UPX Pack/Unpack Converter

UPX (Ultimate Packer for eXecutables) is a widely used open-source executable packer that compresses executable files to reduce their disk footprint. UPX works by compressing the code and data sections of a binary, then adding a decompression stub that restores the original executable at runtime. OurUPX analysis tool scans binary files for telltale signs of UPX packing, including the distinctive "UPX!" magic bytes, UPX-named sections (UPX0, UPX1, UPX2) in PE files, and high-entropy indicators that suggest compressed content.

Our UPX Pack/Unpack Converter analyzes binaries in three major formats: PE (Windows Portable Executable), ELF (Linux Executable and Linkable Format), and Mach-O (macOS/iOS executable format). The tool reads the binary header, parses section tables, detects UPX signatures, calculates Shannon entropy for compression analysis, and generates platform-specific unpacking instructions. All processing runs locally in your browser with no file uploads to any server.

1. 1. File Upload & Type Detection: Drag and drop or browse to select a binary file. The tool reads the first bytes to identify the file format using magic bytes: "MZ" for PE (Windows executables), "\x7fELF" for ELF (Linux binaries), and "feedface"/"cafebabe" for Mach-O (macOS binaries). File type, architecture, and OS target are displayed with high confidence when valid magic bytes are found.
2. 2. UPX Signature Scanning: The engine systematically scans the binary for UPX indicators. It searches for the "UPX!" magic string in the first 64KB of the file, checks for UPX-named sections (UPX0, UPX1) in PE section tables, calculates Shannon entropy across the binary to detect compressed regions, and attempts to extract the UPX version from nearby bytes. Each detected signature is logged with its offset and confidence level.
3. 3. Detailed Report & Unpacking Guidance: Results are presented in an organized dashboard showing file type, packed size, UPX detection status, compression ratio (for PE files), all detected signatures with offsets, a full section header table with raw/virtual sizes and entropy values, and platform-specific unpacking instructions. Toggle the unpacking stub section to view methods ranging from standard upx -d to manual unpacking with debuggers.

• UPX! Magic Signature: The most reliable UPX indicator. UPX embeds the ASCII string "UPX!" (bytes 55 50 58 21) in the decompression stub of packed binaries. This signature appears in all UPX-packed files regardless of the target format (PE, ELF, Mach-O). The tool scans the first 64KB section-by-section to find this signature and logs the exact offset.
• UPX Section Names (PE-specific): When UPX packs a Windows PE file, it replaces the original section names with UPX0 (uninitialized data), UPX1 (compressed data), and sometimes UPX2 (additional compressed data). The original virtual size is preserved in UPX0 (typically very large), while the raw on-disk size is small - this size discrepancy is a strong UPX indicator.
• Entropy Analysis: Compressed or encrypted data has high Shannon entropy (typically 0.7-1.0 on a scale of 0-1). The tool calculates entropy across the binary to identify compressed regions. High entropy combined with UPX signatures provides stronger confidence in the detection.
• Version Fingerprinting: The bytes immediately following the "UPX!" magic often contain version information (e.g., "UPX!4.93"). The tool attempts to extract version strings from context around detected UPX signatures, helping analysts determine which UPX version was used for packing.

The UPX Pack/Unpack Converter is 100% free with no signup required. All binary analysis is performedlocally in your browser using client-side JavaScript - your executables, analysis reports, and detected signaturesnever leave your device. There areno usage limits or rate caps. The tool supports files up to 16MB for analysis, covers PE/ELF/Mach-O formats, detects UPX signatures with version fingerprinting, provides section-level detail, calculates entropy metrics, and generates platform-specific unpacking instructions. Use it as many times as you need for security analysis, education, or research.