0

I want to ask if someone can explain me, why I cannot execute a UPX-packed version of the Windows tool: "calc.exe" (32-bit version) on Windows 7 or Windows 10, but on Windows XP the packed "calc.exe" is running without problems (on all conversions I got no errors messages and good packing ratios from about 50%).

Is the reason for this that calc-versions since Windows 7 are using more dependencies like .NET or are somehow protected by a more sophisticated security mechanism of these operating systems?

I am using the latest UPX version 3.94.

Best Regards,

Andreas

Andreas
  • 342
  • 1
  • 10

1 Answers1

2

I would guess the issue is related to the MUI resource and MUI satellite DLLs.

Try using the --compress-resources=0 UPX option. If you want to compress some of the other resources you can try --keep-resource= instead.

If you move/rename Calc.exe you must also make sure you do the same with the .mui file:

md myCompressedCalc
cd myCompressedCalc
copy %windir%\System32\calc.exe .\
md .\en-us
copy %windir%\System32\en-US\calc.exe.mui .\en-us\
upx --compress-resources=0 .\calc.exe
Anders
  • 97,548
  • 12
  • 110
  • 164
  • Thank you for the information about the MUI dependencies, I was not aware of this. I have tried the option `--compress-resources=0` without success, and then played a little bit with the other disabling `win32/pe`-options. But even if I set all options to zero, the result is the same (when I did that, it confused me, that the compression ratio and the file size are always exactly the same as before, so it looks that the deactivation of these options has no effect). – Andreas Jun 25 '17 at 09:21
  • I think I forgot to add the en-US directory. On Windows 10 it seems like that there is no calc.exe.mui, but otherwise it would be too easy ;) – Andreas Jun 28 '17 at 17:48
  • On Windows 10 Calc.exe is probably just a simple launcher for the ugly modern Calculator. – Anders Jun 28 '17 at 20:24