipping in the main binary.
the old XOR is gone. every packed file now runs through a custom 20-opcode virtual machine with a randomly shuffled instruction set baked in at pack time. no two packed files share the same ISA.
with XOR, an analyst opens a debugger, sets a breakpoint on VirtualAlloc, runs the stub, and dumps the decrypted payload. takes about 30 seconds. the decryption loop is native x86 and trivially recognizable.
with the VM, they first have to reverse the interpreter to figure out what the opcodes even mean — and those opcodes are different every build so they can't reuse their work. it's not unbreakable but it's a completely different class of problem.
the current LZ77 is good but it's general purpose. PE files have structure that a general compressor doesn't know about — sections, imports, relocation tables, repeated patterns across the header. a purpose-built PE-aware compressor could exploit all of that.
the plan for v4 is a PE-aware compression pass that runs before LZ77. instead of feeding the raw binary straight into the sliding window, it would pre-process the PE structure first — delta-encoding relocation entries, separating code and data sections, stripping and restoring the header separately. all of that creates streams with way more local repetition, which LZ77 (or any follow-up entropy coder) can then crush much harder.
on top of that we're looking at swapping the backend from LZ77 to LZMA or a custom context-mixing stage. LZ77 is fast but leaves a lot on the table for highly structured data. a context model that understands instruction boundaries could get significantly better ratios on x86/x64 code sections.
no ETA yet. the VM work came first because protection matters more than size. but this is next.
this post was written before v3 shipped. kept for history.
TinyLoad is a simple tool for packing Windows executables. it compresses the input file and encrypts the payload using a custom virtual machine. when the packed executable runs, it spins up a VM interpreter, decrypts the payload, and loads it directly into RAM.
the whole thing is one .cpp file with no external dependencies.
TinyLoad.exe --i app.exe --c
TinyLoad.exe --i app.exe --o packed.exe --vm --c
TinyLoad.exe --i game.exe --vm
| Flag | What it does |
|---|---|
--i <file> |
input executable to pack |
--o <file> |
output path, defaults to inputname_packed.exe |
--vm |
encrypt payload with custom VM, randomized ISA every build |
--c |
compress with LZ77 |
custom hash-chain LZ77 with a 64KB sliding window and deep chain search. uses lazy match evaluation to pick better matches. compression runs on the raw PE first, then VM encryption is applied on top so patterns in the compressed stream are also hidden.
a custom 20-opcode VM interpreter is embedded in the stub. at pack time the opcode table is randomly shuffled — so every packed file has a different instruction set. the decryption program is stored as bytecode with 128-bit keys embedded as immediate values. an analyst has to reverse the interpreter before they can even start on the payload.
grab the source on GitHub or download the latest build: releases.