I have an ELF file and want to know if it is UPX packed. How can I detect UPX compression in GNU/Linux?
How to check if an ELF file is UPX packed?
linux;upx
Okay, assuming vanilla UPX you should be fine by detecting the strings UPX! or UPX0. As far as I remember this would also work on Windows.So it's a shell one-liner such as:grep UPX\! <filename>orgrep UPX0 <filename>... assuming the GNU version of grep here.Another method, but using the same principle:$ hexdump -C <filename> |grep -C 1 UPX000000a0  00 00 00 00 00 00 00 00  00 00 20 00 00 00 00 00  |.......... .....|000000b0  c3 af e9 18 55 50 58 21  20 08 0d 16 00 00 00 00  |....UPX! .......|000000c0  a0 fd 16 00 a0 fd 16 00  38 02 00 00 c6 00 00 00  |........8.......|--0000cf60  fe 61 03 83 78 b5 54 03  67 8b 85 2d ca a8 12 3c  |.a..x.T.g..-...<|0000cf70  44 ad bc 12 ab 7e 86 55  50 58 30 0e 01 ee 7c 64  |D....~.UPX0...|d|0000cf80  00 f7 d1 80 4a 11 03 58  6e ac 0d 01 ff 92 83 e8  |....J..Xn.......|--000544e0  73 20 66 69 6c 65 20 69  73 20 70 61 63 6b 65 64  |s file is packed|000544f0  20 77 69 74 68 20 74 68  65 20 55 50 58 20 65 78  | with the UPX ex|00054500  65 63 75 74 61 62 6c 65  20 70 61 63 6b 65 72 20  |ecutable packer |00054510  68 74 74 70 3a 2f 2f 75  70 78 2e 73 66 2e 6e 65  |http://upx.sf.ne|00054520  74 20 24 0a 00 24 49 64  3a 20 55 50 58 20 33 2e  |t $..$Id: UPX 3.|00054530  30 38 20 43 6f 70 79 72  69 67 68 74 20 28 43 29  |08 Copyright (C)|--00054e40  7d 24 24 92 b7 0c 7f 12  01 a8 24 49 92 ff 00 00  |}$$.......$I....|00054e50  00 00 55 50 58 21 00 00  00 00 00 00 55 50 58 21  |..UPX!......UPX!|00054e60  0d 16 08 07 80 44 b5 80  b9 9a 8a d9 a0 08 00 00  |.....D..........|