+ v7 adds runtime memory encryption, overlay structural obfuscation, and tamper detection. The payload is never fully decrypted in memory at any point — pages are decrypted on first access and re-encrypted after 200ms of idle time. +
+ ++ Previous versions protected the payload at rest and wiped imports on load. v7 ensures the payload is never fully decrypted in memory at any given moment — even if an analyst dumps the process, most pages are encrypted XOR noise. The watchdog re-encrypt cycle means the window to capture decrypted code is at most 200ms per page. +
++ The overlay hardening means finding where the payload starts requires extracting and hashing the stub's .text section to derive stubKey. The chunk splitting, interleaving, and encrypted metadata make static overlay carving impractical. +
+ ++ v6 doesn't just hide the payload — it hides the stub itself. Every major function is now flattened through indirect dispatch tables, the VM interpreter has no recognizable switch statement, and the opcode decoder is split across four independently-keyed tables. +
+ +tryRun is broken into 6 stages dispatched through a function pointer table — no linear flow to trace. The PE loader (runInMem) is split into 5 stages using the same pattern.noiseDecrypt() fires at scattered points — every stage, every 64 VM iterations. Real sdec2 calls (IAT hooking) are drowned in identical-looking decoys. Dynamic traces become useless.
+ v5 protected the payload. v6 protects the protector. Every major code path in the stub now runs through indirect function calls — the control flow graph is a web, not a tree. The VM interpreter has no switch statement to fingerprint. String decryption calls that used to be precise markers for "here's where the stub reads encrypted data" are now indistinguishable from noise. An analyst can't tell which sdec2 call is real and which is a decoy without executing every path.
+
+ The split opcode decoder means even if you recover one subtable key — perhaps by guessing that HLT always maps to opcode 0 — you only get 8 opcodes. The remaining 20 are behind three different keys derived from different data. +
+v5 doubles down on anti-analysis. The payload is now worthless without the stub at runtime — dumping from memory gets you a broken executable with no import table. @@ -72,12 +240,12 @@
IsDebuggerPresent and CheckRemoteDebuggerPresent) and abort payload execution before decryption even starts.HLT) and halts.
+ VM Opaque Predicates: Inserted fake branching logic into the custom VM. If you try to reverse or manually alter the execution flow during debugging, it drops into a trap (`HLT`) and halts.
.text, .data, .rdata, etc.) using generic names, blending perfectly into the background and avoiding automated packer detection.
+ PE Section Scrambling: Instead of having obvious packer-specific structural anomalies, TinyLoad v4 intercepts the executable before writing it to disk and rewrites all the section headers (`.text`, `.data`, `.rdata`, etc.) using generic names, blending perfectly into the background and avoiding automated packer detection.
TinyLoad.exe --i app.exe --c TinyLoad.exe --i app.exe --o packed.exe --vm --c -TinyLoad.exe --i game.exe --vm -+TinyLoad.exe --i app.exe --vm --c --veh + -
| Flag | What it does | @@ -136,6 +305,10 @@ TinyLoad.exe --i game.exe --vm--c |
compress with LZ77 |
|---|---|---|---|
--veh |
+ VEH page-fault decryption | +
a custom 28-opcode VM interpreter is embedded in the stub. at - pack time the opcode table is split into four 8-entry subtables, each XOR-encrypted with an independent key. + pack time the opcode table is split into four 8-entry subtables, each XOR-encrypted with an independent key — so every packed file has a different instruction set spread across multiple decode layers. the decryption program is stored as bytecode with 128-bit keys embedded as immediate values. v6 replaces the switch-based dispatch with a computed-goto jump table built from encrypted label offsets. @@ -162,16 +335,9 @@ TinyLoad.exe --i game.exe --vm
- v6 flattens every major function through indirect dispatch tables. the self-extraction entry point (tryRun) is 6 stages called through a function pointer array. the PE loader (runInMem) is 5 stages using the same pattern. string decryption is pre-loaded once and then re-triggered as noise at scattered points.
-
- v6 redirects critical payload imports through stub-resident wrappers and wipes the import directory after loading. a dumped payload has no import table and IAT entries pointing into dead addresses. automated reconstruction is impossible — every slot must be manually reversed.
+ --veh maps all PE section pages as PAGE_NOACCESS. A vectored exception handler decrypts pages on first access and restores their original section protection (PAGE_EXECUTE_READ for .text, PAGE_READONLY for .rdata). A watchdog thread re-encrypts pages after 200ms of inactivity with a 256-slot LRU cache. Memory dumps capture only recently-accessed pages — cold pages remain encrypted XOR noise.