← back to til

UPX magic bytes can be swapped to block automated unpacking

Standard UPX uses the magic bytes UPX! (0x55505821). Swapping them to anything else (e.g. TRTW / 0x54525457) causes upx -d to throw NotPackedException while the binary still unpacks and runs fine at runtime. Four bytes of friction against automated tools.