TinyLoad
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
simple PE packer with LZ77 compression and custom VM encryption for Windows executables.
v4 is finally here. We focused heavily on anti-analysis and hardening to make TinyLoad practically invisible to standard debuggers and automated unpackers.
A virtual machine is great for hiding the decryption routine, but it doesn't help if an analyst can just step through it or dump the unpacked payload from memory right before execution. The new anti-debugging mechanisms prevent them from even starting the debugging process.
The section scrambling completely breaks automated tools that rely on specific packer signatures, forcing analysts to manually reverse the VM just to figure out where the payload actually lives.
TinyLoad is a simple tool for packing Windows executables. it compresses the input file and encrypts the payload using a custom virtual machine. when the packed executable runs, it spins up a VM interpreter, decrypts the payload, and loads it directly into RAM.
the whole thing is one .cpp file with no external dependencies.
TinyLoad.exe --i app.exe --c
TinyLoad.exe --i app.exe --o packed.exe --vm --c
TinyLoad.exe --i game.exe --vm
| Flag | What it does |
|---|---|
--i <file> |
input executable to pack |
--o <file> |
output path, defaults to inputname_packed.exe |
--vm |
encrypt payload with custom VM, randomized ISA every build |
--c |
compress with LZ77 |
custom hash-chain LZ77 with a 64KB sliding window and deep chain search. uses lazy match evaluation to pick better matches. compression runs on the raw PE first, then VM encryption is applied on top so patterns in the compressed stream are also hidden.
a custom 32-opcode VM interpreter is embedded in the stub. at pack time the opcode table is randomly shuffled — so every packed file has a different instruction set. the decryption program is stored as bytecode with 128-bit keys embedded as immediate values. v4 also introduces opaque predicates to the VM execution flow, injecting fake traps to halt analysis. an analyst has to completely reverse the interpreter and dodge the traps before they can even start on the payload.
grab the source on GitHub or download the latest build: releases.