7zip >> Sfx optimized - 23,7 kb

[Yuri Grille.]

Sorry if I have grammatical errors I speak Spanish. :=)

Sfx optimized is a optimization of 7zip 4.64 self Extractor.

Download
http://lix.in/-424778

Principal modifications:

No icons and packed whith Upx (3.03W) or Upack (0.39 Final) you can choose.
"I don?t know if ?Upacked? files can be detected as virus in some antivirus"


Differences from original 7z SFX

Original 78,0 KB (79.872 bytes)
Modifiqued 54,3 KB (55.680 bytes) With Upack >> - 23,7 kb
Modifiqued 58,5 KB (59.904 bytes) With UPX --brute >> - 19,5 kb

How to Use:
Copy the files

sfx optimized (Upack)\7z.sfx and
\7zCon.sfx

Or
sfx optimized (Upx) )\7z.sfx and
\7zCon.sfx

And paste in the 7zip folder :
Programs Files\7zip\
\PeaZip\res\7z << If you use PEAZIP >> http://peazip.sourceforge.net/


And overwrite.

For example now Precomp and Precomp confort in 291 >> -100 kb
Download
http://lix.in/-40c0eb


Enjoy.
----------------------
Yuri Grille


thanks to
encode.su and Igor Pavlov

[pat357]

Thanks for the optimized 7z sfx's

For example now Precomp and Precomp confort in 291 >> -100 kb
Download
http://lix.in/-40c0eb

Mine is still better :
precomp in 238 kb !!

http://rapidshare.com/files/218563060/Precomp_237kb_.7z

[m^2]

Thanks for the optimized 7z sfx's

Mine is still better :
precomp in 238 kb !!

http://rapidshare.com/files/218563060/Precomp_237kb_.7z

Just wow...loose 1 minute on extraction to save 0.01 sec. on download.

197,1

[schnaader]

Just wow...loose 1 minute on extraction to save 0.01 sec. on download.

197,1

Sorry, this is wrong - Precomp Comfort doesn't just show a different message and supports drag&drop, it also creates and parses an INI file which you can't do in a small batch file.

Also, still no readme.txt in all your SFXs.

[m^2]

Sorry, this is wrong - Precomp Comfort doesn't just show a different message and supports drag&drop, it also creates and parses an INI file which you can't do in a small batch file.

Also, still no readme.txt in all your SFXs.

I don't see how editing .ini is better than editing a batch.
And readme...who reads them?

But more seriously I totally agree that omitting readme was wrong.
And replacing precomf with a batch wasn't fair, but really I don't see any advantage of your precomf over mine.

[Skymmer]

Sfx optimized is a optimization of 7zip 4.64 self Extractor.

Yuri, please don't mislead people. The SFX stubs you've presented are not from v4.64. These are SFX stubs from v4.47 Beta. Although its not a problem from technical point of view - its absolutely not good from morality one.

Modifiqued 54,3 KB (55.680 bytes) With Upack >> - 23,7 kb
Modifiqued 58,5 KB (59.904 bytes) With UPX --brute >> - 19,5 kb

Just for competition
54 496 bytes with UPack v0.399
58 302 bytes with UPX --brute + post-processing
47 104 bytes with one nasty PE packer

I can upload my variants if somebody interested or you have reasons not to believe me.

[Skymmer]

Mine is still better :
precomp in 238 kb !!
http://rapidshare.com/files/218563060/Precomp_237kb_.7z

Nope ! Here is mine. 234 KB (240 376 bytes)
It contains all files from Precomp v0.4 including Readme.txt. Furthermore it have modified GUI and new installator-like icon. Enjoy !

[m^2]

Where did you get this UDA stub? Is it your work? Made from .exe or from the sources?
Looks very different from the original.
Anyway, another 0.1 KB down.
There's some to be saved by using 16x16 icon.

[Shelwien]

It looks like its allowed to modify the precomp binaries here...
Then you could at least strip the relocations from the dll...
Also, I have a "mapper" script which patches a chunk in file,
then runs the test, and undoes the change if exception occurs
or test fails - it might allow to remove a lot of unused code from
precomp, especially if its only intended for decoding something.
But its a perl script

Also, something like this might be useful too:
http://shelwien.googlepages.com/precompU.rar
(its a precomp.exe merged with packjpg_dll.dll)

[nanoflooder]

Also, something like this might be useful too:
http://shelwien.googlepages.com/precompU.rar
(its a precomp.exe merged with packjpg_dll.dll)

Oh, this is useful even regardless this somewhat strange competition

[Skymmer]

Where did you get this UDA stub? Is it your work? Made from .exe or from the sources?
Looks very different from the original.

Yes, its my work. Made from exe-file, not from the sources. AFAIK there are no sources for WinUDA.
By the way, making modified WinUDA is a little bit complicated process. Dwing used a nice and simple trick. Actualy WinUDA SFX is WinUDA itself prepended to .uda archive. At runtime WinUDA code checks the file size it have been executed from and if its 18 146 bytes or smaller it shows up the main window, if bigger - then it shows 'Extract to' dialog which you see when you start the SFX. Further. WinUDA packed with UPack (by Dwing too). It can be unpacked in different ways but the most "clean" unpack (at least for WinUDA) is done with PE Explorer. Now you can use some resource editor. I'm personally prefer old good Resource hacker. But your torment doesn't ends up here
You need to shape your resulting file to 18 146 bytes or smaller. I advise you to use Upack v0.399 combined with UPack Optimizer to achieve the minimally smaller result. In my case it was lc=4 fb=13 and 18 144 bytes of resulting file. Then I just appended 2 zero bytes to exe-file to have the same 18 146 byte modified WinUDA.
Yes, you can make it smaller. I was managed to pack it into ~15KB but unfortunately WinUDA code makes its judgements in very narrow range. It gives me the error with smaller image, although I believe some small changes in size are acceptable. Well, now you have your own WinUDA

Then you could at least strip the relocations from the dll...

Strange. I'm always thought that stripping the relocs from DLL will make it dead or its true only when you gonna pack DLL with some PE packer ? For example UPX docs say that UPX never strips relocs from DLL even when you use --strip-relocs=1. Thanks for tip.

231.5

Ohh, I think its time to put the cards on the table. Here's my strike
It's slow as hell and requires SSE2 from your CPU but its supplied with simple but natural installator, i.e. information screen and predefined path - C:\Program Files\Precomp, not the folder you're starting it from.
By the way, nice 0D 0A -> 0A trick.

227 KB (232 480 bytes)

[m^2]

Yes, its my work. Made from exe-file, not from the sources. AFAIK there are no sources for WinUDA.
By the way, making modified WinUDA is a little bit complicated process. Dwing used a nice and simple trick. Actualy WinUDA SFX is WinUDA itself prepended to .uda archive. At runtime WinUDA code checks the file size it have been executed from and if its 18 146 bytes or smaller it shows up the main window, if bigger - then it shows 'Extract to' dialog which you see when you start the SFX. Further. WinUDA packed with UPack (by Dwing too). It can be unpacked in different ways but the most "clean" unpack (at least for WinUDA) is done with PE Explorer. Now you can use some resource editor. I'm personally prefer old good Resource hacker. But your torment doesn't ends up here
You need to shape your resulting file to 18 146 bytes or smaller. I advise you to use Upack v0.399 combined with UPack Optimizer to achieve the minimally smaller result. In my case it was lc=4 fb=13 and 18 144 bytes of resulting file. Then I just appended 2 zero bytes to exe-file to have the same 18 146 byte modified WinUDA.
Yes, you can make it smaller. I was managed to pack it into ~15KB but unfortunately WinUDA code makes its judgements in very narrow range. It gives me the error with smaller image, although I believe some small changes in size are acceptable. Well, now you have your own WinUDA



Strange. I'm always thought that stripping the relocs from DLL will make it dead or its true only when you gonna pack DLL with some PE packer ? For example UPX docs say that UPX never strips relocs from DLL even when you use --strip-relocs=1. Thanks for tip.



Ohh, I think its time to put the cards on the table. Here's my strike
It's slow as hell and requires SSE2 from your CPU but its supplied with simple but natural installator, i.e. information screen and predefined path - C:\Program Files\Precomp, not the folder you're starting it from.
By the way, nice 0D 0A -> 0A trick.

227 KB (232 480 bytes)

RAR sfx treated with .kkrunchy and starting PAQ8p? Cool.
There's still a lot to gain, but I'm too lazy. At least today.
TODO:
-I don't think that PAQ8p is the best choice, it has too many contexts that are unused.
-I guess that it was compiled with speed, not size optimizations.
-You didn't use the strongest mode.
-Why RAR sfx? Because it was the first that could autostart the given program that came to your mind? A custom one would give 12 KB gain easily. Or even better: make a .bat dropper. ~15 KB.

What did you use to compress PAQ? My PEID definitions fail here.

[Skymmer]

RAR sfx treated with .kkrunchy and starting PAQ8p? Cool.

Thanks

Why RAR sfx? Because it was the first that could autostart the given program that came to your mind?

No. Actualy the first tool which came in my mind was aPackage. It has tiny ~6 KB stub but it has some issues. First of all aPackage itself and output SFXes are causing false antivirus alerts. More exactly speaking Win32.HLLW.MyBot. Seems that some not very good person used aPackage for wrapping the evil stuff. Second. aPackage has no option for just storing the files, aPLib compression used anyway and its results was about 30 KB larger than uncompressed size. I tried to unpack the stub but failed. Seems its packed with 32Lite 0.03. Then yes, WinRAR SFX. Small and with usefull functionality. As you see it works

What did you use to compress PAQ? My PEID definitions fail here.

I think you guessed the name of the packer by viewing the stub in HEX, cause its same packer used for RAR SFX. Damn, how I forgot to clear the header
Its kkrunchy v0.23a4_asm07. Totally impractical for common tasks cause it uses PAQ based compression with small decompression code which is very good for DemoScene its aimed for. Well, PAQ packed by PAQ
By the way, here is the little present for you.

[kkrunchy 0.23 (a3\a3neu\a3neuneu\a4asm07) -> Ryg]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 45 04 89 45 58 50 C7 45 10 ?? ?? ?? ?? FF 4D 0C FF 45 14 FF 45 5C C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? ?? 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE ?? ?? ?? ?? 31 DB B1 04 83 F3 01 8A 24 1F 80 FC 02 76 0F 0F B6 C4 8B 04 85 ?? ?? ?? ?? C1 E0 02 FE
ep_only = true

[m^2]

Thanks



No. Actualy the first tool which came in my mind was aPackage. It has tiny ~6 KB stub but it has some issues. First of all aPackage itself and output SFXes are causing false antivirus alerts. More exactly speaking Win32.HLLW.MyBot. Seems that some not very good person used aPackage for wrapping the evil stuff. Second. aPackage has no option for just storing the files, aPLib compression used anyway and its results was about 30 KB larger than uncompressed size. I tried to unpack the stub but failed. Seems its packed with 32Lite 0.03. Then yes, WinRAR SFX. Small and with usefull functionality. As you see it works



I think you guessed the name of the packer by viewing the stub in HEX, cause its same packer used for RAR SFX. Damn, how I forgot to clear the header
Its kkrunchy v0.23a4_asm07. Totally impractical for common tasks cause it uses PAQ based compression with small decompression code which is very good for DemoScene its aimed for. Well, PAQ packed by PAQ
By the way, here is the little present for you.

Yes, I identified the stub by first looking at it in a binary files viewer, then reading memory when it was unpacked...strangely my PEID guessed correctly that it's a rar sfx (most likely it recognizes the rar header), but I didn't believe it.
Thanks for the signature.

[nimdamsk]

Virustotal can help anyway
http://www.virustotal.com/en/analisi...44f255643dbb75

[Skymmer]

Yes, this is the biggest problem of PE packers - antivirus alerts. All companies I've seen so far are lazy to include the proper detection and static unpacking routine for every packer around. I even seen the false alert on file protected with well known Themida protector. Well, with endless bag of Chinese packers its almost impossible. Although there are some diamonds in there, like Upack for example

[m^2]

Yes, this is the biggest problem of PE packers - antivirus alerts. All companies I've seen so far are lazy to include the proper detection and static unpacking routine for every packer around. I even seen the false alert on file protected with well known Themida protector. Well, with endless bag of Chinese packers its almost impossible. Although there are some diamonds in there, like Upack for example

Yes, once I distributed a program packed with Upack. After some time people started telling me about false positives. I screwed them (it was a 30-minute one built on request, I didn't want to give any support).
After a year sb. showed me a Virustotal scan showing 85% positives, 1 or 2 were correctly recognizing Upack, the rest showed some random stuff.

Antiviruses are crappy nowadays...

[nanoflooder]

And they will always be.

GNU/Linux ftw

[m^2]

And they will always be.

GNU/Linux ftw

Yes, they can't be perfect, but the current situation it's really bad...

But Linux is not a solution. Currently ~1% of computers use it. Majority of them is administrated by geeks or professionals. It's not a good target for crapware now, but when it becomes popular (if ever), it won't be safe anymore.

[nanoflooder]

If this was an OS-related forum (or topic) I woulda told you the main difference in security of Windows and Unix-like systems, and why Windows can be damaged by crapware (and there is no real way to "escape" from that) and *nix don't, but that's quite a long story, so I won't kill your time with that

[Vacon]

Hello everyone,

If this was an OS-related forum (or topic) I woulda told you the main difference in security of Windows and Unix-like systems, and why Windows can be damaged by crapware (and there is no real way to "escape" from that) and *nix don't, but that's quite a long story, so I won't kill your time with that

http://encode.su/forum/showthread.php?t=194


Best regards!

[m^2]

Hello everyone,



http://encode.su/forum/showthread.php?t=194


Best regards!

You're right, thank you for this suggestion. Encode, could you move this OT there?

If this was an OS-related forum (or topic) I woulda told you the main difference in security of Windows and Unix-like systems, and why Windows can be damaged by crapware (and there is no real way to "escape" from that) and *nix don't, but that's quite a long story, so I won't kill your time with that

There is only one big issue with Windows - it's users who prefer comfort over security and work with admin rights. There are technical ones, but much smaller. Patchable, but MS has no reason to patch some holes (like SetWindowsHookEx) because nobody uses them for malicious stuff. And nobody uses them because when you have admin rights, you don't need them.
I know Linux very little, but I seriously doubt it's security is unbreakable. Though I'd like to read a bit more about it's security concepts. I don't ask you to elaborate, but if you know some good overview, I'd gladly read it.
If you want to drop it off your heart, that's good for me too.